diff --git a/.agents/domain_knowledge_prompt.md b/.agents/domain_knowledge_prompt.md
new file mode 100644
index 000000000..9d4327e3e
--- /dev/null
+++ b/.agents/domain_knowledge_prompt.md
@@ -0,0 +1,286 @@
+# Create Domain Knowledge File
+
+This guide outlines best practices for creating domain knowledge files in the `.agents/knowledge/` folder. These files serve as a source of truth for understanding the Sail Operator architecture, patterns, and implementation details.
+
+## Naming Convention
+
+- Use kebab-case for filenames: `domain-knowledge-component-name.md`
+- Use descriptive names that clearly indicate the content: `domain-knowledge-api-types.md`, `domain-knowledge-controllers.md`, etc.
+- Prefix all files with `domain-knowledge-` for consistency
+
+## Structure
+
+Each domain knowledge file should follow this structure:
+
+1. **Title**: Clear, descriptive title at the top using H1 (`# Title`)
+2. **Introduction**: Brief overview of what the document explains
+3. **Conceptual Overview**: High-level explanation of the concept or component
+4. **Implementation Architecture**: Key components and their relationships
+5. **Code Implementation**: Relevant code patterns with examples
+6. **Key Interfaces/Models**: Important data structures, interfaces, or protocols
+7. **Example Use Cases**: Real-world examples of how the component is used
+8. **Best Practices**: Guidelines for working with this component
+9. **Related Components**: Links to other domain knowledge files that relate to this one
+
+## Content Guidelines
+
+### 1. Technical Depth
+
+- Balance high-level concepts with implementation details
+- Include enough information for new developers to understand the system
+- Reference specific file paths for key implementations
+- Show actual code examples, not just descriptions
+
+### 2. Code Examples
+
+- Include small, focused code snippets that illustrate key patterns
+- Reference file paths above each code example
+- Use Go syntax highlighting for Go code examples
+- Keep examples concise, focusing on the most important patterns
+
+Example:
+```go
+// From controllers/istio/istio_controller.go
+func (r *IstioReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+    log := r.Log.WithValues("istio", req.NamespacedName)
+
+    // Fetch the Istio instance
+    istio := &v1.Istio{}
+    if err := r.Get(ctx, req.NamespacedName, istio); err != nil {
+        return ctrl.Result{}, client.IgnoreNotFound(err)
+    }
+
+    return r.reconcile(ctx, istio)
+}
+```
+
+### 3. Component Relationships
+
+- Clearly explain how components interact with each other
+- Use numbered lists or flow descriptions to show sequences
+- Explain communication patterns between services
+
+### 4. File References
+
+- Include complete file paths to make it easy to find implementations
+- Group related files by functionality or component
+- List both interface/contract files and implementations
+
+Example:
+```
+Sail Operator Istio Custom Resources:
+- API Definitions: api/v1/istio_types.go
+- Controller Implementation: controllers/istio/istio_controller.go
+- Status Management: controllers/istio/istio_status.go
+- Helm Integration: pkg/helm/istio_installer.go
+- Version Management: pkg/istioversion/version_resolver.go
+```
+
+### 5. Best Practices
+
+- Include best practices specific to the component
+- Highlight common pitfalls and how to avoid them
+- Show code examples of proper usage patterns
+
+## Required Sections for Common Component Types
+
+### API Components (Custom Resources)
+
+- Resource specification structure
+- Status field definitions
+- Validation patterns
+- Controller reconciliation flow
+- Example resource manifests
+
+### Controller Components
+
+- Reconciliation patterns
+- Error handling strategies
+- Status update patterns
+- Event recording
+- Example controller implementations
+
+### Testing Components
+
+- Test structure patterns
+- Mock/fake usage
+- Integration test setup
+- E2E test scenarios
+- Platform-specific considerations (macOS/Podman)
+
+### Helm Integration
+
+- Chart management patterns
+- Values processing
+- Version compatibility
+- Platform customization
+- Troubleshooting approaches
+
+### Version Management
+
+- Version resolution logic
+- Compatibility matrices
+- Upgrade strategies
+- Chart selection
+- Validation patterns
+
+## Example Domain Knowledge File Structure
+
+```markdown
+# Sail Operator [Component Name] Domain Knowledge
+
+Brief introduction explaining the purpose and importance of this component in the Sail Operator.
+
+## Overview
+
+High-level conceptual explanation of how this component works within the Sail Operator ecosystem.
+
+## Architecture
+
+How this component fits into the Sail Operator system:
+- Relationship to Istio control plane management
+- Integration with Kubernetes operator patterns
+- Connection to other Sail Operator components
+
+## Implementation Details
+
+### Key Patterns
+
+Important implementation patterns specific to Sail Operator with code examples.
+
+### Component Flow
+
+Step-by-step explanation of how data/requests flow through the component:
+1. User creates/updates Custom Resource
+2. Controller receives reconciliation request
+3. Component processes the change
+4. Istio components are updated/configured
+5. Status is reported back
+
+## Key Files
+
+List of critical files with their purposes:
+- API definitions in `api/v1/`
+- Controller implementations in `controllers/`
+- Business logic in `pkg/`
+- Tests in `tests/`
+
+## Examples
+
+### Basic Usage
+```yaml
+apiVersion: sailoperator.io/v1
+kind: [ResourceType]
+metadata:
+  name: example
+spec:
+  # Component-specific configuration
+```
+
+### Advanced Configuration
+Real-world examples showing complex scenarios.
+
+## Testing Patterns
+
+### Unit Tests
+- Location: `[component]_test.go` files
+- Framework: Standard Go testing
+- Patterns: Table-driven tests for business logic
+
+### Integration Tests
+- Location: `tests/integration/`
+- Framework: Ginkgo + Gomega + envtest
+- Focus: Controller behavior with fake Kubernetes API
+
+### E2E Tests
+- Location: `tests/e2e/`
+- Framework: Ginkgo + Gomega + real clusters
+- Scenarios: Complete workflow validation
+
+## Best Practices
+
+Guidelines for working with this component effectively:
+- Follow Kubernetes operator patterns
+- Use controller-runtime best practices
+- Implement proper error handling and status reporting
+- Ensure compatibility with multiple Istio versions
+
+## Platform Considerations
+
+### macOS Development
+- Reference `docs/macos/develop-on-macos.adoc` for Podman setup
+- Use `CONTAINER_CLI=podman` for container operations
+- Consider architecture differences (ARM64 vs AMD64)
+
+### OpenShift
+- Special considerations for OpenShift deployments
+- Security context constraints
+- Network policy requirements
+
+### Multi-Platform Testing
+- KIND cluster setup variations
+- Container runtime differences
+- Architecture-specific image handling
+
+## Troubleshooting
+
+Common issues and solutions:
+- Controller reconciliation failures
+- Resource status not updating
+- Platform-specific deployment issues
+
+## Related Components
+
+Links to related Sail Operator domain knowledge files:
+- [API Types](knowledge/domain-knowledge-api-types.md)
+- [Controllers](knowledge/domain-knowledge-controllers.md)
+- [Testing Framework](knowledge/domain-knowledge-testing-framework.md)
+- [Version Management](knowledge/domain-knowledge-version-management.md)
+```
+
+## Maintenance
+
+- Update domain knowledge files when Sail Operator components change significantly
+- Keep code examples current with the latest Sail Operator implementation patterns
+- Add new domain knowledge files when new Sail Operator features are added
+- Review and update Istio version compatibility information regularly
+- Update platform-specific guidance when new platforms are supported
+
+## Sail Operator Specific Considerations
+
+When creating domain knowledge files, include these Sail Operator-specific elements:
+
+### Istio Integration
+- Explain how the component relates to Istio control plane management
+- Document Helm chart integration patterns
+- Reference Istio version compatibility requirements
+- Include examples of Istio configuration values
+
+### Kubernetes Operator Patterns
+- Follow controller-runtime best practices
+- Document Custom Resource specifications
+- Explain status field usage and condition patterns
+- Include proper RBAC considerations
+
+### Multi-Version Support
+- Document how components handle multiple Istio versions
+- Explain version resolution and compatibility checking
+- Include upgrade and downgrade scenarios
+
+### Platform Support
+- **macOS Development**: Reference `docs/macos/develop-on-macos.adoc` for Podman setup
+- **OpenShift**: Document OCP-specific requirements (CNI, SCC, etc.)
+- **KIND/minikube**: Include local development cluster considerations
+- **Multi-architecture**: ARM64 vs AMD64 deployment differences
+
+### Testing Integration
+- Reference Sail Operator testing framework patterns
+- Include examples from `tests/integration/` and `tests/e2e/`
+- Document test environment setup (envtest, KIND, OCP)
+- Explain container runtime alternatives (Docker vs Podman)
+
+### Development Workflow
+- Reference Sail Operator Makefile targets
+- Include examples of local development workflows
+- Document debugging approaches specific to operator development
+- Explain SEP (Sail Enhancement Proposal) process for API changes
\ No newline at end of file
diff --git a/.agents/knowledge/domain-knowledge-api-types.md b/.agents/knowledge/domain-knowledge-api-types.md
new file mode 100644
index 000000000..9b20373b1
--- /dev/null
+++ b/.agents/knowledge/domain-knowledge-api-types.md
@@ -0,0 +1,228 @@
+# Sail Operator API Types Domain Knowledge
+
+This document provides AI agents with detailed knowledge about the Sail Operator's Custom Resource Definitions (CRDs) and API types.
+
+## Core Custom Resources
+
+### Istio Resource
+The primary resource for managing Istio control plane deployments.
+
+**Key Fields:**
+- `spec.version` - Istio version to install (defaults to operator's default version)
+- `spec.namespace` - Target namespace for control plane (default: `istio-system`, immutable)
+- `spec.profile` - Built-in installation profile (e.g., `default`, `ambient`, `openshift`)
+- `spec.values` - Helm values for customizing Istio installation
+- `spec.updateStrategy.type` - Update strategy: `InPlace` (default) or `RevisionBased`
+- `spec.updateStrategy.inactiveRevisionDeletionGracePeriodSeconds` - Seconds before removing inactive revision (default: 30)
+- `spec.updateStrategy.updateWorkloads` - Automatically move workloads to new revision (default: false)
+
+**Status Fields:**
+- `status.state` - Current state: `Healthy`, `Installing`, `Updating`, `Error`, etc.
+- `status.activeRevisionName` - Name of the active IstioRevision
+- `status.revisions` - Summary of all managed revisions
+
+### IstioRevision Resource
+Represents a specific deployment of Istio control plane components.
+
+**Key Fields:**
+- `spec.version` - Exact Istio version for this revision
+- `spec.namespace` - Installation namespace
+- `spec.values` - Helm configuration values
+
+**Status Fields:**
+- `status.state` - Revision state: `Installing`, `Healthy`, `Failed`, etc.
+- `status.conditions` - Detailed condition information
+
+### IstioCNI Resource
+Manages the Istio CNI plugin (required for OpenShift and Ambient mesh).
+
+**Key Fields:**
+- `spec.version` - CNI plugin version (must match Istio version)
+- `spec.namespace` - CNI installation namespace (default: `istio-cni`, immutable)
+- `spec.profile` - Built-in installation profile
+- `spec.values` - CNI-specific Helm values
+
+**Note:** The resource name must be `default` (validated by CRD).
+
+### ZTunnel Resource
+Manages ZTunnel workloads for Istio Ambient mesh mode.
+
+**Key Fields:**
+- `spec.version` - ZTunnel version (must match Istio version)
+- `spec.namespace` - ZTunnel namespace (default: `ztunnel`)
+- `spec.values` - ZTunnel configuration values
+
+**Note:** The resource name must be `default` (validated by CRD). ZTunnel was promoted to v1 API; a v1alpha1 version still exists for backwards compatibility.
+
+### IstioRevisionTag Resource
+Creates revision tags for canary deployments and traffic shifting. References an Istio or IstioRevision object and serves as an alias for sidecar injection.
+
+**Key Fields:**
+- `spec.targetRef.kind` - Kind of target resource (`Istio` or `IstioRevision`)
+- `spec.targetRef.name` - Name of the target resource
+
+**Status Fields:**
+- `status.istioRevision` - Name of the referenced IstioRevision
+- `status.istiodNamespace` - Namespace of the corresponding Istiod instance
+
+## Common Patterns
+
+### Profile Configuration
+Istio and IstioCNI resources support profiles for predefined configuration sets:
+- `ambient` - Ambient mesh configuration
+- `default` - Default Istio configuration (always applied)
+- `demo` - Demo configuration with additional features
+- `empty` - Empty profile
+- `openshift` - OpenShift-specific configuration (auto-applied on OpenShift)
+- `openshift-ambient` - OpenShift with Ambient mesh
+- `preview` - Preview features
+- `remote` - Remote cluster configuration
+- `stable` - Stable production configuration
+
+### Values Configuration
+All resources support Helm values via the `values` field:
+
+```yaml
+spec:
+  values:
+    global:
+      variant: distroless
+      logging:
+        level: "all:info"
+    meshConfig:
+      trustDomain: cluster.local
+      defaultConfig:
+        proxyStatsMatcher:
+          inclusionRegexps:
+            - ".*outlier_detection.*"
+```
+
+### Version Management
+- Versions are specified as semantic versions (e.g., `1.25.0`)
+- If no version specified, uses operator's default supported version
+- Version compatibility is enforced by the operator
+
+### Resource Relationships
+1. `Istio` → creates/manages → `IstioRevision`
+2. `IstioRevisionTag` → references → `Istio`
+3. Ambient mode requires: `Istio` + `IstioCNI` + `ZTunnel`
+4. Sidecar mode requires: `Istio` (+ `IstioCNI` on OpenShift)
+
+## Status Conditions
+
+All resources use standard Kubernetes condition patterns:
+
+**Common Condition Types:**
+- `Ready` - Resource is ready and operational
+- `Reconciled` - Last reconciliation was successful
+- `ReconcileError` - Reconciliation encountered errors
+
+**Condition Status Values:**
+- `True` - Condition is active/successful
+- `False` - Condition is inactive/failed
+- `Unknown` - Condition state is uncertain
+
+## Update Strategies
+
+### InPlace Strategy
+- Updates existing revision in-place
+- Faster but with brief control plane downtime
+- Default strategy
+
+### RevisionBased Strategy
+- Creates new revision alongside existing one
+- Enables canary deployments and zero-downtime updates
+- Requires manual traffic shifting via IstioRevisionTag
+
+## Validation Rules
+
+### Version Constraints
+- Must use supported Istio versions (defined in `versions.yaml`)
+- CNI and ZTunnel versions must be compatible with Istio version
+- Revision names must be unique within namespace
+
+### Namespace Requirements
+- Control plane namespace must exist before creating Istio resource
+- CNI deployed to `istio-cni` namespace
+- ZTunnel deployed to `ztunnel` namespace
+
+### Resource Dependencies
+- IstioCNI must be deployed before Istio in Ambient mode
+- ZTunnel requires both Istio and IstioCNI to be ready
+- Removing Istio resource removes all associated IstioRevisions
+
+## Generated Types
+
+The `api/v1/values_types.gen.go` file contains auto-generated types from Istio's Helm values schema:
+
+- **Values** - Root Helm values structure
+- **GlobalConfig** - Global Istio configuration
+- **PilotConfig** - Istiod (Pilot) specific configuration
+- **ProxyConfig** - Sidecar proxy configuration
+- **MeshConfig** - Service mesh configuration
+
+These types ensure type-safe access to all Istio configuration options.
+
+## Common Configuration Examples
+
+### Basic Istio Installation
+```yaml
+apiVersion: sailoperator.io/v1
+kind: Istio
+metadata:
+  name: default
+spec:
+  namespace: istio-system
+```
+
+### Ambient Mesh Setup
+```yaml
+# 1. CNI (required for Ambient)
+apiVersion: sailoperator.io/v1
+kind: IstioCNI
+metadata:
+  name: default
+spec:
+  namespace: istio-cni
+  profile: ambient
+
+# 2. Control Plane
+apiVersion: sailoperator.io/v1
+kind: Istio
+metadata:
+  name: default
+spec:
+  namespace: istio-system
+  profile: ambient
+
+# 3. ZTunnel
+apiVersion: sailoperator.io/v1
+kind: ZTunnel
+metadata:
+  name: default
+spec:
+  namespace: ztunnel
+```
+
+### Revision-Based Canary Deployment
+```yaml
+# Main Istio resource with RevisionBased strategy
+apiVersion: sailoperator.io/v1
+kind: Istio
+metadata:
+  name: default
+spec:
+  namespace: istio-system
+  updateStrategy:
+    type: RevisionBased
+
+# Revision tag pointing to the Istio resource
+apiVersion: sailoperator.io/v1
+kind: IstioRevisionTag
+metadata:
+  name: stable
+spec:
+  targetRef:
+    kind: Istio
+    name: default
+```
\ No newline at end of file
diff --git a/.agents/knowledge/domain-knowledge-controllers.md b/.agents/knowledge/domain-knowledge-controllers.md
new file mode 100644
index 000000000..3e032c8c9
--- /dev/null
+++ b/.agents/knowledge/domain-knowledge-controllers.md
@@ -0,0 +1,235 @@
+# Sail Operator Controllers Domain Knowledge
+
+This document provides AI agents with detailed knowledge about the Sail Operator's Kubernetes controllers and their reconciliation logic.
+
+## Controller Architecture
+
+The Sail Operator uses the controller-runtime framework with separate controllers for each Custom Resource. Controllers are located in `controllers/<resource>/` directories:
+
+- **IstioController** (`controllers/istio/`) - Manages `Istio` resources and their lifecycle
+- **IstioRevisionController** (`controllers/istiorevision/`) - Manages `IstioRevision` resources and Helm deployments
+- **IstioCNIController** (`controllers/istiocni/`) - Manages `IstioCNI` resources for CNI plugin
+- **ZTunnelController** (`controllers/ztunnel/`) - Manages `ZTunnel` resources for Ambient mesh
+- **IstioRevisionTagController** (`controllers/istiorevisiontag/`) - Manages `IstioRevisionTag` resources for canary deployments
+- **WebhookController** (`controllers/webhook/`) - Manages MutatingWebhookConfiguration for Istio resources
+
+## Controller Reconciliation Patterns
+
+### IstioController (`controllers/istio/istio_controller.go`)
+
+**Primary Responsibilities:**
+- Creates and manages `IstioRevision` resources based on `Istio` spec
+- Handles update strategies (InPlace vs RevisionBased)
+- Manages revision lifecycle and cleanup
+- Updates `Istio` status with active revision information
+
+**Reconciliation Flow:**
+1. Validate Istio version compatibility
+2. Determine if new revision is needed (version change, config change)
+3. Create new `IstioRevision` if required
+4. Wait for revision to become Ready
+5. For InPlace strategy: cleanup old revision
+6. For RevisionBased: keep both revisions for canary deployment
+7. Update Istio status with active revision
+
+**Key Functions:**
+- `getDesiredIstioRevision()` - Calculates desired revision configuration
+- `updateRevisionIfNeeded()` - Handles revision updates
+- `pruneOldRevisions()` - Cleanup logic for old revisions
+
+### IstioRevisionController (`controllers/istiorevision/istiorevision_controller.go`)
+
+**Primary Responsibilities:**
+- Installs/upgrades Istio using Helm charts
+- Manages Istio component deployments (istiod, gateways, etc.)
+- Handles Helm value validation and templating
+- Reports installation status and health
+
+**Reconciliation Flow:**
+1. Validate revision version and configuration
+2. Fetch Istio Helm charts for specified version
+3. Generate Helm values from IstioRevision spec
+4. Install/upgrade Helm release
+5. Wait for all components to be ready
+6. Update IstioRevision status
+
+**Key Functions:**
+- `installOrUpdateRevision()` - Helm installation logic
+- `validateValues()` - Helm values validation
+- `checkComponentHealth()` - Health monitoring
+
+### IstioCNIController (`controllers/istiocni/istiocni_controller.go`)
+
+**Primary Responsibilities:**
+- Deploys Istio CNI plugin as DaemonSet
+- Manages CNI configuration and RBAC
+- Handles OpenShift-specific CNI requirements
+- Coordinates with Istio control plane
+
+**Reconciliation Flow:**
+1. Validate CNI version compatibility
+2. Generate CNI-specific Helm values
+3. Install CNI DaemonSet and configuration
+4. Verify CNI pods are running on all nodes
+5. Update IstioCNI status
+
+### ZTunnelController (`controllers/ztunnel/ztunnel_controller.go`)
+
+**Primary Responsibilities:**
+- Deploys ZTunnel DaemonSet for Ambient mesh
+- Manages ztunnel configuration and certificates
+- Handles node-level ztunnel deployment
+- Integrates with Istio CA for certificate management
+
+**Reconciliation Flow:**
+1. Verify Ambient mesh prerequisites (CNI + Istio)
+2. Generate ZTunnel configuration
+3. Deploy ztunnel DaemonSet
+4. Configure certificate rotation
+5. Update ZTunnel status
+
+### IstioRevisionTagController (`controllers/istiorevisiontag/istiorevisiontag_controller.go`)
+
+**Primary Responsibilities:**
+- Creates revision tags for canary deployments
+- Manages ValidatingAdmissionWebhook configuration
+- Handles tag-to-revision mapping
+- Enables traffic shifting between revisions
+
+**Reconciliation Flow:**
+1. Validate target IstioRevision exists and is ready
+2. Create/update ValidatingAdmissionWebhook with tag
+3. Configure webhook to inject tag label
+4. Update IstioRevisionTag status
+
+### WebhookController (`controllers/webhook/webhook_controller.go`)
+
+**Primary Responsibilities:**
+- Manages ValidatingAdmissionWebhook lifecycle
+- Handles webhook certificate rotation
+- Coordinates webhook configuration across revisions
+- Manages admission webhook for sidecar injection
+
+## Common Controller Patterns
+
+### Status Management
+All controllers follow standard Kubernetes status patterns:
+
+```go
+// Update condition
+condition := metav1.Condition{
+    Type:   "Ready",
+    Status: metav1.ConditionTrue,
+    Reason: "InstallationComplete",
+    Message: "Istio installation completed successfully",
+}
+meta.SetStatusCondition(&resource.Status.Conditions, condition)
+
+// Update status
+if err := r.Status().Update(ctx, resource); err != nil {
+    return ctrl.Result{}, err
+}
+```
+
+### Error Handling and Requeuing
+Controllers use exponential backoff for error recovery:
+
+```go
+// Requeue with exponential backoff
+if err != nil {
+    return ctrl.Result{RequeueAfter: time.Second * 30}, err
+}
+
+// Immediate requeue for configuration changes
+if configChanged {
+    return ctrl.Result{Requeue: true}, nil
+}
+```
+
+### Resource Ownership
+Controllers establish ownership relationships for garbage collection:
+
+```go
+// Set owner reference for child resources
+if err := controllerutil.SetControllerReference(parent, child, r.Scheme); err != nil {
+    return err
+}
+```
+
+### Finalizer Management
+Controllers use finalizers for cleanup coordination:
+
+```go
+// Add finalizer
+if !controllerutil.ContainsFinalizer(resource, finalizerName) {
+    controllerutil.AddFinalizer(resource, finalizerName)
+    return r.Update(ctx, resource)
+}
+
+// Remove finalizer after cleanup
+controllerutil.RemoveFinalizer(resource, finalizerName)
+return r.Update(ctx, resource)
+```
+
+## Controller Dependencies
+
+### Startup Order
+1. **IstioCNIController** - Deploys CNI plugin first
+2. **IstioController/IstioRevisionController** - Deploys control plane
+3. **ZTunnelController** - Deploys ztunnel (Ambient only)
+4. **IstioRevisionTagController** - Creates revision tags
+5. **WebhookController** - Manages admission webhooks
+
+### Inter-Controller Communication
+Controllers coordinate through:
+- **Status Conditions** - Ready/Error states
+- **Labels/Annotations** - Metadata passing
+- **Owner References** - Hierarchy relationships
+- **Events** - Audit trail and debugging
+
+## Debugging Controllers
+
+### Common Issues
+1. **Resource Not Found** - Check owner references and namespace
+2. **Permission Denied** - Verify RBAC in `config/rbac/`
+3. **Helm Failures** - Check Helm values and chart compatibility
+4. **Status Not Updating** - Verify status subresource access
+
+### Debugging Commands
+```bash
+# Check controller logs
+kubectl logs -n sail-operator deployment/sail-operator-controller
+
+# Describe resource status
+kubectl describe istio -n istio-system
+
+# Check events
+kubectl events --for istio/default -n istio-system
+
+# Debug Helm releases
+helm list -n istio-system
+helm status <release-name> -n istio-system
+```
+
+### Controller Metrics
+Controllers expose metrics for monitoring:
+- `controller_runtime_reconcile_total` - Reconciliation attempts
+- `controller_runtime_reconcile_errors_total` - Reconciliation errors
+- `controller_runtime_reconcile_time_seconds` - Reconciliation duration
+
+## Testing Controllers
+
+### Unit Tests
+- Mock Kubernetes clients using `controller-runtime/pkg/client/fake`
+- Test reconciliation logic with various resource states
+- Verify status updates and condition management
+
+### Integration Tests
+- Use `envtest` for testing against real Kubernetes API
+- Test controller interactions and resource lifecycle
+- Verify garbage collection and finalizer behavior
+
+### E2E Tests
+- Test complete workflows on real clusters
+- Verify Istio functionality after operator deployment
+- Test upgrade scenarios and error recovery
\ No newline at end of file
diff --git a/.agents/knowledge/domain-knowledge-helm-integration.md b/.agents/knowledge/domain-knowledge-helm-integration.md
new file mode 100644
index 000000000..f31771783
--- /dev/null
+++ b/.agents/knowledge/domain-knowledge-helm-integration.md
@@ -0,0 +1,258 @@
+# Sail Operator Helm Integration Domain Knowledge
+
+This document provides AI agents with detailed knowledge about how the Sail Operator integrates with Istio Helm charts for deployment and configuration management.
+
+## Helm Integration Overview
+
+The Sail Operator uses Istio's official Helm charts to deploy and manage Istio components. Instead of embedding charts, it dynamically downloads them from Istio's release repositories.
+
+## Chart Management
+
+### Chart Discovery
+Charts are downloaded from Istio's GitHub releases:
+- **Base Chart**: `istio/manifests/charts/base`
+- **Istiod Chart**: `istio/manifests/charts/istio-control/istio-discovery`
+- **CNI Chart**: `istio/manifests/charts/istio-cni`
+- **ZTunnel Chart**: `istio/manifests/charts/ztunnel`
+- **Gateway Charts**: `istio/manifests/charts/gateways/*`
+
+### Chart Caching
+- Charts are cached locally to avoid repeated downloads
+- Cache invalidated when Istio version changes
+- Supports air-gapped environments with pre-cached charts
+
+## Values Processing
+
+### Values Hierarchy
+The operator merges values from multiple sources (highest to lowest priority):
+
+1. **User-provided values** - `spec.values` in custom resources
+2. **Vendor defaults** - `pkg/istiovalues/vendor_defaults.yaml`
+3. **Operator defaults** - Built-in safe defaults
+4. **Chart defaults** - Default values from Helm charts
+
+### Values Transformation
+Values undergo several transformations:
+
+```go
+// Example transformation pipeline
+rawValues := getUserValues(resource.Spec.Values)
+vendorDefaults := loadVendorDefaults()
+operatorDefaults := getOperatorDefaults()
+
+// Merge with precedence
+finalValues := merge(operatorDefaults, vendorDefaults, rawValues)
+
+// Apply transformations
+transformedValues := applyTransformations(finalValues, resource)
+```
+
+### Common Value Transformations
+- **Namespace injection** - Automatically set target namespaces
+- **Revision naming** - Generate consistent revision names
+- **Resource limits** - Apply operator-managed resource constraints
+- **Security contexts** - Inject security policies for specific platforms
+
+## Helm Release Management
+
+### Release Naming Convention
+- **Istio**: `istio-<revision-name>`
+- **CNI**: `istio-cni-<resource-name>`
+- **ZTunnel**: `ztunnel-<resource-name>`
+
+### Release Lifecycle
+1. **Pre-install validation** - Validate values and dependencies
+2. **Install/Upgrade** - Deploy charts using Helm SDK
+3. **Post-install verification** - Verify component readiness
+4. **Status tracking** - Monitor release health
+5. **Cleanup** - Remove releases when resources are deleted
+
+### Helm SDK Usage
+The operator uses Helm's Go SDK for chart operations:
+
+```go
+// Example Helm install
+cfg := &action.Configuration{}
+client := action.NewInstall(cfg)
+client.ReleaseName = releaseName
+client.Namespace = targetNamespace
+client.CreateNamespace = true
+
+release, err := client.Run(chart, values)
+```
+
+## Chart Customization
+
+### Platform-Specific Adjustments
+Charts are customized for different Kubernetes platforms:
+
+#### OpenShift
+- **Security Context Constraints** - Apply OpenShift SCC policies
+- **Route vs Ingress** - Use OpenShift Routes instead of Ingress
+- **Network Policies** - Apply OpenShift-specific network policies
+
+#### GKE/EKS/AKS
+- **Cloud provider integrations** - Configure load balancers
+- **Node selectors** - Platform-specific node targeting
+- **Storage classes** - Use cloud-native storage
+
+### Resource Customization
+Common resource customizations:
+
+```yaml
+# Resource limits and requests
+resources:
+  limits:
+    cpu: 500m
+    memory: 2Gi
+  requests:
+    cpu: 100m
+    memory: 128Mi
+
+# Node affinity and tolerations
+nodeSelector:
+  node-role.kubernetes.io/control-plane: ""
+tolerations:
+- key: CriticalAddonsOnly
+  operator: Exists
+```
+
+## Values Schema Validation
+
+### Generated Types
+The `api/v1/values_types.gen.go` file contains Go types generated from Istio's Helm values schema, providing:
+- **Type safety** - Compile-time validation of configuration
+- **IntelliSense** - IDE support for configuration
+- **Documentation** - Embedded field documentation
+
+### Runtime Validation
+Values are validated at runtime:
+1. **Schema validation** - Against Istio's JSON schema
+2. **Compatibility checks** - Version-specific validation
+3. **Platform validation** - Platform-specific requirements
+4. **Security validation** - Security policy compliance
+
+## Common Configuration Patterns
+
+### Basic Control Plane
+```yaml
+spec:
+  values:
+    global:
+      meshID: mesh1
+      network: network1
+    pilot:
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+```
+
+### Multi-Cluster Configuration
+```yaml
+spec:
+  values:
+    global:
+      meshID: mesh1
+      network: network1
+      remotePilotAddress: pilot.istio-system.svc.cluster.local
+    istiodRemote:
+      enabled: true
+```
+
+### Ambient Mesh Configuration
+```yaml
+# Istio
+spec:
+  values:
+    pilot:
+      env:
+        PILOT_ENABLE_AMBIENT: true
+    global:
+      waypoint:
+        affinity: {}
+
+# CNI
+spec:
+  values:
+    cni:
+      ambient:
+        enabled: true
+
+# ZTunnel
+spec:
+  values:
+    ztunnel:
+      image: istio/ztunnel
+```
+
+### Production Hardening
+```yaml
+spec:
+  values:
+    global:
+      proxy:
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+          limits:
+            cpu: 2000m
+            memory: 1024Mi
+    pilot:
+      resources:
+        requests:
+          cpu: 500m
+          memory: 2048Mi
+      env:
+        PILOT_ENABLE_WORKLOAD_ENTRY_AUTOREGISTRATION: false
+        PILOT_ENABLE_CROSS_CLUSTER_WORKLOAD_ENTRY: false
+```
+
+## Troubleshooting Helm Integration
+
+### Common Issues
+1. **Chart download failures** - Network connectivity or version issues
+2. **Values validation errors** - Schema violations or incompatible values
+3. **Release conflicts** - Conflicting Helm releases in same namespace
+4. **Resource quotas** - Insufficient cluster resources
+
+### Debugging Commands
+```bash
+# Check Helm releases
+helm list -A | grep istio
+
+# Debug release status
+helm status istio-base -n istio-system
+
+# Get release values
+helm get values istio-base -n istio-system
+
+# Check release history
+helm history istio-base -n istio-system
+```
+
+### Values Debugging
+```bash
+# Export effective values
+kubectl get istio default -o jsonpath='{.spec.values}' | jq .
+
+# Check operator logs for values processing
+kubectl logs -n sail-operator deployment/sail-operator-controller | grep values
+```
+
+## Version Compatibility
+
+### Supported Versions
+The operator maintains compatibility with multiple Istio versions:
+- Defined in `pkg/istioversion/versions.yaml`
+- Supports n-2 versioning policy
+- Automatic compatibility validation
+
+### Chart Compatibility Matrix
+Different Istio versions may have breaking changes in chart structure:
+- **Values schema changes** - New/removed configuration options
+- **Resource definitions** - Changed Kubernetes resources
+- **Default behaviors** - Modified default configurations
+
+The operator handles these through version-specific transformation logic.
\ No newline at end of file
diff --git a/.agents/knowledge/domain-knowledge-testing-framework.md b/.agents/knowledge/domain-knowledge-testing-framework.md
new file mode 100644
index 000000000..8d48c4abc
--- /dev/null
+++ b/.agents/knowledge/domain-knowledge-testing-framework.md
@@ -0,0 +1,383 @@
+# Sail Operator Testing Framework Domain Knowledge
+
+This document provides AI agents with detailed knowledge about the Sail Operator's testing framework, methodologies, and best practices.
+
+## Testing Architecture
+
+The Sail Operator uses a multi-layered testing approach:
+
+### Unit Tests
+- **Framework**: Standard Go testing (`testing` package)
+- **Location**: Alongside source code files (`*_test.go`)
+- **Purpose**: Test individual functions and business logic
+- **Execution**: `make test`
+
+### Integration Tests
+- **Framework**: Ginkgo + Gomega + envtest
+- **Location**: `tests/integration/`
+- **Purpose**: Test controller behavior against fake Kubernetes API
+- **Execution**: `make test.integration`
+
+### End-to-End Tests
+- **Framework**: Ginkgo + Gomega + real clusters
+- **Location**: `tests/e2e/`
+- **Purpose**: Test complete operator functionality on real clusters
+- **Execution**: `make test.e2e.kind` or `make test.e2e.ocp`
+
+## Integration Testing Framework
+
+### Setup and Configuration
+Integration tests use `envtest` to create a fake Kubernetes control plane:
+
+```go
+// Example suite setup
+var _ = BeforeSuite(func() {
+    testEnv = &envtest.Environment{
+        CRDDirectoryPaths: []string{
+            filepath.Join("..", "..", "config", "crd", "bases"),
+        },
+    }
+
+    cfg, err := testEnv.Start()
+    Expect(err).NotTo(HaveOccurred())
+
+    k8sClient, err = client.New(cfg, client.Options{
+        Scheme: scheme.Scheme,
+    })
+    Expect(err).NotTo(HaveOccurred())
+})
+```
+
+### Testing Patterns
+Integration tests follow Ginkgo BDD patterns:
+
+```go
+var _ = Describe("IstioController", func() {
+    Context("when creating an Istio resource", func() {
+        BeforeEach(func() {
+            // Setup test resources
+        })
+
+        When("the resource is valid", func() {
+            It("should create an IstioRevision", func() {
+                // Test assertions
+                Eventually(func() error {
+                    return k8sClient.Get(ctx, key, &istioRevision)
+                }).Should(Succeed())
+            })
+        })
+
+        AfterEach(func() {
+            // Cleanup test resources
+        })
+    })
+})
+```
+
+### Key Testing Utilities
+- **envtest.Environment** - Fake Kubernetes API server
+- **client.Client** - Kubernetes API client for assertions
+- **Eventually/Consistently** - Async operation testing
+- **BeforeEach/AfterEach** - Test setup/teardown
+
+## End-to-End Testing Framework
+
+### Test Structure
+E2E tests are organized by functionality:
+
+```
+tests/e2e/
+├── ambient/              # Ambient mesh functionality tests
+├── controlplane/         # Control plane installation and update tests
+├── dualstack/            # Dual-stack networking tests
+├── multicluster/         # Multi-cluster scenarios (primary-remote, multi-primary, external control plane)
+├── multicontrolplane/    # Multiple control plane tests
+├── operator/             # Operator deployment and installation tests
+├── samples/              # Sample application tests
+├── setup/                # Test setup utilities
+└── util/                 # Shared utilities (cleaner, kubectl, helm, etc.)
+```
+
+### Cluster Management
+E2E tests support multiple cluster types:
+
+#### KIND Clusters
+- Automated setup via `integ-suite-kind.sh`
+- Uses upstream Istio provisioning scripts
+- Configurable with environment variables
+
+#### OpenShift Clusters
+- Uses existing OCP cluster
+- Setup via `integ-suite-ocp.sh`
+- Requires `oc` login and permissions
+
+### Test Execution Environments
+
+#### Containerized Execution (Default)
+```bash
+# Run in container (default)
+make test.e2e.kind
+
+# Specify container runtime
+CONTAINER_CLI=podman make test.e2e.kind
+```
+
+#### Local Execution
+```bash
+# Run locally without container
+BUILD_WITH_CONTAINER=0 make test.e2e.kind
+```
+
+### Test Configuration Variables
+
+#### Core Configuration
+- `SKIP_BUILD=false` - Skip operator image build
+- `SKIP_DEPLOY=false` - Skip operator deployment
+- `IMAGE=quay.io/sail-dev/sail-operator:latest` - Operator image
+- `OCP=true` - Use OpenShift cluster
+- `OLM=true` - Deploy via OLM instead of Helm
+
+#### Test Behavior
+- `GINKGO_FLAGS` - Pass flags to Ginkgo runner
+- `NAMESPACE=sail-operator` - Operator namespace
+- `CONTROL_PLANE_NS=istio-system` - Istio namespace
+- `EXPECTED_REGISTRY=^docker\.io|^gcr\.io` - Expected image registry
+- `KEEP_ON_FAILURE=false` - Keep cluster on test failure
+
+#### Custom Samples
+- `CUSTOM_SAMPLES_PATH` - Path to custom kustomize samples
+- `HTTPBIN_KUSTOMIZE_PATH` - Custom httpbin samples
+- `HELLOWORLD_KUSTOMIZE_PATH` - Custom helloworld samples
+- `SLEEP_KUSTOMIZE_PATH` - Custom sleep samples
+
+### Test Labels and Filtering
+
+Tests use labels for categorization and selective execution:
+
+```go
+var _ = Describe("Ambient configuration", Label("smoke", "ambient"), func() {
+    // Test implementation
+})
+```
+
+Common labels:
+- **smoke** - Basic functionality tests
+- **ambient** - Ambient mesh specific tests
+- **sidecar** - Sidecar injection tests
+- **multicluster** - Multi-cluster scenarios
+- **upgrade** - Version upgrade tests
+
+### Test Utilities
+
+#### Resource Management
+```go
+import "github.com/istio-ecosystem/sail-operator/tests/e2e/util/cleaner"
+
+// Automatic resource cleanup
+clr := cleaner.New(cl)
+BeforeAll(func(ctx SpecContext) {
+    clr.Record(ctx)  // Record initial state
+})
+AfterAll(func(ctx SpecContext) {
+    clr.Cleanup(ctx)  // Remove added resources
+})
+```
+
+#### kubectl and helm Utilities
+```go
+import (
+    "github.com/istio-ecosystem/sail-operator/tests/e2e/util/kubectl"
+    "github.com/istio-ecosystem/sail-operator/tests/e2e/util/helm"
+)
+
+// Execute kubectl commands
+kubectl.Apply(namespace, yamlContent)
+kubectl.Delete(namespace, resourceType, resourceName)
+
+// Helm operations
+helm.Install(releaseName, chartPath, namespace, values)
+helm.Uninstall(releaseName, namespace)
+```
+
+#### Client-based Assertions
+```go
+// Use Kubernetes client for reliable assertions
+Eventually(func() error {
+    var istio v1.Istio
+    return k8sClient.Get(ctx, client.ObjectKey{
+        Name: "default",
+        Namespace: "istio-system",
+    }, &istio)
+}).Should(Succeed())
+
+// Check resource status
+Expect(istio.Status.State).To(Equal(v1.IstioReady))
+```
+
+## Testing Best Practices
+
+### Unit Test Guidelines
+1. **Isolation** - Test individual functions without Kubernetes dependencies
+2. **Mocking** - Use interfaces and mocks for external dependencies
+3. **Table-driven tests** - Use test tables for multiple scenarios
+4. **Error testing** - Test both success and failure cases
+
+```go
+func TestCalculateRevisionName(t *testing.T) {
+    tests := []struct {
+        name     string
+        input    string
+        expected string
+    }{
+        {"valid version", "1.25.0", "default-1-25-0"},
+        {"version with patch", "1.25.1", "default-1-25-1"},
+    }
+
+    for _, tt := range tests {
+        t.Run(tt.name, func(t *testing.T) {
+            result := calculateRevisionName("default", tt.input)
+            assert.Equal(t, tt.expected, result)
+        })
+    }
+}
+```
+
+### Integration Test Guidelines
+1. **Real API behavior** - Test controller interactions with Kubernetes API
+2. **Async testing** - Use `Eventually`/`Consistently` for async operations
+3. **Resource cleanup** - Always clean up created resources
+4. **Status testing** - Verify status conditions and state transitions
+
+### E2E Test Guidelines
+1. **User scenarios** - Test realistic user workflows
+2. **End-to-end validation** - Verify complete functionality
+3. **Resource cleanup** - Use cleaner utility for automatic cleanup
+4. **Platform coverage** - Test on different Kubernetes distributions
+
+### Common Testing Patterns
+
+#### Testing Controller Reconciliation
+```go
+It("should reconcile Istio resource", func() {
+    // Create resource
+    istio := &v1.Istio{
+        ObjectMeta: metav1.ObjectMeta{
+            Name: "test-istio",
+            Namespace: "istio-system",
+        },
+        Spec: v1.IstioSpec{
+            Version: "1.25.0",
+        },
+    }
+    Expect(k8sClient.Create(ctx, istio)).To(Succeed())
+
+    // Verify reconciliation results
+    Eventually(func() error {
+        var revision v1.IstioRevision
+        return k8sClient.Get(ctx, client.ObjectKey{
+            Name: "test-istio-1-25-0",
+            Namespace: "istio-system",
+        }, &revision)
+    }).Should(Succeed())
+})
+```
+
+#### Testing Status Updates
+```go
+It("should update status conditions", func() {
+    Eventually(func() []metav1.Condition {
+        var istio v1.Istio
+        if err := k8sClient.Get(ctx, key, &istio); err != nil {
+            return nil
+        }
+        return istio.Status.Conditions
+    }).Should(ContainElement(MatchFields(IgnoreExtras, Fields{
+        "Type":   Equal("Ready"),
+        "Status": Equal(metav1.ConditionTrue),
+    })))
+})
+```
+
+#### Testing Error Conditions
+```go
+When("invalid configuration is provided", func() {
+    It("should report error condition", func() {
+        // Create resource with invalid config
+        Eventually(func() string {
+            var istio v1.Istio
+            k8sClient.Get(ctx, key, &istio)
+            for _, cond := range istio.Status.Conditions {
+                if cond.Type == "ReconcileError" {
+                    return cond.Status
+                }
+            }
+            return ""
+        }).Should(Equal(metav1.ConditionTrue))
+    })
+})
+```
+
+## Test Execution and CI/CD
+
+### Local Development
+```bash
+# Run all tests
+make test test.integration test.e2e.kind
+
+# Run specific test suites
+make test.integration GINKGO_FLAGS="--focus=IstioController"
+make test.e2e.kind GINKGO_FLAGS="--label-filter=smoke"
+
+# Debug test failures
+KEEP_ON_FAILURE=true make test.e2e.kind
+
+# macOS with Podman (see docs/macos/develop-on-macos.adoc)
+CONTAINER_CLI=podman TARGET_OS=linux TARGET_ARCH=arm64 make test.e2e.kind
+CONTAINER_CLI=podman DOCKER_GID=0 make test.integration
+```
+
+### Continuous Integration
+Tests run automatically on:
+- **Pull requests** - Unit and integration tests
+- **Merge to main** - Full test suite including E2E
+- **Release branches** - Extended test matrix across platforms
+
+### Test Reporting
+- **JUnit XML** - Generated as `report.xml` for CI integration
+- **Coverage reports** - Go coverage for unit/integration tests
+- **Test artifacts** - Logs and cluster state on failures
+
+## Platform-Specific Testing Considerations
+
+### macOS Development with Podman
+For macOS developers using Podman instead of Docker, refer to `docs/macos/develop-on-macos.adoc` for detailed guidance:
+
+#### Common Issues and Solutions
+- **Architecture mismatch**: Use `TARGET_ARCH=arm64` for ARM64 Macs
+- **UID conflicts**: Set `DOCKER_GID=0` to avoid permission issues
+- **Container runtime**: Always specify `CONTAINER_CLI=podman`
+- **KIND compatibility**: Use compatible KIND images for Podman
+
+#### Example Commands
+```bash
+# E2E tests on macOS with Podman
+CONTAINER_CLI=podman TARGET_OS=linux TARGET_ARCH=arm64 make test.e2e.kind
+
+# Integration tests with permission fixes
+CONTAINER_CLI=podman DOCKER_GID=0 make test.integration
+
+# Avoid container for specific targets
+make -f common/Makefile.common.mk update-common
+```
+
+### Container Runtime Considerations
+The testing framework supports both Docker and Podman:
+- **Default**: Docker (`CONTAINER_CLI=docker`)
+- **Alternative**: Podman (`CONTAINER_CLI=podman`)
+- **Local execution**: `BUILD_WITH_CONTAINER=0` to run tests without containers
+
+### Cluster Architecture
+When testing on different architectures:
+- **AMD64**: Default for most CI environments
+- **ARM64**: Common for Apple Silicon Macs
+- **Mixed environments**: Use `TARGET_ARCH` to specify target architecture
\ No newline at end of file
diff --git a/.agents/knowledge/domain-knowledge-version-management.md b/.agents/knowledge/domain-knowledge-version-management.md
new file mode 100644
index 000000000..20e93b92b
--- /dev/null
+++ b/.agents/knowledge/domain-knowledge-version-management.md
@@ -0,0 +1,360 @@
+# Sail Operator Version Management Domain Knowledge
+
+This document provides AI agents with detailed knowledge about how the Sail Operator manages Istio versions, compatibility, and upgrade strategies.
+
+## Version Management Architecture
+
+The Sail Operator follows Istio's versioning scheme and maintains compatibility with multiple Istio versions simultaneously.
+
+## Version Configuration
+
+### Primary Version File
+**Location**: `pkg/istioversion/versions.yaml`
+
+This file defines all supported Istio versions:
+
+```yaml
+versions:
+  # Alias pointing to a specific version (the first entry is the default)
+  - name: v1.X-latest
+    ref: v1.X.Y
+
+  # Full version definition
+  - name: v1.X.Y
+    version: 1.X.Y
+    repo: https://github.com/istio/istio
+    commit: 1.X.Y
+    charts:
+      - https://istio-release.storage.googleapis.com/charts/base-1.X.Y.tgz
+      - https://istio-release.storage.googleapis.com/charts/istiod-1.X.Y.tgz
+      - https://istio-release.storage.googleapis.com/charts/gateway-1.X.Y.tgz
+      - https://istio-release.storage.googleapis.com/charts/cni-1.X.Y.tgz
+      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.X.Y.tgz
+
+  # End-of-life version (still valid input, but not installable)
+  - name: v1.W-latest
+    ref: v1.W.Z
+    eol: true
+  - name: v1.W.Z
+    eol: true
+```
+
+**Note:** Check `pkg/istioversion/versions.yaml` in the repository for the current list of supported versions.
+
+### Version Entry Structure
+- **name** - Human-readable version identifier (e.g., `v1.X.Y`, `v1.X-latest`)
+- **ref** - Reference to another version (for alias entries like `v1.X-latest`)
+- **version** - Semantic version (x.y.z)
+- **repo** - Source repository URL
+- **commit** - Git commit/tag reference
+- **branch** - Git branch (for development versions like `master`)
+- **charts** - List of Helm chart URLs for this version
+- **eol** - Boolean indicating end-of-life (version remains valid but not installable)
+
+### Vendor Customization
+The version file can be customized using the `VERSIONS_YAML_FILE` environment variable:
+
+```bash
+export VERSIONS_YAML_FILE=custom_versions.yaml
+```
+
+This allows downstream vendors to:
+- Define custom version sets
+- Point to different chart repositories
+- Support enterprise or patched Istio versions
+
+## Versioning Policy
+
+### Supported Version Range
+- **Current policy**: n-2 versions (the operator supports the current and two previous minor Istio versions)
+- **Version alignment**: Operator version matches latest supported Istio version
+- **Patch version handling**: Not all Istio patch versions are included
+- **EOL versions**: Versions can be marked with `eol: true` to keep them as valid input but not installable
+
+### Version Lifecycle
+1. **New Istio release** - Add to versions.yaml with charts
+2. **Operator release** - Create corresponding operator version
+3. **Deprecation** - Remove oldest version when adding new one
+4. **End of support** - Remove from versions.yaml
+
+## Default Version Selection
+
+### Automatic Version Selection
+When no version is specified in custom resources:
+
+```go
+// Default version selection logic
+func getDefaultVersion() string {
+    versions := loadSupportedVersions()
+
+    // Find latest stable version
+    for _, version := range versions {
+        if strings.Contains(version.Name, "latest") {
+            return version.Version
+        }
+    }
+
+    // Fallback to newest version
+    return versions[0].Version
+}
+```
+
+### Version Resolution
+The operator resolves versions in this order:
+1. **Explicit version** - User-specified in `spec.version`
+2. **Default version** - Latest stable from versions.yaml
+3. **Fallback** - Operator's built-in default
+
+## Chart Management
+
+### Chart Discovery
+Charts are downloaded from URLs defined in versions.yaml:
+
+```go
+// Chart download logic
+func downloadChart(chartURL string) (*chart.Chart, error) {
+    // Check local cache first
+    if cached := checkCache(chartURL); cached != nil {
+        return cached, nil
+    }
+
+    // Download and cache
+    chartData, err := httpClient.Get(chartURL)
+    if err != nil {
+        return nil, err
+    }
+
+    chart, err := loader.LoadArchive(chartData)
+    if err != nil {
+        return nil, err
+    }
+
+    cacheChart(chartURL, chart)
+    return chart, nil
+}
+```
+
+### Chart Caching Strategy
+- **Local cache** - Charts cached by URL in operator filesystem
+- **Cache invalidation** - Cache cleared when versions.yaml changes
+- **Air-gapped support** - Pre-populate cache for offline environments
+
+### Chart Validation
+Charts undergo validation before use:
+- **Schema validation** - Verify chart structure
+- **Version compatibility** - Ensure chart matches declared version
+- **Dependency checks** - Validate chart dependencies
+
+## Version Compatibility Matrix
+
+### Component Compatibility
+Different Istio components have specific compatibility requirements:
+
+| Component | Version Source | Compatibility Notes |
+|-----------|---------------|-------------------|
+| **Istiod** | Istio version | Core control plane |
+| **CNI** | Same as Istio | Must match Istio version |
+| **ZTunnel** | Same as Istio | Ambient mesh only |
+| **Gateways** | Same as Istio | Optional components |
+
+### Cross-Version Support
+The operator supports mixed versions in specific scenarios:
+- **Canary deployments** - Multiple Istio revisions
+- **Rolling upgrades** - Temporary version coexistence
+- **Multi-cluster** - Different versions across clusters
+
+## Upgrade Strategies
+
+### InPlace Upgrade Strategy
+Default upgrade method with brief downtime:
+
+```yaml
+spec:
+  updateStrategy:
+    type: InPlace
+```
+
+**Process**:
+1. Update existing IstioRevision with new version
+2. Helm upgrade control plane components
+3. Restart workloads if necessary
+4. Validate new version health
+
+### RevisionBased Upgrade Strategy
+Zero-downtime upgrades using canary deployments:
+
+```yaml
+spec:
+  updateStrategy:
+    type: RevisionBased
+```
+
+**Process**:
+1. Create new IstioRevision with new version
+2. Deploy new control plane alongside existing
+3. Use IstioRevisionTag for traffic shifting
+4. Remove old revision when upgrade complete
+
+### Upgrade Validation
+Before performing upgrades:
+
+```go
+func validateUpgrade(fromVersion, toVersion string) error {
+    // Check version compatibility
+    if !isCompatibleUpgrade(fromVersion, toVersion) {
+        return errors.New("incompatible version upgrade")
+    }
+
+    // Validate breaking changes
+    if hasBreakingChanges(fromVersion, toVersion) {
+        return errors.New("breaking changes detected")
+    }
+
+    // Check operator support
+    if !isSupportedVersion(toVersion) {
+        return errors.New("target version not supported")
+    }
+
+    return nil
+}
+```
+
+## Version-Specific Behaviors
+
+### Feature Flags
+Different Istio versions may require different configurations:
+
+```go
+// Version-specific configuration
+func getVersionSpecificConfig(version string) map[string]interface{} {
+    config := make(map[string]interface{})
+
+    // Ambient mesh support (1.25+)
+    if semver.Compare(version, "1.25.0") >= 0 {
+        config["pilot.env.PILOT_ENABLE_AMBIENT"] = true
+    }
+
+    // New telemetry API (1.26+)
+    if semver.Compare(version, "1.26.0") >= 0 {
+        config["telemetry.v2.enabled"] = true
+    }
+
+    return config
+}
+```
+
+### Deprecation Handling
+The operator handles deprecated features across versions:
+
+```go
+func transformValuesForVersion(values map[string]interface{}, version string) {
+    // Remove deprecated fields for newer versions
+    if semver.Compare(version, "1.26.0") >= 0 {
+        delete(values, "global.legacy")
+    }
+
+    // Add required fields for older versions
+    if semver.Compare(version, "1.25.0") < 0 {
+        values["global.legacy"] = true
+    }
+}
+```
+
+## Version Status and Reporting
+
+### Version Information in Status
+Custom resources report version information:
+
+```yaml
+status:
+  observedGeneration: 1
+  state: Healthy
+  activeRevisionName: default-1-26-0
+  revisions:
+  - name: default-1-26-0
+    version: 1.26.0
+    state: Healthy
+  conditions:
+  - type: Ready
+    status: "True"
+    reason: InstallationComplete
+```
+
+### Version Events
+The operator generates events for version-related activities:
+
+```go
+func recordVersionEvent(obj runtime.Object, eventType, reason, message string) {
+    r.EventRecorder.Event(obj, eventType, reason, message)
+}
+
+// Example usage
+recordVersionEvent(istio, "Normal", "VersionUpgrade",
+    fmt.Sprintf("Upgrading from %s to %s", oldVersion, newVersion))
+```
+
+## Troubleshooting Version Issues
+
+### Common Version Problems
+1. **Unsupported version** - Version not in versions.yaml
+2. **Chart download failure** - Network issues or invalid URLs
+3. **Version mismatch** - Operator/Istio version compatibility
+4. **Upgrade incompatibility** - Breaking changes between versions
+
+### Version Debugging Commands
+
+```bash
+# Check supported versions
+kubectl get cm -n sail-operator sail-operator-versions -o yaml
+
+# Verify current versions
+kubectl get istio -o jsonpath='{.items[*].spec.version}'
+
+# Check version-specific events
+kubectl events --for istio/default --types Warning,Normal
+
+# Validate chart availability
+curl -I https://istio-release.storage.googleapis.com/charts/istiod-1.26.0.tgz
+```
+
+### Version Status Inspection
+
+```bash
+# Check operator's version awareness
+kubectl logs -n sail-operator deployment/sail-operator | grep version
+
+# Verify chart cache
+kubectl exec -n sail-operator deployment/sail-operator -- ls /tmp/charts/
+
+# Check version resolution
+kubectl describe istio default | grep "Version:"
+```
+
+## Custom Version Development
+
+### Adding New Versions
+1. **Update versions.yaml** - Add new version entry with charts
+2. **Test compatibility** - Verify operator works with new version
+3. **Update defaults** - Modify vendor_defaults.yaml if needed
+4. **Test upgrades** - Validate upgrade paths from previous versions
+
+### Version Testing
+```yaml
+# Custom test versions.yaml
+versions:
+  - name: v1.27-dev
+    version: 1.27.0-dev
+    repo: https://github.com/istio/istio
+    commit: main
+    charts:
+      - https://storage.googleapis.com/istio-build/dev/charts/istiod-1.27.0-dev.tgz
+```
+
+### Development Workflow
+```bash
+# Test with custom versions
+VERSIONS_YAML_FILE=test_versions.yaml make test.e2e.kind
+
+# Validate version support
+make test.integration GINKGO_FLAGS="--focus=Version"
+```
\ No newline at end of file
diff --git a/.claude/commands/update-eol-versions.md b/.claude/commands/update-eol-versions.md
new file mode 100644
index 000000000..25d48bb4c
--- /dev/null
+++ b/.claude/commands/update-eol-versions.md
@@ -0,0 +1,68 @@
+# Update EOL Istio Versions
+
+This command automates the process of marking End-of-Life (EOL) Istio versions in the versions.yaml file.
+
+## Tasks
+
+1. **Fetch supported Istio versions** from istio.io:
+   - Visit https://istio.io/latest/docs/releases/supported-releases/ to get the list of currently supported Istio versions
+   - Identify which major.minor versions are still supported upstream
+   - Note the EOL dates for versions that are no longer supported
+
+2. **Analyze what changes are needed**:
+   - Read `pkg/istioversion/versions.yaml` (or the file specified by VERSIONS_YAML_FILE env var)
+   - Compare the current state with the upstream supported versions
+   - Identify versions that need to be marked as EOL (not supported upstream but missing `eol: true`)
+   - Identify versions that need EOL removed (supported upstream but have `eol: true`)
+   - **If no changes are needed**, inform the user that all versions are already up-to-date and STOP
+   - Only proceed to the next steps if changes are required
+
+3. **Create a new git branch** for this update (only if changes are needed):
+   - Branch name should be: `update-eol-versions-YYYY-MM-DD` (use today's date)
+   - Ensure the working directory is clean before creating the branch
+   - If there are uncommitted changes, ask the user what to do
+
+4. **Update versions.yaml**:
+   - For each version entry that needs changes:
+     - If the version is NOT supported upstream and doesn't already have `eol: true`, add `eol: true` to that version entry
+     - If a version has `eol: true` but is still supported upstream, remove the `eol: true` flag (this handles corrections)
+   - Preserve the YAML structure and comments
+   - For EOL versions, keep only `name:`, `eol:` and `ref:` sections
+
+
+5. **Run code generation**:
+   - Execute `make gen` to regenerate all necessary code and manifests
+   - This ensures CRDs and other generated files are updated
+
+6. **Show summary**:
+   - List all versions that were marked as EOL
+   - List all versions that had EOL status removed (if any)
+   - Show the git diff of changes made to versions.yaml
+   - Provide next steps for the user (review changes, run tests, commit, create PR)
+
+## Important Notes
+
+- Only mark versions as EOL if they are confirmed to be EOL upstream Istio [project](https://istio.io/latest/docs/releases/supported-releases/)
+- Preserve all existing version entries - do not remove them from the file
+- The `eol: true` flag makes versions uninstallable but keeps them as valid spec.version values for API compatibility
+- For EOL versions, keep only `name:`, `eol:` and `ref:` sections
+- Show the changes and ask the user to confirm the changes before committing
+
+## Example Version Entry
+
+Before (supported version):
+```yaml
+- name: v1.25.0
+  version: 1.25.0
+  repo: https://github.com/istio/istio
+  commit: 1.25.0
+  charts:
+    - https://istio-release.storage.googleapis.com/charts/base-1.25.0.tgz
+    - https://istio-release.storage.googleapis.com/charts/istiod-1.25.0.tgz
+```
+
+After (EOL version):
+```yaml
+- name: v1.25.0
+  eol: true
+```
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 413028681..bb348965e 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,6 +1,6 @@
 {
   "name": "istio build-tools",
-  "image": "gcr.io/istio-testing/build-tools:master-6ac9cdb3d1ad09092398ab15574ce88cf2ac31ff",
+  "image": "gcr.io/istio-testing/build-tools:master-8dcf63149d5bdaa83d1407a121098e8e8d1626dd",
   "privileged": true,
   "remoteEnv": {
     "USE_GKE_GCLOUD_AUTH_PLUGIN": "True",
diff --git a/.github/workflows/commit-validation.yaml b/.github/workflows/commit-validation.yaml
index 327f8e569..7509af089 100644
--- a/.github/workflows/commit-validation.yaml
+++ b/.github/workflows/commit-validation.yaml
@@ -11,11 +11,18 @@ jobs:
         ref: ${{ github.event.pull_request.head.sha }}
         fetch-depth: 0
 
-    - name: Validate PR commit
+    - name: Get first commit SHA in PR
+      id: first_commit
+      run: |
+        FIRST_COMMIT=$(git rev-list --reverse origin/${{ github.event.pull_request.base.ref }}..HEAD | head -n 1)
+        echo "first_commit_sha=$FIRST_COMMIT" >> $GITHUB_OUTPUT
+
+    - name: Validate the first commit from the PR
       uses: commit-check/commit-check-action@v0.9.2
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
+        commit: ${{ steps.first_commit.outputs.first_commit_sha }}
         message: true
         author-name: true
         author-email: true
diff --git a/.github/workflows/update-deps.yaml b/.github/workflows/update-deps.yaml
index 92b0f1c07..d99b306ec 100644
--- a/.github/workflows/update-deps.yaml
+++ b/.github/workflows/update-deps.yaml
@@ -23,7 +23,7 @@ jobs:
   update-deps:
     runs-on: ubuntu-latest
     container:
-      image: gcr.io/istio-testing/build-tools:master-6ac9cdb3d1ad09092398ab15574ce88cf2ac31ff
+      image: gcr.io/istio-testing/build-tools:master-8dcf63149d5bdaa83d1407a121098e8e8d1626dd
       options: --entrypoint ''
 
     steps:
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 000000000..37cabcbc8
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,172 @@
+# Sail Operator Agent Instructions
+
+This document provides AI coding agents with project-specific context for the Sail Operator, which manages the lifecycle of Istio control planes on Kubernetes.
+
+## Project Overview
+
+The Sail Operator is a Kubernetes operator built to manage Istio service mesh deployments. It provides custom resources (`Istio`, `IstioRevision`, `IstioRevisionTag`, `IstioCNI`, `ZTunnel`) to deploy and manage control plane components.
+
+## Setup Commands
+
+```bash
+# Install CRDs into the cluster
+make install
+
+# Deploy operator to cluster
+make deploy
+
+# Run operator locally (for development)
+make run
+
+# Create local KIND cluster with operator
+make cluster
+
+# Create multi-cluster setup
+make cluster MULTICLUSTER=true
+```
+
+## Development Workflow
+
+```bash
+# Run unit tests
+make test
+
+# Run integration tests
+make test.integration
+
+# Run e2e tests on KIND
+make test.e2e.kind
+
+# Run e2e tests on OpenShift
+make test.e2e.ocp
+
+# Lint and format code
+make lint
+
+# Build operator image
+make build
+
+# macOS with Podman (see docs/macos/develop-on-macos.adoc)
+CONTAINER_CLI=podman make build
+CONTAINER_CLI=podman DOCKER_GID=0 make deploy
+```
+
+## Code Style and Conventions
+
+- **Language**: Go 1.24+ with modules
+- **Framework**: Kubebuilder with controller-runtime
+- **Testing**: Ginkgo/Gomega for E2E/integration tests, standard Go testing for unit tests
+- **Commit signing**: Required with `-s` flag
+- **API changes**: Must be discussed in SEP (Sail Enhancement Proposal) first
+
+## Key Directories
+
+- `api/` - Custom Resource Definitions (CRDs)
+- `pkg/` - Core business logic packages
+- `controllers/` - Kubernetes controllers
+- `tests/integration/` - Integration test suites
+- `tests/e2e/` - End-to-end test suites
+- `chart/` - Helm charts and samples
+- `enhancements/` - SEP (Sail Enhancement Proposal) documents
+- `docs/` - Documentation files
+- `resources/` - Resource manifests for each supported Istio version
+- `hack/` - Development scripts and tools
+
+## Custom Resources
+
+### Primary Resources
+- **Istio**: Main resource representing a control plane
+- **IstioRevision**: Represents a specific control plane deployment
+- **IstioRevisionTag**: Tags for managing active revisions
+- **IstioCNI**: CNI plugin configuration (required for OpenShift/Ambient)
+- **ZTunnel**: Ambient mesh tunnel configuration
+
+### Resource Relationships
+- `Istio` creates and manages `IstioRevision`
+- `IstioRevisionTag` points to an `Istio` or `IstioRevision` resource
+- Ambient mode requires `Istio` + `IstioCNI` + `ZTunnel`
+- Sidecar mode requires `Istio` (+ `IstioCNI` on OpenShift)
+
+## Key Configuration Files
+
+- `pkg/istioversion/versions.yaml` - Supported Istio versions (configurable via VERSIONS_YAML_FILE)
+- `pkg/istiovalues/vendor_defaults.yaml` - Vendor-specific Helm value defaults
+- `go.mod` - Go dependencies and replacements
+
+## Testing Patterns
+
+- **Unit tests**: Use standard Go testing, avoid Kubernetes clients when possible
+- **Integration tests**: Use Ginkgo/Gomega with envtest
+- **E2E tests**: Use Ginkgo/Gomega against real clusters
+- **Test isolation**: Keep business logic in testable packages separate from controllers
+
+## Common Operations
+
+### Adding New API Fields
+1. Modify types in `api/`
+2. Run `make gen` to generate CRDs
+3. Update controllers in `controllers/`
+4. Add tests
+5. Create SEP for significant changes
+
+### Debugging
+- Use `make run` to run operator locally
+- Check controller logs for reconciliation issues
+- Use `kubectl describe` on custom resources for events
+
+## Vendor Considerations
+
+The project supports downstream vendors with custom configurations:
+- Vendor-specific changes should be configuration-based, not code changes
+- Use `VERSIONS_YAML_FILE` environment variable for custom version files
+- Modify `vendor_defaults.yaml` for vendor-specific Helm defaults
+
+## Versioning Policy
+
+- Sail Operator versions follow Istio versioning
+- Supports n-2 Istio releases (the operator supports the current and two previous minor Istio versions)
+- Not all Istio patch versions are included in Sail releases
+- EOL versions remain valid inputs but are not installable
+- Check `pkg/istioversion/versions.yaml` for the current list of supported versions
+
+## Security
+
+- Never commit secrets or credentials
+- Use gitleaks pre-commit hook for secret scanning
+- Follow Kubernetes security best practices
+- Sign all commits with `-s` flag
+- Add comments to all git commits (e.g., -m "Fix typo in README" -m "Fixes #123")
+
+## Troubleshooting
+
+- **CRD issues**: Ensure `make install` was run
+- **Image pull errors**: Verify HUB/TAG environment variables
+- **Local development**: Use `export HUB=localhost:5000` for KIND clusters and KIND registry
+- **Controller errors**: Check logs and resource events
+- **macOS with Podman**: See `docs/macos/develop-on-macos.adoc` for platform-specific guidance
+
+## Integration with Istio
+
+The operator deploys Istio using Helm charts and follows Istio's configuration patterns:
+- Uses official Istio Helm charts
+- Supports all standard Istio configuration via `values` field
+- Manages Istio lifecycle (install, upgrade, uninstall)
+- Handles revision-based upgrades
+
+## Domain Knowledge
+
+For detailed technical knowledge about specific areas of the Sail Operator, refer to these domain-specific documents:
+
+### API and Resource Management
+- **[API Types and CRDs](.agents/knowledge/domain-knowledge-api-types.md)** - Detailed knowledge about Custom Resource Definitions, API types, validation rules, and resource relationships
+- **[Controllers Architecture](.agents/knowledge/domain-knowledge-controllers.md)** - Controller reconciliation patterns, error handling, debugging, and inter-controller communication
+
+### Development and Operations
+- **[Helm Integration](.agents/knowledge/domain-knowledge-helm-integration.md)** - Chart management, values processing, platform customization, and troubleshooting
+- **[Testing Framework](.agents/knowledge/domain-knowledge-testing-framework.md)** - Unit/integration/E2E testing methodologies, utilities, and best practices
+- **[Version Management](.agents/knowledge/domain-knowledge-version-management.md)** - Version compatibility, upgrade strategies, chart management, and troubleshooting
+
+### Creating New Domain Knowledge
+- **[Domain Knowledge Creation Guide](.agents/domain_knowledge_prompt.md)** - Template and guidelines for creating new domain knowledge files
+
+Each domain knowledge file provides deep, technical details that complement the high-level guidance in this document. Use them for specific implementation questions and detailed understanding of system behavior.
\ No newline at end of file
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 000000000..aa9a92ef5
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,5 @@
+# Claude Code Instructions
+
+This file imports AGENTS.md, which serves as the primary agent instructions document for all AI coding agents working with this repository.
+
+@AGENTS.md
diff --git a/Makefile.core.mk b/Makefile.core.mk
index cd3f40fda..ba311f027 100644
--- a/Makefile.core.mk
+++ b/Makefile.core.mk
@@ -154,6 +154,8 @@ BUNDLE_MANIFEST_DATE := $(shell cat bundle/manifests/${OPERATOR_NAME}.clusterser
 BUNDLE_IMG ?= $(IMAGE_TAG_BASE)-bundle:v$(VERSION)
 
 # BUNDLE_GEN_FLAGS are the flags passed to the operator-sdk generate bundle command
+# We are overwriting the version as we are appending a suffix for nightly builds,
+# otherwise it would be taken directly from helm values.
 BUNDLE_GEN_FLAGS ?= -q --overwrite --version $(VERSION) $(BUNDLE_METADATA_OPTS)
 
 # USE_IMAGE_DIGESTS defines if images are resolved via tags or digests
@@ -171,6 +173,8 @@ endif
 # Default values and flags used when rendering chart templates locally
 HELM_VALUES_FILE ?= chart/values.yaml
 HELM_TEMPL_DEF_FLAGS ?= --include-crds --values $(HELM_VALUES_FILE)
+# When true, all operand images will be added to the HELM_VALUES_FILE automatically
+PATCH_HELM_VALUES ?= true
 
 TODAY ?= $(shell date -I)
 
@@ -512,10 +516,12 @@ operator-chart: download-istio-charts # pull the charts first as they are requir
 	sed -i -e "s/^\(version: \).*$$/\1${VERSION}/g" \
 	       -e "s/^\(appVersion: \).*$$/\1\"${VERSION}\"/g" chart/Chart.yaml
 	sed -i -e "s|^\(image: \).*$$|\1${IMAGE}|g" \
-	       -e "s/^\(  version: \).*$$/\1${VERSION}/g" chart/values.yaml
+	       -e "s/^\(  version: \).*$$/\1${VERSION}/g" ${HELM_VALUES_FILE}
 	# adding all component images to values
 	# when building the bundle, helm generated base CSV is passed to the operator-sdk. With USE_IMAGE_DIGESTS=true, operator-sdk replaces all pullspecs with tags by digests and adds spec.relatedImages field automatically
-	@hack/patch-values.sh chart/values.yaml
+ifeq ($(PATCH_HELM_VALUES), true)
+	@hack/patch-values.sh ${HELM_VALUES_FILE}
+endif
 
 .PHONY: update-istio
 update-istio: ## Update the Istio commit hash in the 'latest' entry in versions.yaml to the latest commit in the branch.
@@ -525,6 +531,12 @@ update-istio: ## Update the Istio commit hash in the 'latest' entry in versions.
 update-istio-samples: ## Update the Istio samples files located in the samples folder to match the latest Istio upstream version of the charts.
 	@hack/update-istio-samples.sh
 
+.PHONY: update-deps
+update-deps: ## Update all dependencies including tools, Go modules, and operator components.
+	@echo "Running dependency update script..."
+	@tools/update_deps.sh
+	@echo "Dependency update completed successfully."
+
 .PHONY: print-variables
 print-variables: ## Print all Makefile variables; Useful to inspect overrides of variables.
 	$(foreach v,                                        \
@@ -551,15 +563,15 @@ RUNME ?= $(LOCALBIN)/runme
 MISSPELL ?= $(LOCALBIN)/misspell
 
 ## Tool Versions
-OPERATOR_SDK_VERSION ?= v1.41.1
-HELM_VERSION ?= v3.19.0
+OPERATOR_SDK_VERSION ?= v1.42.0
+HELM_VERSION ?= v3.19.2
 CONTROLLER_TOOLS_VERSION ?= v0.19.0
 CONTROLLER_RUNTIME_BRANCH ?= release-0.22
-OPM_VERSION ?= v1.60.0
-OLM_VERSION ?= v0.34.0
-GITLEAKS_VERSION ?= v8.28.0
+OPM_VERSION ?= v1.61.0
+OLM_VERSION ?= v0.38.0
+GITLEAKS_VERSION ?= v8.29.1
 ISTIOCTL_VERSION ?= 1.26.2
-RUNME_VERSION ?= 3.15.3
+RUNME_VERSION ?= 3.16.1
 MISSPELL_VERSION ?= v0.3.4
 
 .PHONY: helm $(HELM)
diff --git a/PROJECT b/PROJECT
index 2c90bbbb3..73239a351 100644
--- a/PROJECT
+++ b/PROJECT
@@ -50,5 +50,5 @@ resources:
   domain: sailoperator.io
   kind: ZTunnel
   path: github.com/istio-ecosystem/sail-operator/api/v1alpha1
-  version: v1alpha1
+  version: v1
 version: "3"
diff --git a/README.md b/README.md
index 78c7d8d24..180d29e4a 100644
--- a/README.md
+++ b/README.md
@@ -332,6 +332,9 @@ When an Istio release is out of support, the corresponding Sail Operator release
 ## Community Support and Contributing
 Please refer to the [CONTRIBUTING-SAIL-PROJECT.md](CONTRIBUTING.md) file for more information on how to contribute to the Sail Operator project. This file contains all the information you need to get started with contributing to the project.
 
+## AI Agents for Development
+If you're using AI coding assistants like Claude, GitHub Copilot, or Cursor, check out our [AI Agents Guide](docs/ai/ai-agents-guide.adoc) for information on how to configure these tools to understand Sail Operator patterns and best practices.
+
 ## Sail Enhancement Proposal
 
 SEP documents are used to propose and discuss non-trivial features or epics and any API changes. Please refer to the [SEP1-enhancement-process.md](enhancements/SEP1-enhancement-process.md) file for more information on how to create a Sail Enhancement Proposal (SEP) for the Sail Operator project.
diff --git a/api/v1/istio_types.go b/api/v1/istio_types.go
index beb41a0c9..08f9cdd6a 100644
--- a/api/v1/istio_types.go
+++ b/api/v1/istio_types.go
@@ -37,10 +37,10 @@ const (
 type IstioSpec struct {
 	// +sail:version
 	// Defines the version of Istio to install.
-	// Must be one of: v1.27-latest, v1.27.1, v1.27.0, v1.26-latest, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25-latest, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, master, v1.28-alpha.724e2360.
-	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Istio Version",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:fieldGroup:General", "urn:alm:descriptor:com.tectonic.ui:select:v1.27-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.26-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.25-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.24-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.6", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.0", "urn:alm:descriptor:com.tectonic.ui:select:master", "urn:alm:descriptor:com.tectonic.ui:select:v1.28-alpha.724e2360"}
-	// +kubebuilder:validation:Enum=v1.27-latest;v1.27.1;v1.27.0;v1.26-latest;v1.26.4;v1.26.3;v1.26.2;v1.26.0;v1.25-latest;v1.25.5;v1.25.4;v1.25.3;v1.25.2;v1.25.1;v1.24-latest;v1.24.6;v1.24.5;v1.24.4;v1.24.3;v1.24.2;v1.24.1;v1.24.0;v1.23-latest;v1.23.6;v1.23.5;v1.23.4;v1.23.3;v1.23.2;v1.22-latest;v1.22.8;v1.22.7;v1.22.6;v1.22.5;v1.21.6;master;v1.28-alpha.724e2360
-	// +kubebuilder:default=v1.27.1
+	// Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, master, v1.29-alpha.b2f713a9.
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Istio Version",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:fieldGroup:General", "urn:alm:descriptor:com.tectonic.ui:select:v1.28-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.28.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.27-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.26-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.6", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.0", "urn:alm:descriptor:com.tectonic.ui:select:master", "urn:alm:descriptor:com.tectonic.ui:select:v1.29-alpha.b2f713a9"}
+	// +kubebuilder:validation:Enum=v1.28-latest;v1.28.0;v1.27-latest;v1.27.3;v1.27.2;v1.27.1;v1.27.0;v1.26-latest;v1.26.6;v1.26.5;v1.26.4;v1.26.3;v1.26.2;v1.26.1;v1.26.0;v1.25-latest;v1.25.5;v1.25.4;v1.25.3;v1.25.2;v1.25.1;v1.24-latest;v1.24.6;v1.24.5;v1.24.4;v1.24.3;v1.24.2;v1.24.1;v1.24.0;v1.23-latest;v1.23.6;v1.23.5;v1.23.4;v1.23.3;v1.23.2;v1.22-latest;v1.22.8;v1.22.7;v1.22.6;v1.22.5;v1.21.6;master;v1.29-alpha.b2f713a9
+	// +kubebuilder:default=v1.28.0
 	Version string `json:"version"`
 
 	// Defines the update strategy to use when the version in the Istio CR is updated.
@@ -282,7 +282,7 @@ type Istio struct {
 	// +optional
 	metav1.ObjectMeta `json:"metadata"`
 
-	// +kubebuilder:default={version: "v1.27.1", namespace: "istio-system", updateStrategy: {type:"InPlace"}}
+	// +kubebuilder:default={version: "v1.28.0", namespace: "istio-system", updateStrategy: {type:"InPlace"}}
 	// +optional
 	Spec IstioSpec `json:"spec"`
 
diff --git a/api/v1/istiocni_types.go b/api/v1/istiocni_types.go
index e81887a23..bf3f64756 100644
--- a/api/v1/istiocni_types.go
+++ b/api/v1/istiocni_types.go
@@ -28,10 +28,10 @@ const (
 type IstioCNISpec struct {
 	// +sail:version
 	// Defines the version of Istio to install.
-	// Must be one of: v1.27-latest, v1.27.1, v1.27.0, v1.26-latest, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25-latest, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, master, v1.28-alpha.724e2360.
-	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Istio Version",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:fieldGroup:General", "urn:alm:descriptor:com.tectonic.ui:select:v1.27-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.26-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.25-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.24-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.6", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.0", "urn:alm:descriptor:com.tectonic.ui:select:master", "urn:alm:descriptor:com.tectonic.ui:select:v1.28-alpha.724e2360"}
-	// +kubebuilder:validation:Enum=v1.27-latest;v1.27.1;v1.27.0;v1.26-latest;v1.26.4;v1.26.3;v1.26.2;v1.26.0;v1.25-latest;v1.25.5;v1.25.4;v1.25.3;v1.25.2;v1.25.1;v1.24-latest;v1.24.6;v1.24.5;v1.24.4;v1.24.3;v1.24.2;v1.24.1;v1.24.0;v1.23-latest;v1.23.6;v1.23.5;v1.23.4;v1.23.3;v1.23.2;v1.22-latest;v1.22.8;v1.22.7;v1.22.6;v1.22.5;v1.21.6;master;v1.28-alpha.724e2360
-	// +kubebuilder:default=v1.27.1
+	// Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, master, v1.29-alpha.b2f713a9.
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Istio Version",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:fieldGroup:General", "urn:alm:descriptor:com.tectonic.ui:select:v1.28-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.28.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.27-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.26-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.6", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.0", "urn:alm:descriptor:com.tectonic.ui:select:master", "urn:alm:descriptor:com.tectonic.ui:select:v1.29-alpha.b2f713a9"}
+	// +kubebuilder:validation:Enum=v1.28-latest;v1.28.0;v1.27-latest;v1.27.3;v1.27.2;v1.27.1;v1.27.0;v1.26-latest;v1.26.6;v1.26.5;v1.26.4;v1.26.3;v1.26.2;v1.26.1;v1.26.0;v1.25-latest;v1.25.5;v1.25.4;v1.25.3;v1.25.2;v1.25.1;v1.24-latest;v1.24.6;v1.24.5;v1.24.4;v1.24.3;v1.24.2;v1.24.1;v1.24.0;v1.23-latest;v1.23.6;v1.23.5;v1.23.4;v1.23.3;v1.23.2;v1.22-latest;v1.22.8;v1.22.7;v1.22.6;v1.22.5;v1.21.6;master;v1.29-alpha.b2f713a9
+	// +kubebuilder:default=v1.28.0
 	Version string `json:"version"`
 
 	// +sail:profile
@@ -181,7 +181,7 @@ type IstioCNI struct {
 	// +optional
 	metav1.ObjectMeta `json:"metadata"`
 
-	// +kubebuilder:default={version: "v1.27.1", namespace: "istio-cni"}
+	// +kubebuilder:default={version: "v1.28.0", namespace: "istio-cni"}
 	// +optional
 	Spec IstioCNISpec `json:"spec"`
 
diff --git a/api/v1/istiorevision_types.go b/api/v1/istiorevision_types.go
index f1a28bed8..46b1080d4 100644
--- a/api/v1/istiorevision_types.go
+++ b/api/v1/istiorevision_types.go
@@ -30,9 +30,9 @@ const (
 type IstioRevisionSpec struct {
 	// +sail:version
 	// Defines the version of Istio to install.
-	// Must be one of: v1.27.1, v1.27.0, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, v1.28-alpha.724e2360.
-	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Istio Version",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:fieldGroup:General", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.6", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.28-alpha.724e2360"}
-	// +kubebuilder:validation:Enum=v1.27.1;v1.27.0;v1.26.4;v1.26.3;v1.26.2;v1.26.0;v1.25.5;v1.25.4;v1.25.3;v1.25.2;v1.25.1;v1.24.6;v1.24.5;v1.24.4;v1.24.3;v1.24.2;v1.24.1;v1.24.0;v1.23.6;v1.23.5;v1.23.4;v1.23.3;v1.23.2;v1.22.8;v1.22.7;v1.22.6;v1.22.5;v1.21.6;v1.28-alpha.724e2360
+	// Must be one of: v1.28.0, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, v1.29-alpha.b2f713a9.
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Istio Version",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:fieldGroup:General", "urn:alm:descriptor:com.tectonic.ui:select:v1.28.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.6", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.29-alpha.b2f713a9"}
+	// +kubebuilder:validation:Enum=v1.28.0;v1.27.3;v1.27.2;v1.27.1;v1.27.0;v1.26.6;v1.26.5;v1.26.4;v1.26.3;v1.26.2;v1.26.1;v1.26.0;v1.25.5;v1.25.4;v1.25.3;v1.25.2;v1.25.1;v1.24.6;v1.24.5;v1.24.4;v1.24.3;v1.24.2;v1.24.1;v1.24.0;v1.23.6;v1.23.5;v1.23.4;v1.23.3;v1.23.2;v1.22.8;v1.22.7;v1.22.6;v1.22.5;v1.21.6;v1.29-alpha.b2f713a9
 	Version string `json:"version"`
 
 	// Namespace to which the Istio components should be installed.
@@ -185,6 +185,12 @@ const (
 	// IstioRevisionReasonIstioCNINotHealthy indicates that the IstioCNI resource is not healthy.
 	IstioRevisionReasonIstioCNINotHealthy IstioRevisionConditionReason = "IstioCNINotHealthy"
 
+	// IstioRevisionReasonZTunnelNotFound indicates that the ZTunnel resource is not found.
+	IstioRevisionReasonZTunnelNotFound IstioRevisionConditionReason = "ZTunnelNotFound"
+
+	// IstioRevisionReasonZTunnelNotHealthy indicates that the ZTunnel resource is not healthy.
+	IstioRevisionReasonZTunnelNotHealthy IstioRevisionConditionReason = "ZTunnelNotHealthy"
+
 	// IstioRevisionDependencyCheckFailed indicates that the status of the dependencies could not be ascertained.
 	IstioRevisionDependencyCheckFailed IstioRevisionConditionReason = "DependencyCheckFailed"
 )
diff --git a/api/v1/values_types.gen.go b/api/v1/values_types.gen.go
index 7d49684e8..cda9f6949 100644
--- a/api/v1/values_types.gen.go
+++ b/api/v1/values_types.gen.go
@@ -24,6 +24,16 @@ import (
 	intstr "k8s.io/apimachinery/pkg/util/intstr"
 )
 
+// +kubebuilder:validation:Enum=undefined;all;cluster;namespace
+type ResourceScope string
+
+const (
+	ResourceScopeUndefined ResourceScope = "undefined"
+	ResourceScopeAll       ResourceScope = "all"
+	ResourceScopeCluster   ResourceScope = "cluster"
+	ResourceScopeNamespace ResourceScope = "namespace"
+)
+
 // Mode for the ingress controller.
 // +kubebuilder:validation:Enum=UNSPECIFIED;DEFAULT;STRICT;OFF
 type IngressControllerMode string
@@ -442,7 +452,10 @@ type GlobalConfig struct {
 	// Specifies whether native nftables rules should be used instead of iptables rules for traffic redirection.
 	NativeNftables *bool `json:"nativeNftables,omitempty"`
 	// Settings related to Kubernetes NetworkPolicy.
-	NetworkPolicy *NetworkPolicyConfig `json:"networkPolicy,omitempty"` // The next available key is 76
+	NetworkPolicy *NetworkPolicyConfig `json:"networkPolicy,omitempty"`
+	// Specifies resource scope for discovery selectors.
+	// This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
+	ResourceScope ResourceScope `json:"resourceScope,omitempty"` // The next available key is 77
 
 }
 
@@ -637,6 +650,8 @@ type PilotConfig struct {
 	IstiodRemote *IstiodRemoteConfig `json:"istiodRemote,omitempty"`
 	// Configuration for the istio-discovery chart
 	EnvVarFrom []k8sv1.EnvVar `json:"envVarFrom,omitempty"`
+	// Select a custom name for istiod's plugged-in CA CRL ConfigMap.
+	CrlConfigMapName *string `json:"crlConfigMapName,omitempty"`
 }
 
 type PilotTaintControllerConfig struct {
@@ -1154,7 +1169,7 @@ const filePkgApisValuesTypesProtoRawDesc = "" +
 	"\x14istio_ingressgateway\x18\x04 \x01(\v2-.istio.operator.v1alpha1.IngressGatewayConfigR\x14istio-ingressgateway\x12@\n" +
 	"\x0fsecurityContext\x18\n" +
 	" \x01(\v2\x16.google.protobuf.ValueR\x0fsecurityContext\x12>\n" +
-	"\x0eseccompProfile\x18\f \x01(\v2\x16.google.protobuf.ValueR\x0eseccompProfile\"\xdf\x13\n" +
+	"\x0eseccompProfile\x18\f \x01(\v2\x16.google.protobuf.ValueR\x0eseccompProfile\"\xad\x14\n" +
 	"\fGlobalConfig\x12;\n" +
 	"\x04arch\x18\x01 \x01(\v2#.istio.operator.v1alpha1.ArchConfigB\x02\x18\x01R\x04arch\x12 \n" +
 	"\vcertSigners\x18D \x03(\tR\vcertSigners\x12F\n" +
@@ -1204,7 +1219,8 @@ const filePkgApisValuesTypesProtoRawDesc = "" +
 	"\bwaypoint\x18H \x01(\v2'.istio.operator.v1alpha1.WaypointConfigR\bwaypoint\x12(\n" +
 	"\x0ftrustBundleName\x18I \x01(\tR\x0ftrustBundleName\x12B\n" +
 	"\x0enativeNftables\x18J \x01(\v2\x1a.google.protobuf.BoolValueR\x0enativeNftables\x12R\n" +
-	"\rnetworkPolicy\x18K \x01(\v2,.istio.operator.v1alpha1.NetworkPolicyConfigR\rnetworkPolicy\"-\n" +
+	"\rnetworkPolicy\x18K \x01(\v2,.istio.operator.v1alpha1.NetworkPolicyConfigR\rnetworkPolicy\x12L\n" +
+	"\rresourceScope\x18L \x01(\x0e2&.istio.operator.v1alpha1.ResourceScopeR\rresourceScope\"-\n" +
 	"\tSTSConfig\x12 \n" +
 	"\vservicePort\x18\x01 \x01(\rR\vservicePort\"R\n" +
 	"\fIstiodConfig\x12B\n" +
@@ -1261,7 +1277,7 @@ const filePkgApisValuesTypesProtoRawDesc = "" +
 	"\x04mode\x18\x02 \x01(\x0e29.istio.operator.v1alpha1.OutboundTrafficPolicyConfig.ModeR\x04mode\"(\n" +
 	"\x04Mode\x12\r\n" +
 	"\tALLOW_ANY\x10\x00\x12\x11\n" +
-	"\rREGISTRY_ONLY\x10\x01\"\x98\x13\n" +
+	"\rREGISTRY_ONLY\x10\x01\"\xc4\x13\n" +
 	"\vPilotConfig\x124\n" +
 	"\aenabled\x18\x01 \x01(\v2\x1a.google.protobuf.BoolValueR\aenabled\x12F\n" +
 	"\x10autoscaleEnabled\x18\x02 \x01(\v2\x1a.google.protobuf.BoolValueR\x10autoscaleEnabled\x12\"\n" +
@@ -1306,7 +1322,8 @@ const filePkgApisValuesTypesProtoRawDesc = "" +
 	"\fistiodRemote\x18= \x01(\v2+.istio.operator.v1alpha1.IstiodRemoteConfigR\fistiodRemote\x127\n" +
 	"\n" +
 	"envVarFrom\x18> \x03(\v2\x17.google.protobuf.StructR\n" +
-	"envVarFrom\"T\n" +
+	"envVarFrom\x12*\n" +
+	"\x10crlConfigMapName\x18? \x01(\tR\x10crlConfigMapName\"T\n" +
 	"\x1aPilotTaintControllerConfig\x12\x18\n" +
 	"\aenabled\x18\x01 \x01(\bR\aenabled\x12\x1c\n" +
 	"\tnamespace\x18\x02 \x01(\tR\tnamespace\"\xc6\x01\n" +
@@ -1463,7 +1480,12 @@ const filePkgApisValuesTypesProtoRawDesc = "" +
 	"toleration\x18\x05 \x03(\v2\x1e.k8s.io.api.core.v1.TolerationR\n" +
 	"toleration\"K\n" +
 	"\x13NetworkPolicyConfig\x124\n" +
-	"\aenabled\x18\x01 \x01(\v2\x1a.google.protobuf.BoolValueR\aenabled*J\n" +
+	"\aenabled\x18\x01 \x01(\v2\x1a.google.protobuf.BoolValueR\aenabled*C\n" +
+	"\rResourceScope\x12\r\n" +
+	"\tundefined\x10\x00\x12\a\n" +
+	"\x03all\x10\x01\x12\v\n" +
+	"\acluster\x10\x02\x12\r\n" +
+	"\tnamespace\x10\x03*J\n" +
 	"\x15ingressControllerMode\x12\x0f\n" +
 	"\vUNSPECIFIED\x10\x00\x12\v\n" +
 	"\aDEFAULT\x10\x01\x12\n" +
@@ -2513,6 +2535,12 @@ type MeshConfigExtensionProviderZipkinTracingProvider struct {
 	// This controls both downstream request header extraction and upstream request header injection.
 	// The default value is USE_B3 to maintain backward compatibility.
 	TraceContextOption MeshConfigExtensionProviderZipkinTracingProviderTraceContextOption `json:"traceContextOption,omitempty"`
+	// Optional. The timeout for the HTTP request to the Zipkin collector.
+	// If not specified, the default timeout from Envoy's configuration will be used (which is 5 seconds currently).
+	Timeout *metav1.Duration `json:"timeout,omitempty"`
+	// Optional. Additional HTTP headers to include in the request to the Zipkin collector.
+	// These headers will be added to the HTTP request when sending spans to the collector.
+	Headers []*MeshConfigExtensionProviderHttpHeader `json:"headers,omitempty"`
 }
 
 // Defines configuration for a Lightstep tracer.
@@ -3083,7 +3111,7 @@ type MeshConfigExtensionProviderResourceDetectorsDynatraceResourceDetector struc
 
 const fileMeshV1alpha1ConfigProtoRawDesc = "" +
 	"\n" +
-	"\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\x1a)networking/v1alpha3/virtual_service.proto\"\xf7n\n" +
+	"\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\x1a)networking/v1alpha3/virtual_service.proto\"\x84p\n" +
 	"\n" +
 	"MeshConfig\x12*\n" +
 	"\x11proxy_listen_port\x18\x04 \x01(\x05R\x0fproxyListenPort\x129\n" +
@@ -3166,7 +3194,7 @@ const fileMeshV1alpha1ConfigProtoRawDesc = "" +
 	"\ftls_settings\x18\x02 \x01(\v2,.istio.networking.v1alpha3.ClientTLSSettingsR\vtlsSettings\x12B\n" +
 	"\x0frequest_timeout\x18\x03 \x01(\v2\x19.google.protobuf.DurationR\x0erequestTimeout\x12\x1f\n" +
 	"\vistiod_side\x18\x04 \x01(\bR\n" +
-	"istiodSide\x1a\xc2@\n" +
+	"istiodSide\x1a\xcfA\n" +
 	"\x11ExtensionProvider\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x8b\x01\n" +
 	"\x14envoy_ext_authz_http\x18\x02 \x01(\v2X.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationHttpProviderH\x00R\x11envoyExtAuthzHttp\x12\x8b\x01\n" +
@@ -3222,14 +3250,16 @@ const fileMeshV1alpha1ConfigProtoRawDesc = "" +
 	"\tfail_open\x18\x03 \x01(\bR\bfailOpen\x12*\n" +
 	"\x11clear_route_cache\x18\a \x01(\bR\x0fclearRouteCache\x12&\n" +
 	"\x0fstatus_on_error\x18\x04 \x01(\tR\rstatusOnError\x12\x99\x01\n" +
-	"\x1dinclude_request_body_in_check\x18\x06 \x01(\v2W.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationRequestBodyR\x19includeRequestBodyInCheck\x1a\x84\x03\n" +
+	"\x1dinclude_request_body_in_check\x18\x06 \x01(\v2W.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationRequestBodyR\x19includeRequestBodyInCheck\x1a\x91\x04\n" +
 	"\x15ZipkinTracingProvider\x12\x18\n" +
 	"\aservice\x18\x01 \x01(\tR\aservice\x12\x12\n" +
 	"\x04port\x18\x02 \x01(\rR\x04port\x12$\n" +
 	"\x0emax_tag_length\x18\x03 \x01(\rR\fmaxTagLength\x121\n" +
 	"\x15enable_64bit_trace_id\x18\x04 \x01(\bR\x12enable64bitTraceId\x12\x12\n" +
 	"\x04path\x18\x05 \x01(\tR\x04path\x12\x8c\x01\n" +
-	"\x14trace_context_option\x18\x06 \x01(\x0e2Z.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.ZipkinTracingProvider.TraceContextOptionR\x12traceContextOption\"A\n" +
+	"\x14trace_context_option\x18\x06 \x01(\x0e2Z.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.ZipkinTracingProvider.TraceContextOptionR\x12traceContextOption\x123\n" +
+	"\atimeout\x18\a \x01(\v2\x19.google.protobuf.DurationR\atimeout\x12V\n" +
+	"\aheaders\x18\b \x03(\v2<.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.HttpHeaderR\aheaders\"A\n" +
 	"\x12TraceContextOption\x12\n" +
 	"\n" +
 	"\x06USE_B3\x10\x00\x12\x1f\n" +
diff --git a/api/v1/values_types_extra.go b/api/v1/values_types_extra.go
index b4a0eb3d5..b6f2a5f05 100644
--- a/api/v1/values_types_extra.go
+++ b/api/v1/values_types_extra.go
@@ -15,6 +15,7 @@
 package v1
 
 import (
+	appsv1 "k8s.io/api/apps/v1"
 	k8sv1 "k8s.io/api/core/v1"
 )
 
@@ -49,6 +50,10 @@ type ZTunnelConfig struct {
 	// Image name to pull from. Image will be `Hub/Image:Tag-Variant`.
 	// If Image contains a "/", it will replace the entire `image` in the pod.
 	Image *string `json:"image,omitempty"`
+	// defines the network this cluster belong to. This name corresponds to the networks in the map of mesh networks.
+	Network *string `json:"network,omitempty"`
+	// K8s affinity to set on the ztunnel Pods. Can be used to exclude ztunnel from being scheduled on specified nodes.
+	Affinity *k8sv1.Affinity `json:"affinity,omitempty"`
 	// resourceName, if set, will override the naming of resources. If not set, will default to the release name.
 	// It is recommended to not set this; this is primarily for backwards compatibility.
 	ResourceName *string `json:"resourceName,omitempty"`
@@ -60,12 +65,20 @@ type ZTunnelConfig struct {
 	VolumeMounts []k8sv1.VolumeMount `json:"volumeMounts,omitempty"`
 	// Additional volumes to add to the ztunnel Pod.
 	Volumes []k8sv1.Volume `json:"volumes,omitempty"`
+	// Tolerations for the ztunnel pod
+	Tolerations []k8sv1.Toleration `json:"tolerations,omitempty"`
 	// Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
 	PodAnnotations map[string]string `json:"podAnnotations,omitempty"`
 	// Additional labels to apply on the pod level.
 	PodLabels map[string]string `json:"podLabels,omitempty"`
 	// The k8s resource requests and limits for the ztunnel Pods.
 	Resources *k8sv1.ResourceRequirements `json:"resources,omitempty"`
+	// The resource quotas configuration for ztunnel
+	ResourceQuotas *ResourceQuotas `json:"resourceQuotas,omitempty"`
+	// K8s node selector settings.
+	//
+	// See https://kubernetes.io/docs/user-guide/node-selection/
+	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
 	// List of secret names to add to the service account as image pull secrets
 	// to use for pulling any images in pods that reference this ServiceAccount.
 	// Must be set for any cluster configured with private docker registry.
@@ -102,6 +115,10 @@ type ZTunnelConfig struct {
 	LogLevel *string `json:"logLevel,omitempty"`
 	// Specifies whether istio components should output logs in json format by adding --log_as_json argument to each container.
 	LogAsJSON *bool `json:"logAsJson,omitempty"`
+	// Set seLinux options for the ztunnel pod
+	SeLinuxOptions *k8sv1.SELinuxOptions `json:"seLinuxOptions,omitempty"`
+	// Defines the update strategy to use when the version in the Ztunnel CR is updated.
+	UpdateStrategy *appsv1.DaemonSetUpdateStrategy `json:"updateStrategy,omitempty"`
 }
 
 // ZTunnelGlobalConfig is a subset of the Global Configuration used in the Istio ztunnel chart.
diff --git a/api/v1/ztunnel_types.go b/api/v1/ztunnel_types.go
new file mode 100644
index 000000000..ecaa353e5
--- /dev/null
+++ b/api/v1/ztunnel_types.go
@@ -0,0 +1,194 @@
+// Copyright Istio Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1
+
+import (
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	ZTunnelKind = "ZTunnel"
+)
+
+// ZTunnelSpec defines the desired state of ZTunnel
+type ZTunnelSpec struct {
+	// +sail:version
+	// Defines the version of Istio to install.
+	// Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, v1.25-latest, v1.24-latest, master, v1.29-alpha.b2f713a9.
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Istio Version",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:fieldGroup:General", "urn:alm:descriptor:com.tectonic.ui:select:v1.28-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.28.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.27-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.26-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.6", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.25-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.24-latest", "urn:alm:descriptor:com.tectonic.ui:select:master", "urn:alm:descriptor:com.tectonic.ui:select:v1.29-alpha.b2f713a9"}
+	// +kubebuilder:validation:Enum=v1.28-latest;v1.28.0;v1.27-latest;v1.27.3;v1.27.2;v1.27.1;v1.27.0;v1.26-latest;v1.26.6;v1.26.5;v1.26.4;v1.26.3;v1.26.2;v1.26.1;v1.26.0;v1.25-latest;v1.24-latest;master;v1.29-alpha.b2f713a9
+	// +kubebuilder:default=v1.28.0
+	Version string `json:"version"`
+
+	// Namespace to which the Istio ztunnel component should be installed.
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:io.kubernetes:Namespace"}
+	// +kubebuilder:default=ztunnel
+	Namespace string `json:"namespace"`
+
+	// Defines the values to be passed to the Helm charts when installing Istio ztunnel.
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Helm Values"
+	Values *ZTunnelValues `json:"values,omitempty"`
+}
+
+// ZTunnelStatus defines the observed state of ZTunnel
+type ZTunnelStatus struct {
+	// ObservedGeneration is the most recent generation observed for this
+	// ZTunnel object. It corresponds to the object's generation, which is
+	// updated on mutation by the API Server. The information in the status
+	// pertains to this particular generation of the object.
+	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
+
+	// Represents the latest available observations of the object's current state.
+	Conditions []ZTunnelCondition `json:"conditions,omitempty"`
+
+	// Reports the current state of the object.
+	State ZTunnelConditionReason `json:"state,omitempty"`
+}
+
+// GetCondition returns the condition of the specified type
+func (s *ZTunnelStatus) GetCondition(conditionType ZTunnelConditionType) ZTunnelCondition {
+	if s != nil {
+		for i := range s.Conditions {
+			if s.Conditions[i].Type == conditionType {
+				return s.Conditions[i]
+			}
+		}
+	}
+	return ZTunnelCondition{Type: conditionType, Status: metav1.ConditionUnknown}
+}
+
+// SetCondition sets a specific condition in the list of conditions
+func (s *ZTunnelStatus) SetCondition(condition ZTunnelCondition) {
+	var now time.Time
+	if testTime == nil {
+		now = time.Now()
+	} else {
+		now = *testTime
+	}
+
+	// The lastTransitionTime only gets serialized out to the second.  This can
+	// break update skipping, as the time in the resource returned from the client
+	// may not match the time in our cached status during a reconcile.  We truncate
+	// here to save any problems down the line.
+	lastTransitionTime := metav1.NewTime(now.Truncate(time.Second))
+
+	for i, prevCondition := range s.Conditions {
+		if prevCondition.Type == condition.Type {
+			if prevCondition.Status != condition.Status {
+				condition.LastTransitionTime = lastTransitionTime
+			} else {
+				condition.LastTransitionTime = prevCondition.LastTransitionTime
+			}
+			s.Conditions[i] = condition
+			return
+		}
+	}
+
+	// If the condition does not exist, initialize the lastTransitionTime
+	condition.LastTransitionTime = lastTransitionTime
+	s.Conditions = append(s.Conditions, condition)
+}
+
+// ZTunnelCondition represents a specific observation of the ZTunnel object's state.
+type ZTunnelCondition struct {
+	// The type of this condition.
+	Type ZTunnelConditionType `json:"type,omitempty"`
+
+	// The status of this condition. Can be True, False or Unknown.
+	Status metav1.ConditionStatus `json:"status,omitempty"`
+
+	// Unique, single-word, CamelCase reason for the condition's last transition.
+	Reason ZTunnelConditionReason `json:"reason,omitempty"`
+
+	// Human-readable message indicating details about the last transition.
+	Message string `json:"message,omitempty"`
+
+	// Last time the condition transitioned from one status to another.
+	// +optional
+	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitzero"`
+}
+
+// ZTunnelConditionType represents the type of the condition.  Condition stages are:
+// Installed, Reconciled, Ready
+type ZTunnelConditionType string
+
+// ZTunnelConditionReason represents a short message indicating how the condition came
+// to be in its present state.
+type ZTunnelConditionReason string
+
+const (
+	// ZTunnelConditionReconciled signifies whether the controller has
+	// successfully reconciled the resources defined through the CR.
+	ZTunnelConditionReconciled ZTunnelConditionType = "Reconciled"
+
+	// ZTunnelReasonReconcileError indicates that the reconciliation of the resource has failed, but will be retried.
+	ZTunnelReasonReconcileError ZTunnelConditionReason = "ReconcileError"
+)
+
+const (
+	// ZTunnelConditionReady signifies whether the ztunnel DaemonSet is ready.
+	ZTunnelConditionReady ZTunnelConditionType = "Ready"
+
+	// ZTunnelDaemonSetNotReady indicates that the ztunnel DaemonSet is not ready.
+	ZTunnelDaemonSetNotReady ZTunnelConditionReason = "DaemonSetNotReady"
+
+	// ZTunnelReasonReadinessCheckFailed indicates that the DaemonSet readiness status could not be ascertained.
+	ZTunnelReasonReadinessCheckFailed ZTunnelConditionReason = "ReadinessCheckFailed"
+)
+
+const (
+	// ZTunnelReasonHealthy indicates that the control plane is fully reconciled and that all components are ready.
+	ZTunnelReasonHealthy ZTunnelConditionReason = "Healthy"
+)
+
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:scope=Cluster,categories=istio-io
+// +kubebuilder:subresource:status
+// +kubebuilder:storageversion
+// +kubebuilder:printcolumn:name="Namespace",type="string",JSONPath=".spec.namespace",description="The namespace for the ztunnel component."
+// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description="Whether the Istio ztunnel installation is ready to handle requests."
+// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.state",description="The current state of this object."
+// +kubebuilder:printcolumn:name="Version",type="string",JSONPath=".spec.version",description="The version of the Istio ztunnel installation."
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="The age of the object"
+// +kubebuilder:validation:XValidation:rule="self.metadata.name == 'default'",message="metadata.name must be 'default'"
+
+// ZTunnel represents a deployment of the Istio ztunnel component.
+type ZTunnel struct {
+	metav1.TypeMeta `json:",inline"`
+	// +optional
+	metav1.ObjectMeta `json:"metadata"`
+
+	// +kubebuilder:default={version: "v1.28.0", namespace: "ztunnel"}
+	// +optional
+	Spec ZTunnelSpec `json:"spec"`
+
+	// +optional
+	Status ZTunnelStatus `json:"status"`
+}
+
+// +kubebuilder:object:root=true
+
+// ZTunnelList contains a list of ZTunnel
+type ZTunnelList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+	Items           []ZTunnel `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&ZTunnel{}, &ZTunnelList{})
+}
diff --git a/api/v1/zz_generated.deepcopy.go b/api/v1/zz_generated.deepcopy.go
index 5dabcee75..c218b3ef8 100644
--- a/api/v1/zz_generated.deepcopy.go
+++ b/api/v1/zz_generated.deepcopy.go
@@ -20,6 +20,7 @@ package v1
 
 import (
 	"encoding/json"
+	appsv1 "k8s.io/api/apps/v1"
 	"k8s.io/api/autoscaling/v2"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -3010,6 +3011,22 @@ func (in *MeshConfigExtensionProviderZipkinTracingProvider) DeepCopyInto(out *Me
 		*out = new(string)
 		**out = **in
 	}
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(metav1.Duration)
+		**out = **in
+	}
+	if in.Headers != nil {
+		in, out := &in.Headers, &out.Headers
+		*out = make([]*MeshConfigExtensionProviderHttpHeader, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(MeshConfigExtensionProviderHttpHeader)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MeshConfigExtensionProviderZipkinTracingProvider.
@@ -3771,6 +3788,11 @@ func (in *PilotConfig) DeepCopyInto(out *PilotConfig) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.CrlConfigMapName != nil {
+		in, out := &in.CrlConfigMapName, &out.CrlConfigMapName
+		*out = new(string)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PilotConfig.
@@ -5481,6 +5503,49 @@ func (in *WorkloadSelector) DeepCopy() *WorkloadSelector {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ZTunnel) DeepCopyInto(out *ZTunnel) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZTunnel.
+func (in *ZTunnel) DeepCopy() *ZTunnel {
+	if in == nil {
+		return nil
+	}
+	out := new(ZTunnel)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ZTunnel) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ZTunnelCondition) DeepCopyInto(out *ZTunnelCondition) {
+	*out = *in
+	in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZTunnelCondition.
+func (in *ZTunnelCondition) DeepCopy() *ZTunnelCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(ZTunnelCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ZTunnelConfig) DeepCopyInto(out *ZTunnelConfig) {
 	*out = *in
@@ -5504,6 +5569,16 @@ func (in *ZTunnelConfig) DeepCopyInto(out *ZTunnelConfig) {
 		*out = new(string)
 		**out = **in
 	}
+	if in.Network != nil {
+		in, out := &in.Network, &out.Network
+		*out = new(string)
+		**out = **in
+	}
+	if in.Affinity != nil {
+		in, out := &in.Affinity, &out.Affinity
+		*out = new(corev1.Affinity)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.ResourceName != nil {
 		in, out := &in.ResourceName, &out.ResourceName
 		*out = new(string)
@@ -5537,6 +5612,13 @@ func (in *ZTunnelConfig) DeepCopyInto(out *ZTunnelConfig) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.Tolerations != nil {
+		in, out := &in.Tolerations, &out.Tolerations
+		*out = make([]corev1.Toleration, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	if in.PodAnnotations != nil {
 		in, out := &in.PodAnnotations, &out.PodAnnotations
 		*out = make(map[string]string, len(*in))
@@ -5556,6 +5638,18 @@ func (in *ZTunnelConfig) DeepCopyInto(out *ZTunnelConfig) {
 		*out = new(corev1.ResourceRequirements)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.ResourceQuotas != nil {
+		in, out := &in.ResourceQuotas, &out.ResourceQuotas
+		*out = new(ResourceQuotas)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.NodeSelector != nil {
+		in, out := &in.NodeSelector, &out.NodeSelector
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 	if in.ImagePullSecrets != nil {
 		in, out := &in.ImagePullSecrets, &out.ImagePullSecrets
 		*out = make([]string, len(*in))
@@ -5613,6 +5707,16 @@ func (in *ZTunnelConfig) DeepCopyInto(out *ZTunnelConfig) {
 		*out = new(bool)
 		**out = **in
 	}
+	if in.SeLinuxOptions != nil {
+		in, out := &in.SeLinuxOptions, &out.SeLinuxOptions
+		*out = new(corev1.SELinuxOptions)
+		**out = **in
+	}
+	if in.UpdateStrategy != nil {
+		in, out := &in.UpdateStrategy, &out.UpdateStrategy
+		*out = new(appsv1.DaemonSetUpdateStrategy)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZTunnelConfig.
@@ -5685,6 +5789,80 @@ func (in *ZTunnelGlobalConfig) DeepCopy() *ZTunnelGlobalConfig {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ZTunnelList) DeepCopyInto(out *ZTunnelList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ZTunnel, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZTunnelList.
+func (in *ZTunnelList) DeepCopy() *ZTunnelList {
+	if in == nil {
+		return nil
+	}
+	out := new(ZTunnelList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ZTunnelList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ZTunnelSpec) DeepCopyInto(out *ZTunnelSpec) {
+	*out = *in
+	if in.Values != nil {
+		in, out := &in.Values, &out.Values
+		*out = new(ZTunnelValues)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZTunnelSpec.
+func (in *ZTunnelSpec) DeepCopy() *ZTunnelSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ZTunnelSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ZTunnelStatus) DeepCopyInto(out *ZTunnelStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]ZTunnelCondition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZTunnelStatus.
+func (in *ZTunnelStatus) DeepCopy() *ZTunnelStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ZTunnelStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ZTunnelValues) DeepCopyInto(out *ZTunnelValues) {
 	*out = *in
diff --git a/api/v1alpha1/ztunnel_types.go b/api/v1alpha1/ztunnel_types.go
index 45cacc287..67ca7dc12 100644
--- a/api/v1alpha1/ztunnel_types.go
+++ b/api/v1alpha1/ztunnel_types.go
@@ -29,10 +29,10 @@ const (
 type ZTunnelSpec struct {
 	// +sail:version
 	// Defines the version of Istio to install.
-	// Must be one of: v1.27-latest, v1.27.1, v1.27.0, v1.26-latest, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25-latest, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, master, v1.28-alpha.724e2360.
-	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Istio Version",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:fieldGroup:General", "urn:alm:descriptor:com.tectonic.ui:select:v1.27-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.26-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.25-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.25.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.24-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.6", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.24.0", "urn:alm:descriptor:com.tectonic.ui:select:master", "urn:alm:descriptor:com.tectonic.ui:select:v1.28-alpha.724e2360"}
-	// +kubebuilder:validation:Enum=v1.27-latest;v1.27.1;v1.27.0;v1.26-latest;v1.26.4;v1.26.3;v1.26.2;v1.26.0;v1.25-latest;v1.25.5;v1.25.4;v1.25.3;v1.25.2;v1.25.1;v1.24-latest;v1.24.6;v1.24.5;v1.24.4;v1.24.3;v1.24.2;v1.24.1;v1.24.0;master;v1.28-alpha.724e2360
-	// +kubebuilder:default=v1.27.1
+	// Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, v1.25-latest, v1.24-latest, master, v1.29-alpha.b2f713a9.
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName="Istio Version",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:fieldGroup:General", "urn:alm:descriptor:com.tectonic.ui:select:v1.28-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.28.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.27-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.27.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.26-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.6", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.5", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.4", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.3", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.2", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.1", "urn:alm:descriptor:com.tectonic.ui:select:v1.26.0", "urn:alm:descriptor:com.tectonic.ui:select:v1.25-latest", "urn:alm:descriptor:com.tectonic.ui:select:v1.24-latest", "urn:alm:descriptor:com.tectonic.ui:select:master", "urn:alm:descriptor:com.tectonic.ui:select:v1.29-alpha.b2f713a9"}
+	// +kubebuilder:validation:Enum=v1.28-latest;v1.28.0;v1.27-latest;v1.27.3;v1.27.2;v1.27.1;v1.27.0;v1.26-latest;v1.26.6;v1.26.5;v1.26.4;v1.26.3;v1.26.2;v1.26.1;v1.26.0;v1.25-latest;v1.24-latest;master;v1.29-alpha.b2f713a9
+	// +kubebuilder:default=v1.28.0
 	Version string `json:"version"`
 
 	// +sail:profile
@@ -166,6 +166,7 @@ const (
 	ZTunnelReasonHealthy ZTunnelConditionReason = "Healthy"
 )
 
+// +kubebuilder:deprecatedversion
 // +kubebuilder:object:root=true
 // +kubebuilder:resource:scope=Cluster,categories=istio-io
 // +kubebuilder:subresource:status
@@ -183,7 +184,7 @@ type ZTunnel struct {
 	// +optional
 	metav1.ObjectMeta `json:"metadata"`
 
-	// +kubebuilder:default={version: "v1.27.1", namespace: "ztunnel", profile: "ambient"}
+	// +kubebuilder:default={version: "v1.28.0", namespace: "ztunnel", profile: "ambient"}
 	// +optional
 	Spec ZTunnelSpec `json:"spec"`
 
diff --git a/bundle.Dockerfile b/bundle.Dockerfile
index 5dcf96582..a53cb4c06 100644
--- a/bundle.Dockerfile
+++ b/bundle.Dockerfile
@@ -7,7 +7,7 @@ LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/
 LABEL operators.operatorframework.io.bundle.package.v1=servicemeshoperator3
 LABEL operators.operatorframework.io.bundle.channels.v1="stable,stable-3.0"
 LABEL operators.operatorframework.io.bundle.channel.default.v1=stable
-LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.41.1
+LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.42.0
 LABEL operators.operatorframework.io.metrics.mediatype.v1=metrics+v1
 LABEL operators.operatorframework.io.metrics.project_layout=go.kubebuilder.io/v4
 
diff --git a/bundle/manifests/networking.istio.io_destinationrules.yaml b/bundle/manifests/networking.istio.io_destinationrules.yaml
index 713945274..a78f9e11c 100644
--- a/bundle/manifests/networking.istio.io_destinationrules.yaml
+++ b/bundle/manifests/networking.istio.io_destinationrules.yaml
@@ -363,7 +363,7 @@ spec:
                                   description: This parameter controls the speed of
                                     traffic increase over the warmup duration.
                                   format: double
-                                  minimum: 1
+                                  minimum: 0
                                   nullable: true
                                   type: number
                                 duration:
@@ -746,7 +746,7 @@ spec:
                                         description: This parameter controls the speed
                                           of traffic increase over the warmup duration.
                                         format: double
-                                        minimum: 1
+                                        minimum: 0
                                         nullable: true
                                         type: number
                                       duration:
@@ -1295,7 +1295,7 @@ spec:
                             description: This parameter controls the speed of traffic
                               increase over the warmup duration.
                             format: double
-                            minimum: 1
+                            minimum: 0
                             nullable: true
                             type: number
                           duration:
@@ -1669,7 +1669,7 @@ spec:
                                   description: This parameter controls the speed of
                                     traffic increase over the warmup duration.
                                   format: double
-                                  minimum: 1
+                                  minimum: 0
                                   nullable: true
                                   type: number
                                 duration:
@@ -2364,7 +2364,7 @@ spec:
                                   description: This parameter controls the speed of
                                     traffic increase over the warmup duration.
                                   format: double
-                                  minimum: 1
+                                  minimum: 0
                                   nullable: true
                                   type: number
                                 duration:
@@ -2747,7 +2747,7 @@ spec:
                                         description: This parameter controls the speed
                                           of traffic increase over the warmup duration.
                                         format: double
-                                        minimum: 1
+                                        minimum: 0
                                         nullable: true
                                         type: number
                                       duration:
@@ -3296,7 +3296,7 @@ spec:
                             description: This parameter controls the speed of traffic
                               increase over the warmup duration.
                             format: double
-                            minimum: 1
+                            minimum: 0
                             nullable: true
                             type: number
                           duration:
@@ -3670,7 +3670,7 @@ spec:
                                   description: This parameter controls the speed of
                                     traffic increase over the warmup duration.
                                   format: double
-                                  minimum: 1
+                                  minimum: 0
                                   nullable: true
                                   type: number
                                 duration:
@@ -4365,7 +4365,7 @@ spec:
                                   description: This parameter controls the speed of
                                     traffic increase over the warmup duration.
                                   format: double
-                                  minimum: 1
+                                  minimum: 0
                                   nullable: true
                                   type: number
                                 duration:
@@ -4748,7 +4748,7 @@ spec:
                                         description: This parameter controls the speed
                                           of traffic increase over the warmup duration.
                                         format: double
-                                        minimum: 1
+                                        minimum: 0
                                         nullable: true
                                         type: number
                                       duration:
@@ -5297,7 +5297,7 @@ spec:
                             description: This parameter controls the speed of traffic
                               increase over the warmup duration.
                             format: double
-                            minimum: 1
+                            minimum: 0
                             nullable: true
                             type: number
                           duration:
@@ -5671,7 +5671,7 @@ spec:
                                   description: This parameter controls the speed of
                                     traffic increase over the warmup duration.
                                   format: double
-                                  minimum: 1
+                                  minimum: 0
                                   nullable: true
                                   type: number
                                 duration:
diff --git a/bundle/manifests/networking.istio.io_envoyfilters.yaml b/bundle/manifests/networking.istio.io_envoyfilters.yaml
index 07540b312..4e4874b14 100644
--- a/bundle/manifests/networking.istio.io_envoyfilters.yaml
+++ b/bundle/manifests/networking.istio.io_envoyfilters.yaml
@@ -64,12 +64,16 @@ spec:
                             - routeConfiguration
                           - required:
                             - cluster
+                          - required:
+                            - waypoint
                       - required:
                         - listener
                       - required:
                         - routeConfiguration
                       - required:
                         - cluster
+                      - required:
+                        - waypoint
                       properties:
                         cluster:
                           description: Match on envoy cluster attributes.
@@ -95,12 +99,13 @@ spec:
                           description: |-
                             The specific config generation context to match on.
 
-                            Valid Options: ANY, SIDECAR_INBOUND, SIDECAR_OUTBOUND, GATEWAY
+                            Valid Options: ANY, SIDECAR_INBOUND, SIDECAR_OUTBOUND, GATEWAY, WAYPOINT
                           enum:
                           - ANY
                           - SIDECAR_INBOUND
                           - SIDECAR_OUTBOUND
                           - GATEWAY
+                          - WAYPOINT
                           type: string
                         listener:
                           description: Match on envoy listener attributes.
@@ -230,7 +235,47 @@ spec:
                                   type: object
                               type: object
                           type: object
+                        waypoint:
+                          description: Match on waypoint attributes.
+                          properties:
+                            filter:
+                              description: The name of a specific filter to apply
+                                the patch to.
+                              properties:
+                                name:
+                                  description: The filter name to match on.
+                                  type: string
+                                subFilter:
+                                  description: The next level filter within this filter
+                                    to match on.
+                                  properties:
+                                    name:
+                                      description: The filter name to match on.
+                                      type: string
+                                  type: object
+                              type: object
+                            portNumber:
+                              description: The service port to match on.
+                              maximum: 4294967295
+                              minimum: 0
+                              type: integer
+                              x-kubernetes-validations:
+                              - message: port must be between 1-65535
+                                rule: 0 < self && self <= 6553
+                            route:
+                              description: Match a specific route.
+                              properties:
+                                name:
+                                  description: The Route objects generated by default
+                                    are named as default.
+                                  type: string
+                              type: object
+                          type: object
                       type: object
+                      x-kubernetes-validations:
+                      - message: only support waypointMatch when context is WAYPOINT
+                        rule: 'has(self.context) ? ((self.context == "WAYPOINT") ?
+                          has(self.waypoint) : !has(self.waypoint)) : !has(self.waypoint)'
                     patch:
                       description: The patch to apply along with the operation.
                       properties:
diff --git a/bundle/manifests/networking.istio.io_workloadgroups.yaml b/bundle/manifests/networking.istio.io_workloadgroups.yaml
index 1026d1c9b..5a31c97de 100644
--- a/bundle/manifests/networking.istio.io_workloadgroups.yaml
+++ b/bundle/manifests/networking.istio.io_workloadgroups.yaml
@@ -1,6 +1,8 @@
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
+  annotations:
+    helm.sh/resource-policy: keep
   creationTimestamp: null
   labels:
     app: istio-pilot
diff --git a/bundle/manifests/sailoperator.io_istiocnis.yaml b/bundle/manifests/sailoperator.io_istiocnis.yaml
index d3dbd6cd7..cb88fac0a 100644
--- a/bundle/manifests/sailoperator.io_istiocnis.yaml
+++ b/bundle/manifests/sailoperator.io_istiocnis.yaml
@@ -66,7 +66,7 @@ spec:
           spec:
             default:
               namespace: istio-cni
-              version: v1.27.1
+              version: v1.28.0
             description: IstioCNISpec defines the desired state of IstioCNI
             properties:
               namespace:
@@ -1463,18 +1463,25 @@ spec:
                     type: object
                 type: object
               version:
-                default: v1.27.1
+                default: v1.28.0
                 description: |-
                   Defines the version of Istio to install.
-                  Must be one of: v1.27-latest, v1.27.1, v1.27.0, v1.26-latest, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25-latest, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, master, v1.28-alpha.724e2360.
+                  Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, master, v1.29-alpha.b2f713a9.
                 enum:
+                - v1.28-latest
+                - v1.28.0
                 - v1.27-latest
+                - v1.27.3
+                - v1.27.2
                 - v1.27.1
                 - v1.27.0
                 - v1.26-latest
+                - v1.26.6
+                - v1.26.5
                 - v1.26.4
                 - v1.26.3
                 - v1.26.2
+                - v1.26.1
                 - v1.26.0
                 - v1.25-latest
                 - v1.25.5
@@ -1503,7 +1510,7 @@ spec:
                 - v1.22.5
                 - v1.21.6
                 - master
-                - v1.28-alpha.724e2360
+                - v1.29-alpha.b2f713a9
                 type: string
             required:
             - namespace
diff --git a/bundle/manifests/sailoperator.io_istiorevisions.yaml b/bundle/manifests/sailoperator.io_istiorevisions.yaml
index c79bf1aa3..2fa5280ed 100644
--- a/bundle/manifests/sailoperator.io_istiorevisions.yaml
+++ b/bundle/manifests/sailoperator.io_istiorevisions.yaml
@@ -1113,6 +1113,16 @@ spec:
                         description: Specifies the Istio control plane’s pilot Pod
                           IP address or remote cluster DNS resolvable hostname.
                         type: string
+                      resourceScope:
+                        description: |-
+                          Specifies resource scope for discovery selectors.
+                          This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
+                        enum:
+                        - undefined
+                        - all
+                        - cluster
+                        - namespace
+                        type: string
                       revision:
                         description: Configures the revision this control plane is
                           a part of
@@ -5303,6 +5313,35 @@ spec:
                                     Optional. A 128 bit trace id will be used in Istio.
                                     If true, will result in a 64 bit trace id being used.
                                   type: boolean
+                                headers:
+                                  description: |-
+                                    Optional. Additional HTTP headers to include in the request to the Zipkin collector.
+                                    These headers will be added to the HTTP request when sending spans to the collector.
+                                  items:
+                                    properties:
+                                      envName:
+                                        description: |-
+                                          The HTTP header value from the environment variable.
+
+                                          Warning:
+                                          - The environment variable must be set in the istiod pod spec.
+                                          - This is not a end-to-end secure.
+                                        type: string
+                                      name:
+                                        description: REQUIRED. The HTTP header name.
+                                        type: string
+                                      value:
+                                        description: The HTTP header value.
+                                        type: string
+                                    required:
+                                    - name
+                                    type: object
+                                    x-kubernetes-validations:
+                                    - message: At most one of [value envName] should
+                                        be set
+                                      rule: (has(self.value)?1:0) + (has(self.envName)?1:0)
+                                        <= 1
+                                  type: array
                                 maxTagLength:
                                   description: |-
                                     Optional. Controls the overall path length allowed in a reported span.
@@ -5328,6 +5367,11 @@ spec:
 
                                     Example: "zipkin.default.svc.cluster.local" or "bar/zipkin.example.com".
                                   type: string
+                                timeout:
+                                  description: |-
+                                    Optional. The timeout for the HTTP request to the Zipkin collector.
+                                    If not specified, the default timeout from Envoy's configuration will be used (which is 5 seconds currently).
+                                  type: string
                                 traceContextOption:
                                   description: |-
                                     Optional. Determines which trace context format to use for trace header extraction and propagation.
@@ -7157,6 +7201,10 @@ spec:
                             format: int32
                             type: integer
                         type: object
+                      crlConfigMapName:
+                        description: Select a custom name for istiod's plugged-in
+                          CA CRL ConfigMap.
+                        type: string
                       deploymentLabels:
                         additionalProperties:
                           type: string
@@ -9993,13 +10041,19 @@ spec:
               version:
                 description: |-
                   Defines the version of Istio to install.
-                  Must be one of: v1.27.1, v1.27.0, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, v1.28-alpha.724e2360.
+                  Must be one of: v1.28.0, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, v1.29-alpha.b2f713a9.
                 enum:
+                - v1.28.0
+                - v1.27.3
+                - v1.27.2
                 - v1.27.1
                 - v1.27.0
+                - v1.26.6
+                - v1.26.5
                 - v1.26.4
                 - v1.26.3
                 - v1.26.2
+                - v1.26.1
                 - v1.26.0
                 - v1.25.5
                 - v1.25.4
@@ -10023,7 +10077,7 @@ spec:
                 - v1.22.6
                 - v1.22.5
                 - v1.21.6
-                - v1.28-alpha.724e2360
+                - v1.29-alpha.b2f713a9
                 type: string
             required:
             - namespace
diff --git a/bundle/manifests/sailoperator.io_istios.yaml b/bundle/manifests/sailoperator.io_istios.yaml
index 6053189ce..c59d30b97 100644
--- a/bundle/manifests/sailoperator.io_istios.yaml
+++ b/bundle/manifests/sailoperator.io_istios.yaml
@@ -88,7 +88,7 @@ spec:
               namespace: istio-system
               updateStrategy:
                 type: InPlace
-              version: v1.27.1
+              version: v1.28.0
             description: IstioSpec defines the desired state of Istio
             properties:
               namespace:
@@ -1186,6 +1186,16 @@ spec:
                         description: Specifies the Istio control plane’s pilot Pod
                           IP address or remote cluster DNS resolvable hostname.
                         type: string
+                      resourceScope:
+                        description: |-
+                          Specifies resource scope for discovery selectors.
+                          This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
+                        enum:
+                        - undefined
+                        - all
+                        - cluster
+                        - namespace
+                        type: string
                       revision:
                         description: Configures the revision this control plane is
                           a part of
@@ -5376,6 +5386,35 @@ spec:
                                     Optional. A 128 bit trace id will be used in Istio.
                                     If true, will result in a 64 bit trace id being used.
                                   type: boolean
+                                headers:
+                                  description: |-
+                                    Optional. Additional HTTP headers to include in the request to the Zipkin collector.
+                                    These headers will be added to the HTTP request when sending spans to the collector.
+                                  items:
+                                    properties:
+                                      envName:
+                                        description: |-
+                                          The HTTP header value from the environment variable.
+
+                                          Warning:
+                                          - The environment variable must be set in the istiod pod spec.
+                                          - This is not a end-to-end secure.
+                                        type: string
+                                      name:
+                                        description: REQUIRED. The HTTP header name.
+                                        type: string
+                                      value:
+                                        description: The HTTP header value.
+                                        type: string
+                                    required:
+                                    - name
+                                    type: object
+                                    x-kubernetes-validations:
+                                    - message: At most one of [value envName] should
+                                        be set
+                                      rule: (has(self.value)?1:0) + (has(self.envName)?1:0)
+                                        <= 1
+                                  type: array
                                 maxTagLength:
                                   description: |-
                                     Optional. Controls the overall path length allowed in a reported span.
@@ -5401,6 +5440,11 @@ spec:
 
                                     Example: "zipkin.default.svc.cluster.local" or "bar/zipkin.example.com".
                                   type: string
+                                timeout:
+                                  description: |-
+                                    Optional. The timeout for the HTTP request to the Zipkin collector.
+                                    If not specified, the default timeout from Envoy's configuration will be used (which is 5 seconds currently).
+                                  type: string
                                 traceContextOption:
                                   description: |-
                                     Optional. Determines which trace context format to use for trace header extraction and propagation.
@@ -7230,6 +7274,10 @@ spec:
                             format: int32
                             type: integer
                         type: object
+                      crlConfigMapName:
+                        description: Select a custom name for istiod's plugged-in
+                          CA CRL ConfigMap.
+                        type: string
                       deploymentLabels:
                         additionalProperties:
                           type: string
@@ -10064,18 +10112,25 @@ spec:
                     type: object
                 type: object
               version:
-                default: v1.27.1
+                default: v1.28.0
                 description: |-
                   Defines the version of Istio to install.
-                  Must be one of: v1.27-latest, v1.27.1, v1.27.0, v1.26-latest, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25-latest, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, master, v1.28-alpha.724e2360.
+                  Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, master, v1.29-alpha.b2f713a9.
                 enum:
+                - v1.28-latest
+                - v1.28.0
                 - v1.27-latest
+                - v1.27.3
+                - v1.27.2
                 - v1.27.1
                 - v1.27.0
                 - v1.26-latest
+                - v1.26.6
+                - v1.26.5
                 - v1.26.4
                 - v1.26.3
                 - v1.26.2
+                - v1.26.1
                 - v1.26.0
                 - v1.25-latest
                 - v1.25.5
@@ -10104,7 +10159,7 @@ spec:
                 - v1.22.5
                 - v1.21.6
                 - master
-                - v1.28-alpha.724e2360
+                - v1.29-alpha.b2f713a9
                 type: string
             required:
             - namespace
diff --git a/bundle/manifests/sailoperator.io_ztunnels.yaml b/bundle/manifests/sailoperator.io_ztunnels.yaml
index cf0ecd1b9..035885353 100644
--- a/bundle/manifests/sailoperator.io_ztunnels.yaml
+++ b/bundle/manifests/sailoperator.io_ztunnels.yaml
@@ -21,10 +21,6 @@ spec:
       jsonPath: .spec.namespace
       name: Namespace
       type: string
-    - description: The selected profile (collection of value presets).
-      jsonPath: .spec.values.profile
-      name: Profile
-      type: string
     - description: Whether the Istio ztunnel installation is ready to handle requests.
       jsonPath: .status.conditions[?(@.type=="Ready")].status
       name: Ready
@@ -41,7 +37,7 @@ spec:
       jsonPath: .metadata.creationTimestamp
       name: Age
       type: date
-    name: v1alpha1
+    name: v1
     schema:
       openAPIV3Schema:
         description: ZTunnel represents a deployment of the Istio ztunnel component.
@@ -66,8 +62,7 @@ spec:
           spec:
             default:
               namespace: ztunnel
-              profile: ambient
-              version: v1.27.1
+              version: v1.28.0
             description: ZTunnelSpec defines the desired state of ZTunnel
             properties:
               namespace:
@@ -75,24 +70,6 @@ spec:
                 description: Namespace to which the Istio ztunnel component should
                   be installed.
                 type: string
-              profile:
-                default: ambient
-                description: |-
-                  The built-in installation configuration profile to use.
-                  The 'default' profile is 'ambient' and it is always applied.
-                  Must be one of: ambient, default, demo, empty, external, preview, remote, stable.
-                enum:
-                - ambient
-                - default
-                - demo
-                - empty
-                - external
-                - openshift-ambient
-                - openshift
-                - preview
-                - remote
-                - stable
-                type: string
               values:
                 description: Defines the values to be passed to the Helm charts when
                   installing Istio ztunnel.
@@ -127,108 +104,4547 @@ spec:
                                   type: string
                                 request:
                                   description: |-
-                                    Request is the name chosen for a request in the referenced claim.
-                                    If empty, everything from the claim is made available, otherwise
-                                    only the result of this request.
-                                  type: string
-                              required:
-                              - name
-                              type: object
-                            type: array
-                            x-kubernetes-list-map-keys:
-                            - name
-                            x-kubernetes-list-type: map
-                          limits:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: |-
-                              Limits describes the maximum amount of compute resources allowed.
-                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                            type: object
-                          requests:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: |-
-                              Requests describes the minimum amount of compute resources required.
-                              If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                              otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                    Request is the name chosen for a request in the referenced claim.
+                                    If empty, everything from the claim is made available, otherwise
+                                    only the result of this request.
+                                  type: string
+                              required:
+                              - name
+                              type: object
+                            type: array
+                            x-kubernetes-list-map-keys:
+                            - name
+                            x-kubernetes-list-type: map
+                          limits:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            description: |-
+                              Limits describes the maximum amount of compute resources allowed.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                          requests:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            description: |-
+                              Requests describes the minimum amount of compute resources required.
+                              If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                              otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                        type: object
+                      hub:
+                        description: Specifies the docker hub for Istio images.
+                        type: string
+                      imagePullPolicy:
+                        description: |-
+                          Specifies the image pull policy for the Istio images. one of Always, Never, IfNotPresent.
+                          Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated.
+
+                          More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+                        enum:
+                        - Always
+                        - Never
+                        - IfNotPresent
+                        type: string
+                      imagePullSecrets:
+                        description: |-
+                          ImagePullSecrets for the control plane ServiceAccount, list of secrets in the same namespace
+                          to use for pulling any images in pods that reference this ServiceAccount.
+                          Must be set for any cluster configured with private docker registry.
+                        items:
+                          type: string
+                        type: array
+                      logAsJson:
+                        description: Specifies whether istio components should output
+                          logs in json format by adding --log_as_json argument to
+                          each container.
+                        type: boolean
+                      logging:
+                        description: Specifies the global logging level settings for
+                          the Istio control plane components.
+                        properties:
+                          level:
+                            description: |-
+                              Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+                              The control plane has different scopes depending on component, but can configure default log level across all components
+                              If empty, default scope and level will be used as configured in code
+                            type: string
+                        type: object
+                      platform:
+                        description: |-
+                          Platform in which Istio is deployed. Possible values are: "openshift" and "gcp"
+                          An empty value means it is a vanilla Kubernetes distribution, therefore no special
+                          treatment will be considered.
+                        type: string
+                      tag:
+                        description: Specifies the tag for the Istio docker images.
+                        type: string
+                      variant:
+                        description: The variant of the Istio container images to
+                          use. Options are "debug" or "distroless". Unset will use
+                          the default for the given version.
+                        type: string
+                    type: object
+                  ztunnel:
+                    description: Configuration for the Istio ztunnel plugin.
+                    properties:
+                      Annotations:
+                        additionalProperties:
+                          type: string
+                        description: Annotations to apply to all top level resources
+                        type: object
+                      Labels:
+                        additionalProperties:
+                          type: string
+                        description: Labels to apply to all top level resources
+                        type: object
+                      affinity:
+                        description: K8s affinity to set on the ztunnel Pods. Can
+                          be used to exclude ztunnel from being scheduled on specified
+                          nodes.
+                        properties:
+                          nodeAffinity:
+                            description: Describes node affinity scheduling rules
+                              for the pod.
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  The scheduler will prefer to schedule pods to nodes that satisfy
+                                  the affinity expressions specified by this field, but it may choose
+                                  a node that violates one or more of the expressions. The node that is
+                                  most preferred is the one with the greatest sum of weights, i.e.
+                                  for each node that meets all of the scheduling requirements (resource
+                                  request, requiredDuringScheduling affinity expressions, etc.),
+                                  compute a sum by iterating through the elements of this field and adding
+                                  "weight" to the sum if the node matches the corresponding matchExpressions; the
+                                  node(s) with the highest sum are the most preferred.
+                                items:
+                                  description: |-
+                                    An empty preferred scheduling term matches all objects with implicit weight 0
+                                    (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                                  properties:
+                                    preference:
+                                      description: A node selector term, associated
+                                        with the corresponding weight.
+                                      properties:
+                                        matchExpressions:
+                                          description: A list of node selector requirements
+                                            by node's labels.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchFields:
+                                          description: A list of node selector requirements
+                                            by node's fields.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    weight:
+                                      description: Weight associated with matching
+                                        the corresponding nodeSelectorTerm, in the
+                                        range 1-100.
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - preference
+                                  - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  If the affinity requirements specified by this field are not met at
+                                  scheduling time, the pod will not be scheduled onto the node.
+                                  If the affinity requirements specified by this field cease to be met
+                                  at some point during pod execution (e.g. due to an update), the system
+                                  may or may not try to eventually evict the pod from its node.
+                                properties:
+                                  nodeSelectorTerms:
+                                    description: Required. A list of node selector
+                                      terms. The terms are ORed.
+                                    items:
+                                      description: |-
+                                        A null or empty node selector term matches no objects. The requirements of
+                                        them are ANDed.
+                                        The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                      properties:
+                                        matchExpressions:
+                                          description: A list of node selector requirements
+                                            by node's labels.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchFields:
+                                          description: A list of node selector requirements
+                                            by node's fields.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - nodeSelectorTerms
+                                type: object
+                                x-kubernetes-map-type: atomic
+                            type: object
+                          podAffinity:
+                            description: Describes pod affinity scheduling rules (e.g.
+                              co-locate this pod in the same node, zone, etc. as some
+                              other pod(s)).
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  The scheduler will prefer to schedule pods to nodes that satisfy
+                                  the affinity expressions specified by this field, but it may choose
+                                  a node that violates one or more of the expressions. The node that is
+                                  most preferred is the one with the greatest sum of weights, i.e.
+                                  for each node that meets all of the scheduling requirements (resource
+                                  request, requiredDuringScheduling affinity expressions, etc.),
+                                  compute a sum by iterating through the elements of this field and adding
+                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  node(s) with the highest sum are the most preferred.
+                                items:
+                                  description: The weights of all of the matched WeightedPodAffinityTerm
+                                    fields are added per-node to find the most preferred
+                                    node(s)
+                                  properties:
+                                    podAffinityTerm:
+                                      description: Required. A pod affinity term,
+                                        associated with the corresponding weight.
+                                      properties:
+                                        labelSelector:
+                                          description: |-
+                                            A label query over a set of resources, in this case pods.
+                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        matchLabelKeys:
+                                          description: |-
+                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        mismatchLabelKeys:
+                                          description: |-
+                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        namespaceSelector:
+                                          description: |-
+                                            A label query over the set of namespaces that the term applies to.
+                                            The term is applied to the union of the namespaces selected by this field
+                                            and the ones listed in the namespaces field.
+                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                            An empty selector ({}) matches all namespaces.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        namespaces:
+                                          description: |-
+                                            namespaces specifies a static list of namespace names that the term applies to.
+                                            The term is applied to the union of the namespaces listed in this field
+                                            and the ones selected by namespaceSelector.
+                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        topologyKey:
+                                          description: |-
+                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                            selected pods is running.
+                                            Empty topologyKey is not allowed.
+                                          type: string
+                                      required:
+                                      - topologyKey
+                                      type: object
+                                    weight:
+                                      description: |-
+                                        weight associated with matching the corresponding podAffinityTerm,
+                                        in the range 1-100.
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - podAffinityTerm
+                                  - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  If the affinity requirements specified by this field are not met at
+                                  scheduling time, the pod will not be scheduled onto the node.
+                                  If the affinity requirements specified by this field cease to be met
+                                  at some point during pod execution (e.g. due to a pod label update), the
+                                  system may or may not try to eventually evict the pod from its node.
+                                  When there are multiple elements, the lists of nodes corresponding to each
+                                  podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                items:
+                                  description: |-
+                                    Defines a set of pods (namely those matching the labelSelector
+                                    relative to the given namespace(s)) that this pod should be
+                                    co-located (affinity) or not co-located (anti-affinity) with,
+                                    where co-located is defined as running on a node whose value of
+                                    the label with key <topologyKey> matches that of any node on which
+                                    a pod of the set of pods is running
+                                  properties:
+                                    labelSelector:
+                                      description: |-
+                                        A label query over a set of resources, in this case pods.
+                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      description: |-
+                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      description: |-
+                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      description: |-
+                                        A label query over the set of namespaces that the term applies to.
+                                        The term is applied to the union of the namespaces selected by this field
+                                        and the ones listed in the namespaces field.
+                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                        An empty selector ({}) matches all namespaces.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      description: |-
+                                        namespaces specifies a static list of namespace names that the term applies to.
+                                        The term is applied to the union of the namespaces listed in this field
+                                        and the ones selected by namespaceSelector.
+                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      description: |-
+                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                        selected pods is running.
+                                        Empty topologyKey is not allowed.
+                                      type: string
+                                  required:
+                                  - topologyKey
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                          podAntiAffinity:
+                            description: Describes pod anti-affinity scheduling rules
+                              (e.g. avoid putting this pod in the same node, zone,
+                              etc. as some other pod(s)).
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  The scheduler will prefer to schedule pods to nodes that satisfy
+                                  the anti-affinity expressions specified by this field, but it may choose
+                                  a node that violates one or more of the expressions. The node that is
+                                  most preferred is the one with the greatest sum of weights, i.e.
+                                  for each node that meets all of the scheduling requirements (resource
+                                  request, requiredDuringScheduling anti-affinity expressions, etc.),
+                                  compute a sum by iterating through the elements of this field and subtracting
+                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  node(s) with the highest sum are the most preferred.
+                                items:
+                                  description: The weights of all of the matched WeightedPodAffinityTerm
+                                    fields are added per-node to find the most preferred
+                                    node(s)
+                                  properties:
+                                    podAffinityTerm:
+                                      description: Required. A pod affinity term,
+                                        associated with the corresponding weight.
+                                      properties:
+                                        labelSelector:
+                                          description: |-
+                                            A label query over a set of resources, in this case pods.
+                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        matchLabelKeys:
+                                          description: |-
+                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        mismatchLabelKeys:
+                                          description: |-
+                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        namespaceSelector:
+                                          description: |-
+                                            A label query over the set of namespaces that the term applies to.
+                                            The term is applied to the union of the namespaces selected by this field
+                                            and the ones listed in the namespaces field.
+                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                            An empty selector ({}) matches all namespaces.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        namespaces:
+                                          description: |-
+                                            namespaces specifies a static list of namespace names that the term applies to.
+                                            The term is applied to the union of the namespaces listed in this field
+                                            and the ones selected by namespaceSelector.
+                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        topologyKey:
+                                          description: |-
+                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                            selected pods is running.
+                                            Empty topologyKey is not allowed.
+                                          type: string
+                                      required:
+                                      - topologyKey
+                                      type: object
+                                    weight:
+                                      description: |-
+                                        weight associated with matching the corresponding podAffinityTerm,
+                                        in the range 1-100.
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - podAffinityTerm
+                                  - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  If the anti-affinity requirements specified by this field are not met at
+                                  scheduling time, the pod will not be scheduled onto the node.
+                                  If the anti-affinity requirements specified by this field cease to be met
+                                  at some point during pod execution (e.g. due to a pod label update), the
+                                  system may or may not try to eventually evict the pod from its node.
+                                  When there are multiple elements, the lists of nodes corresponding to each
+                                  podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                items:
+                                  description: |-
+                                    Defines a set of pods (namely those matching the labelSelector
+                                    relative to the given namespace(s)) that this pod should be
+                                    co-located (affinity) or not co-located (anti-affinity) with,
+                                    where co-located is defined as running on a node whose value of
+                                    the label with key <topologyKey> matches that of any node on which
+                                    a pod of the set of pods is running
+                                  properties:
+                                    labelSelector:
+                                      description: |-
+                                        A label query over a set of resources, in this case pods.
+                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      description: |-
+                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      description: |-
+                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      description: |-
+                                        A label query over the set of namespaces that the term applies to.
+                                        The term is applied to the union of the namespaces selected by this field
+                                        and the ones listed in the namespaces field.
+                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                        An empty selector ({}) matches all namespaces.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      description: |-
+                                        namespaces specifies a static list of namespace names that the term applies to.
+                                        The term is applied to the union of the namespaces listed in this field
+                                        and the ones selected by namespaceSelector.
+                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      description: |-
+                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                        selected pods is running.
+                                        Empty topologyKey is not allowed.
+                                      type: string
+                                  required:
+                                  - topologyKey
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                        type: object
+                      caAddress:
+                        description: The address of the CA for CSR.
+                        type: string
+                      env:
+                        additionalProperties:
+                          type: string
+                        description: 'A `key: value` mapping of environment variables
+                          to add to the pod'
+                        type: object
+                      hub:
+                        description: Hub to pull the container image from. Image will
+                          be `Hub/Image:Tag-Variant`.
+                        type: string
+                      image:
+                        description: |-
+                          Image name to pull from. Image will be `Hub/Image:Tag-Variant`.
+                          If Image contains a "/", it will replace the entire `image` in the pod.
+                        type: string
+                      imagePullPolicy:
+                        description: |-
+                          Specifies the image pull policy for the Istio images. one of Always, Never, IfNotPresent.
+                          Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated.
+
+                          More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+                        enum:
+                        - Always
+                        - Never
+                        - IfNotPresent
+                        type: string
+                      imagePullSecrets:
+                        description: |-
+                          List of secret names to add to the service account as image pull secrets
+                          to use for pulling any images in pods that reference this ServiceAccount.
+                          Must be set for any cluster configured with private docker registry.
+                        items:
+                          type: string
+                        type: array
+                      istioNamespace:
+                        description: Specifies the default namespace for the Istio
+                          control plane components.
+                        type: string
+                      logAsJson:
+                        description: Specifies whether istio components should output
+                          logs in json format by adding --log_as_json argument to
+                          each container.
+                        type: boolean
+                      logLevel:
+                        default: info
+                        description: 'Configuration log level of ztunnel binary, default
+                          is info. Valid values are: trace, debug, info, warn, error.'
+                        enum:
+                        - trace
+                        - debug
+                        - info
+                        - warn
+                        - error
+                        type: string
+                      multiCluster:
+                        description: |-
+                          Settings for multicluster.
+                          The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
+                          with Istiod configuration.
+                        properties:
+                          clusterName:
+                            description: |-
+                              The name of the cluster this installation will run in. This is required for sidecar injection
+                              to properly label proxies
+                            type: string
+                          enabled:
+                            description: |-
+                              Enables the connection between two kubernetes clusters via their respective ingressgateway services.
+                              Use if the pods in each cluster cannot directly talk to one another.
+                            type: boolean
+                          globalDomainSuffix:
+                            description: The suffix for global service names.
+                            type: string
+                          includeEnvoyFilter:
+                            description: Enable envoy filter to translate `globalDomainSuffix`
+                              to cluster local suffix for cross cluster communication.
+                            type: boolean
+                        type: object
+                      network:
+                        description: defines the network this cluster belong to. This
+                          name corresponds to the networks in the map of mesh networks.
+                        type: string
+                      nodeSelector:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          K8s node selector settings.
+
+                          See https://kubernetes.io/docs/user-guide/node-selection/
+                        type: object
+                      podAnnotations:
+                        additionalProperties:
+                          type: string
+                        description: Annotations added to each pod. The default annotations
+                          are required for scraping prometheus (in most environments).
+                        type: object
+                      podLabels:
+                        additionalProperties:
+                          type: string
+                        description: Additional labels to apply on the pod level.
+                        type: object
+                      resourceName:
+                        description: |-
+                          resourceName, if set, will override the naming of resources. If not set, will default to the release name.
+                          It is recommended to not set this; this is primarily for backwards compatibility.
+                        type: string
+                      resourceQuotas:
+                        description: The resource quotas configuration for ztunnel
+                        properties:
+                          enabled:
+                            description: Controls whether to create resource quotas
+                              or not for the CNI DaemonSet.
+                            type: boolean
+                          pods:
+                            description: The hard limit on the number of pods in the
+                              namespace where the CNI DaemonSet is deployed.
+                            format: int64
+                            type: integer
+                        type: object
+                      resources:
+                        description: The k8s resource requests and limits for the
+                          ztunnel Pods.
+                        properties:
+                          claims:
+                            description: |-
+                              Claims lists the names of resources, defined in spec.resourceClaims,
+                              that are used by this container.
+
+                              This field depends on the
+                              DynamicResourceAllocation feature gate.
+
+                              This field is immutable. It can only be set for containers.
+                            items:
+                              description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                              properties:
+                                name:
+                                  description: |-
+                                    Name must match the name of one entry in pod.spec.resourceClaims of
+                                    the Pod where this field is used. It makes that resource available
+                                    inside a container.
+                                  type: string
+                                request:
+                                  description: |-
+                                    Request is the name chosen for a request in the referenced claim.
+                                    If empty, everything from the claim is made available, otherwise
+                                    only the result of this request.
+                                  type: string
+                              required:
+                              - name
+                              type: object
+                            type: array
+                            x-kubernetes-list-map-keys:
+                            - name
+                            x-kubernetes-list-type: map
+                          limits:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            description: |-
+                              Limits describes the maximum amount of compute resources allowed.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                          requests:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            description: |-
+                              Requests describes the minimum amount of compute resources required.
+                              If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                              otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                        type: object
+                      revision:
+                        description: Configures the revision this control plane is
+                          a part of
+                        type: string
+                      seLinuxOptions:
+                        description: Set seLinux options for the ztunnel pod
+                        properties:
+                          level:
+                            description: Level is SELinux level label that applies
+                              to the container.
+                            type: string
+                          role:
+                            description: Role is a SELinux role label that applies
+                              to the container.
+                            type: string
+                          type:
+                            description: Type is a SELinux type label that applies
+                              to the container.
+                            type: string
+                          user:
+                            description: User is a SELinux user label that applies
+                              to the container.
+                            type: string
+                        type: object
+                      tag:
+                        description: The container image tag to pull. Image will be
+                          `Hub/Image:Tag-Variant`.
+                        type: string
+                      terminationGracePeriodSeconds:
+                        default: 30
+                        description: |-
+                          This value defines:
+                          1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
+                          2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
+                        format: int64
+                        minimum: 0
+                        type: integer
+                      tolerations:
+                        description: Tolerations for the ztunnel pod
+                        items:
+                          description: |-
+                            The pod this Toleration is attached to tolerates any taint that matches
+                            the triple <key,value,effect> using the matching operator <operator>.
+                          properties:
+                            effect:
+                              description: |-
+                                Effect indicates the taint effect to match. Empty means match all taint effects.
+                                When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                              type: string
+                            key:
+                              description: |-
+                                Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                                If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                              type: string
+                            operator:
+                              description: |-
+                                Operator represents a key's relationship to the value.
+                                Valid operators are Exists and Equal. Defaults to Equal.
+                                Exists is equivalent to wildcard for value, so that a pod can
+                                tolerate all taints of a particular category.
+                              type: string
+                            tolerationSeconds:
+                              description: |-
+                                TolerationSeconds represents the period of time the toleration (which must be
+                                of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                                it is not set, which means tolerate the taint forever (do not evict). Zero and
+                                negative values will be treated as 0 (evict immediately) by the system.
+                              format: int64
+                              type: integer
+                            value:
+                              description: |-
+                                Value is the taint value the toleration matches to.
+                                If the operator is Exists, the value should be empty, otherwise just a regular string.
+                              type: string
+                          type: object
+                        type: array
+                      updateStrategy:
+                        description: Defines the update strategy to use when the version
+                          in the Ztunnel CR is updated.
+                        properties:
+                          rollingUpdate:
+                            description: Rolling update config params. Present only
+                              if type = "RollingUpdate".
+                            properties:
+                              maxSurge:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  The maximum number of nodes with an existing available DaemonSet pod that
+                                  can have an updated DaemonSet pod during during an update.
+                                  Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
+                                  This can not be 0 if MaxUnavailable is 0.
+                                  Absolute number is calculated from percentage by rounding up to a minimum of 1.
+                                  Default value is 0.
+                                  Example: when this is set to 30%, at most 30% of the total number of nodes
+                                  that should be running the daemon pod (i.e. status.desiredNumberScheduled)
+                                  can have their a new pod created before the old pod is marked as deleted.
+                                  The update starts by launching new pods on 30% of nodes. Once an updated
+                                  pod is available (Ready for at least minReadySeconds) the old DaemonSet pod
+                                  on that node is marked deleted. If the old pod becomes unavailable for any
+                                  reason (Ready transitions to false, is evicted, or is drained) an updated
+                                  pod is immediately created on that node without considering surge limits.
+                                  Allowing surge implies the possibility that the resources consumed by the
+                                  daemonset on any given node can double if the readiness check fails, and
+                                  so resource intensive daemonsets should take into account that they may
+                                  cause evictions during disruption.
+                                x-kubernetes-int-or-string: true
+                              maxUnavailable:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  The maximum number of DaemonSet pods that can be unavailable during the
+                                  update. Value can be an absolute number (ex: 5) or a percentage of total
+                                  number of DaemonSet pods at the start of the update (ex: 10%). Absolute
+                                  number is calculated from percentage by rounding up.
+                                  This cannot be 0 if MaxSurge is 0
+                                  Default value is 1.
+                                  Example: when this is set to 30%, at most 30% of the total number of nodes
+                                  that should be running the daemon pod (i.e. status.desiredNumberScheduled)
+                                  can have their pods stopped for an update at any given time. The update
+                                  starts by stopping at most 30% of those DaemonSet pods and then brings
+                                  up new DaemonSet pods in their place. Once the new pods are available,
+                                  it then proceeds onto other DaemonSet pods, thus ensuring that at least
+                                  70% of original number of DaemonSet pods are available at all times during
+                                  the update.
+                                x-kubernetes-int-or-string: true
+                            type: object
+                          type:
+                            description: Type of daemon set update. Can be "RollingUpdate"
+                              or "OnDelete". Default is RollingUpdate.
+                            type: string
+                        type: object
+                      variant:
+                        description: The container image variant to pull. Options
+                          are "debug" or "distroless". Unset will use the default
+                          for the given version.
+                        type: string
+                      volumeMounts:
+                        description: Additional volumeMounts to the ztunnel container
+                        items:
+                          description: VolumeMount describes a mounting of a Volume
+                            within a container.
+                          properties:
+                            mountPath:
+                              description: |-
+                                Path within the container at which the volume should be mounted.  Must
+                                not contain ':'.
+                              type: string
+                            mountPropagation:
+                              description: |-
+                                mountPropagation determines how mounts are propagated from the host
+                                to container and the other way around.
+                                When not set, MountPropagationNone is used.
+                                This field is beta in 1.10.
+                                When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
+                                (which defaults to None).
+                              type: string
+                            name:
+                              description: This must match the Name of a Volume.
+                              type: string
+                            readOnly:
+                              description: |-
+                                Mounted read-only if true, read-write otherwise (false or unspecified).
+                                Defaults to false.
+                              type: boolean
+                            recursiveReadOnly:
+                              description: |-
+                                RecursiveReadOnly specifies whether read-only mounts should be handled
+                                recursively.
+
+                                If ReadOnly is false, this field has no meaning and must be unspecified.
+
+                                If ReadOnly is true, and this field is set to Disabled, the mount is not made
+                                recursively read-only.  If this field is set to IfPossible, the mount is made
+                                recursively read-only, if it is supported by the container runtime.  If this
+                                field is set to Enabled, the mount is made recursively read-only if it is
+                                supported by the container runtime, otherwise the pod will not be started and
+                                an error will be generated to indicate the reason.
+
+                                If this field is set to IfPossible or Enabled, MountPropagation must be set to
+                                None (or be unspecified, which defaults to None).
+
+                                If this field is not specified, it is treated as an equivalent of Disabled.
+                              type: string
+                            subPath:
+                              description: |-
+                                Path within the volume from which the container's volume should be mounted.
+                                Defaults to "" (volume's root).
+                              type: string
+                            subPathExpr:
+                              description: |-
+                                Expanded path within the volume from which the container's volume should be mounted.
+                                Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
+                                Defaults to "" (volume's root).
+                                SubPathExpr and SubPath are mutually exclusive.
+                              type: string
+                          required:
+                          - mountPath
+                          - name
+                          type: object
+                        type: array
+                      volumes:
+                        description: Additional volumes to add to the ztunnel Pod.
+                        items:
+                          description: Volume represents a named volume in a pod that
+                            may be accessed by any container in the pod.
+                          properties:
+                            awsElasticBlockStore:
+                              description: |-
+                                awsElasticBlockStore represents an AWS Disk resource that is attached to a
+                                kubelet's host machine and then exposed to the pod.
+                                Deprecated: AWSElasticBlockStore is deprecated. All operations for the in-tree
+                                awsElasticBlockStore type are redirected to the ebs.csi.aws.com CSI driver.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type of the volume that you want to mount.
+                                    Tip: Ensure that the filesystem type is supported by the host operating system.
+                                    Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
+                                  type: string
+                                partition:
+                                  description: |-
+                                    partition is the partition in the volume that you want to mount.
+                                    If omitted, the default is to mount by volume name.
+                                    Examples: For volume /dev/sda1, you specify the partition as "1".
+                                    Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty).
+                                  format: int32
+                                  type: integer
+                                readOnly:
+                                  description: |-
+                                    readOnly value true will force the readOnly setting in VolumeMounts.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
+                                  type: boolean
+                                volumeID:
+                                  description: |-
+                                    volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume).
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
+                                  type: string
+                              required:
+                              - volumeID
+                              type: object
+                            azureDisk:
+                              description: |-
+                                azureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.
+                                Deprecated: AzureDisk is deprecated. All operations for the in-tree azureDisk type
+                                are redirected to the disk.csi.azure.com CSI driver.
+                              properties:
+                                cachingMode:
+                                  description: 'cachingMode is the Host Caching mode:
+                                    None, Read Only, Read Write.'
+                                  type: string
+                                diskName:
+                                  description: diskName is the Name of the data disk
+                                    in the blob storage
+                                  type: string
+                                diskURI:
+                                  description: diskURI is the URI of data disk in
+                                    the blob storage
+                                  type: string
+                                fsType:
+                                  default: ext4
+                                  description: |-
+                                    fsType is Filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                kind:
+                                  description: 'kind expected values are Shared: multiple
+                                    blob disks per storage account  Dedicated: single
+                                    blob disk per storage account  Managed: azure
+                                    managed data disk (only in managed availability
+                                    set). defaults to shared'
+                                  type: string
+                                readOnly:
+                                  default: false
+                                  description: |-
+                                    readOnly Defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                              required:
+                              - diskName
+                              - diskURI
+                              type: object
+                            azureFile:
+                              description: |-
+                                azureFile represents an Azure File Service mount on the host and bind mount to the pod.
+                                Deprecated: AzureFile is deprecated. All operations for the in-tree azureFile type
+                                are redirected to the file.csi.azure.com CSI driver.
+                              properties:
+                                readOnly:
+                                  description: |-
+                                    readOnly defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                secretName:
+                                  description: secretName is the  name of secret that
+                                    contains Azure Storage Account Name and Key
+                                  type: string
+                                shareName:
+                                  description: shareName is the azure share Name
+                                  type: string
+                              required:
+                              - secretName
+                              - shareName
+                              type: object
+                            cephfs:
+                              description: |-
+                                cephFS represents a Ceph FS mount on the host that shares a pod's lifetime.
+                                Deprecated: CephFS is deprecated and the in-tree cephfs type is no longer supported.
+                              properties:
+                                monitors:
+                                  description: |-
+                                    monitors is Required: Monitors is a collection of Ceph monitors
+                                    More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                path:
+                                  description: 'path is Optional: Used as the mounted
+                                    root, rather than the full Ceph tree, default
+                                    is /'
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly is Optional: Defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                    More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
+                                  type: boolean
+                                secretFile:
+                                  description: |-
+                                    secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret
+                                    More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
+                                  type: string
+                                secretRef:
+                                  description: |-
+                                    secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty.
+                                    More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                user:
+                                  description: |-
+                                    user is optional: User is the rados user name, default is admin
+                                    More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
+                                  type: string
+                              required:
+                              - monitors
+                              type: object
+                            cinder:
+                              description: |-
+                                cinder represents a cinder volume attached and mounted on kubelets host machine.
+                                Deprecated: Cinder is deprecated. All operations for the in-tree cinder type
+                                are redirected to the cinder.csi.openstack.org CSI driver.
+                                More info: https://examples.k8s.io/mysql-cinder-pd/README.md
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                    More info: https://examples.k8s.io/mysql-cinder-pd/README.md
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                    More info: https://examples.k8s.io/mysql-cinder-pd/README.md
+                                  type: boolean
+                                secretRef:
+                                  description: |-
+                                    secretRef is optional: points to a secret object containing parameters used to connect
+                                    to OpenStack.
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                volumeID:
+                                  description: |-
+                                    volumeID used to identify the volume in cinder.
+                                    More info: https://examples.k8s.io/mysql-cinder-pd/README.md
+                                  type: string
+                              required:
+                              - volumeID
+                              type: object
+                            configMap:
+                              description: configMap represents a configMap that should
+                                populate this volume
+                              properties:
+                                defaultMode:
+                                  description: |-
+                                    defaultMode is optional: mode bits used to set permissions on created files by default.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                    Defaults to 0644.
+                                    Directories within the path are not affected by this setting.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  format: int32
+                                  type: integer
+                                items:
+                                  description: |-
+                                    items if unspecified, each key-value pair in the Data field of the referenced
+                                    ConfigMap will be projected into the volume as a file whose name is the
+                                    key and content is the value. If specified, the listed keys will be
+                                    projected into the specified paths, and unlisted keys will not be
+                                    present. If a key is specified which is not present in the ConfigMap,
+                                    the volume setup will error unless it is marked optional. Paths must be
+                                    relative and may not contain the '..' path or start with '..'.
+                                  items:
+                                    description: Maps a string key to a path within
+                                      a volume.
+                                    properties:
+                                      key:
+                                        description: key is the key to project.
+                                        type: string
+                                      mode:
+                                        description: |-
+                                          mode is Optional: mode bits used to set permissions on this file.
+                                          Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                          YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                          If not specified, the volume defaultMode will be used.
+                                          This might be in conflict with other options that affect the file
+                                          mode, like fsGroup, and the result can be other mode bits set.
+                                        format: int32
+                                        type: integer
+                                      path:
+                                        description: |-
+                                          path is the relative path of the file to map the key to.
+                                          May not be an absolute path.
+                                          May not contain the path element '..'.
+                                          May not start with the string '..'.
+                                        type: string
+                                    required:
+                                    - key
+                                    - path
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                name:
+                                  default: ""
+                                  description: |-
+                                    Name of the referent.
+                                    This field is effectively required, but due to backwards compatibility is
+                                    allowed to be empty. Instances of this type with an empty value here are
+                                    almost certainly wrong.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                                optional:
+                                  description: optional specify whether the ConfigMap
+                                    or its keys must be defined
+                                  type: boolean
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            csi:
+                              description: csi (Container Storage Interface) represents
+                                ephemeral storage that is handled by certain external
+                                CSI drivers.
+                              properties:
+                                driver:
+                                  description: |-
+                                    driver is the name of the CSI driver that handles this volume.
+                                    Consult with your admin for the correct name as registered in the cluster.
+                                  type: string
+                                fsType:
+                                  description: |-
+                                    fsType to mount. Ex. "ext4", "xfs", "ntfs".
+                                    If not provided, the empty value is passed to the associated CSI driver
+                                    which will determine the default filesystem to apply.
+                                  type: string
+                                nodePublishSecretRef:
+                                  description: |-
+                                    nodePublishSecretRef is a reference to the secret object containing
+                                    sensitive information to pass to the CSI driver to complete the CSI
+                                    NodePublishVolume and NodeUnpublishVolume calls.
+                                    This field is optional, and  may be empty if no secret is required. If the
+                                    secret object contains more than one secret, all secret references are passed.
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                readOnly:
+                                  description: |-
+                                    readOnly specifies a read-only configuration for the volume.
+                                    Defaults to false (read/write).
+                                  type: boolean
+                                volumeAttributes:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    volumeAttributes stores driver-specific properties that are passed to the CSI
+                                    driver. Consult your driver's documentation for supported values.
+                                  type: object
+                              required:
+                              - driver
+                              type: object
+                            downwardAPI:
+                              description: downwardAPI represents downward API about
+                                the pod that should populate this volume
+                              properties:
+                                defaultMode:
+                                  description: |-
+                                    Optional: mode bits to use on created files by default. Must be a
+                                    Optional: mode bits used to set permissions on created files by default.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                    Defaults to 0644.
+                                    Directories within the path are not affected by this setting.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  format: int32
+                                  type: integer
+                                items:
+                                  description: Items is a list of downward API volume
+                                    file
+                                  items:
+                                    description: DownwardAPIVolumeFile represents
+                                      information to create the file containing the
+                                      pod field
+                                    properties:
+                                      fieldRef:
+                                        description: 'Required: Selects a field of
+                                          the pod: only annotations, labels, name,
+                                          namespace and uid are supported.'
+                                        properties:
+                                          apiVersion:
+                                            description: Version of the schema the
+                                              FieldPath is written in terms of, defaults
+                                              to "v1".
+                                            type: string
+                                          fieldPath:
+                                            description: Path of the field to select
+                                              in the specified API version.
+                                            type: string
+                                        required:
+                                        - fieldPath
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      mode:
+                                        description: |-
+                                          Optional: mode bits used to set permissions on this file, must be an octal value
+                                          between 0000 and 0777 or a decimal value between 0 and 511.
+                                          YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                          If not specified, the volume defaultMode will be used.
+                                          This might be in conflict with other options that affect the file
+                                          mode, like fsGroup, and the result can be other mode bits set.
+                                        format: int32
+                                        type: integer
+                                      path:
+                                        description: 'Required: Path is  the relative
+                                          path name of the file to be created. Must
+                                          not be absolute or contain the ''..'' path.
+                                          Must be utf-8 encoded. The first item of
+                                          the relative path must not start with ''..'''
+                                        type: string
+                                      resourceFieldRef:
+                                        description: |-
+                                          Selects a resource of the container: only resources limits and requests
+                                          (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
+                                        properties:
+                                          containerName:
+                                            description: 'Container name: required
+                                              for volumes, optional for env vars'
+                                            type: string
+                                          divisor:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            description: Specifies the output format
+                                              of the exposed resources, defaults to
+                                              "1"
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          resource:
+                                            description: 'Required: resource to select'
+                                            type: string
+                                        required:
+                                        - resource
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                    required:
+                                    - path
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              type: object
+                            emptyDir:
+                              description: |-
+                                emptyDir represents a temporary directory that shares a pod's lifetime.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                              properties:
+                                medium:
+                                  description: |-
+                                    medium represents what type of storage medium should back this directory.
+                                    The default is "" which means to use the node's default medium.
+                                    Must be an empty string (default) or Memory.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                                  type: string
+                                sizeLimit:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  description: |-
+                                    sizeLimit is the total amount of local storage required for this EmptyDir volume.
+                                    The size limit is also applicable for memory medium.
+                                    The maximum usage on memory medium EmptyDir would be the minimum value between
+                                    the SizeLimit specified here and the sum of memory limits of all containers in a pod.
+                                    The default is nil which means that the limit is undefined.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                              type: object
+                            ephemeral:
+                              description: |-
+                                ephemeral represents a volume that is handled by a cluster storage driver.
+                                The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts,
+                                and deleted when the pod is removed.
+
+                                Use this if:
+                                a) the volume is only needed while the pod runs,
+                                b) features of normal volumes like restoring from snapshot or capacity
+                                   tracking are needed,
+                                c) the storage driver is specified through a storage class, and
+                                d) the storage driver supports dynamic volume provisioning through
+                                   a PersistentVolumeClaim (see EphemeralVolumeSource for more
+                                   information on the connection between this volume type
+                                   and PersistentVolumeClaim).
+
+                                Use PersistentVolumeClaim or one of the vendor-specific
+                                APIs for volumes that persist for longer than the lifecycle
+                                of an individual pod.
+
+                                Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to
+                                be used that way - see the documentation of the driver for
+                                more information.
+
+                                A pod can use both types of ephemeral volumes and
+                                persistent volumes at the same time.
+                              properties:
+                                volumeClaimTemplate:
+                                  description: |-
+                                    Will be used to create a stand-alone PVC to provision the volume.
+                                    The pod in which this EphemeralVolumeSource is embedded will be the
+                                    owner of the PVC, i.e. the PVC will be deleted together with the
+                                    pod.  The name of the PVC will be `<pod name>-<volume name>` where
+                                    `<volume name>` is the name from the `PodSpec.Volumes` array
+                                    entry. Pod validation will reject the pod if the concatenated name
+                                    is not valid for a PVC (for example, too long).
+
+                                    An existing PVC with that name that is not owned by the pod
+                                    will *not* be used for the pod to avoid using an unrelated
+                                    volume by mistake. Starting the pod is then blocked until
+                                    the unrelated PVC is removed. If such a pre-created PVC is
+                                    meant to be used by the pod, the PVC has to updated with an
+                                    owner reference to the pod once the pod exists. Normally
+                                    this should not be necessary, but it may be useful when
+                                    manually reconstructing a broken cluster.
+
+                                    This field is read-only and no changes will be made by Kubernetes
+                                    to the PVC after it has been created.
+
+                                    Required, must not be nil.
+                                  properties:
+                                    metadata:
+                                      description: |-
+                                        May contain labels and annotations that will be copied into the PVC
+                                        when creating it. No other fields are allowed and will be rejected during
+                                        validation.
+                                      type: object
+                                    spec:
+                                      description: |-
+                                        The specification for the PersistentVolumeClaim. The entire content is
+                                        copied unchanged into the PVC that gets created from this
+                                        template. The same fields as in a PersistentVolumeClaim
+                                        are also valid here.
+                                      properties:
+                                        accessModes:
+                                          description: |-
+                                            accessModes contains the desired access modes the volume should have.
+                                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        dataSource:
+                                          description: |-
+                                            dataSource field can be used to specify either:
+                                            * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
+                                            * An existing PVC (PersistentVolumeClaim)
+                                            If the provisioner or an external controller can support the specified data source,
+                                            it will create a new volume based on the contents of the specified data source.
+                                            When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
+                                            and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
+                                            If the namespace is specified, then dataSourceRef will not be copied to dataSource.
+                                          properties:
+                                            apiGroup:
+                                              description: |-
+                                                APIGroup is the group for the resource being referenced.
+                                                If APIGroup is not specified, the specified Kind must be in the core API group.
+                                                For any other third-party types, APIGroup is required.
+                                              type: string
+                                            kind:
+                                              description: Kind is the type of resource
+                                                being referenced
+                                              type: string
+                                            name:
+                                              description: Name is the name of resource
+                                                being referenced
+                                              type: string
+                                          required:
+                                          - kind
+                                          - name
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        dataSourceRef:
+                                          description: |-
+                                            dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
+                                            volume is desired. This may be any object from a non-empty API group (non
+                                            core object) or a PersistentVolumeClaim object.
+                                            When this field is specified, volume binding will only succeed if the type of
+                                            the specified object matches some installed volume populator or dynamic
+                                            provisioner.
+                                            This field will replace the functionality of the dataSource field and as such
+                                            if both fields are non-empty, they must have the same value. For backwards
+                                            compatibility, when namespace isn't specified in dataSourceRef,
+                                            both fields (dataSource and dataSourceRef) will be set to the same
+                                            value automatically if one of them is empty and the other is non-empty.
+                                            When namespace is specified in dataSourceRef,
+                                            dataSource isn't set to the same value and must be empty.
+                                            There are three important differences between dataSource and dataSourceRef:
+                                            * While dataSource only allows two specific types of objects, dataSourceRef
+                                              allows any non-core object, as well as PersistentVolumeClaim objects.
+                                            * While dataSource ignores disallowed values (dropping them), dataSourceRef
+                                              preserves all values, and generates an error if a disallowed value is
+                                              specified.
+                                            * While dataSource only allows local objects, dataSourceRef allows objects
+                                              in any namespaces.
+                                            (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
+                                            (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
+                                          properties:
+                                            apiGroup:
+                                              description: |-
+                                                APIGroup is the group for the resource being referenced.
+                                                If APIGroup is not specified, the specified Kind must be in the core API group.
+                                                For any other third-party types, APIGroup is required.
+                                              type: string
+                                            kind:
+                                              description: Kind is the type of resource
+                                                being referenced
+                                              type: string
+                                            name:
+                                              description: Name is the name of resource
+                                                being referenced
+                                              type: string
+                                            namespace:
+                                              description: |-
+                                                Namespace is the namespace of resource being referenced
+                                                Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
+                                                (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
+                                              type: string
+                                          required:
+                                          - kind
+                                          - name
+                                          type: object
+                                        resources:
+                                          description: |-
+                                            resources represents the minimum resources the volume should have.
+                                            If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+                                            that are lower than previous value but must still be higher than capacity recorded in the
+                                            status field of the claim.
+                                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
+                                          properties:
+                                            limits:
+                                              additionalProperties:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                x-kubernetes-int-or-string: true
+                                              description: |-
+                                                Limits describes the maximum amount of compute resources allowed.
+                                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                              type: object
+                                            requests:
+                                              additionalProperties:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                x-kubernetes-int-or-string: true
+                                              description: |-
+                                                Requests describes the minimum amount of compute resources required.
+                                                If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                                otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                              type: object
+                                          type: object
+                                        selector:
+                                          description: selector is a label query over
+                                            volumes to consider for binding.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        storageClassName:
+                                          description: |-
+                                            storageClassName is the name of the StorageClass required by the claim.
+                                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
+                                          type: string
+                                        volumeAttributesClassName:
+                                          description: |-
+                                            volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
+                                            If specified, the CSI driver will create or update the volume with the attributes defined
+                                            in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
+                                            it can be changed after the claim is created. An empty string or nil value indicates that no
+                                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                            this field can be reset to its previous value (including nil) to cancel the modification.
+                                            If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
+                                            set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
+                                            exists.
+                                            More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
+                                          type: string
+                                        volumeMode:
+                                          description: |-
+                                            volumeMode defines what type of volume is required by the claim.
+                                            Value of Filesystem is implied when not included in claim spec.
+                                          type: string
+                                        volumeName:
+                                          description: volumeName is the binding reference
+                                            to the PersistentVolume backing this claim.
+                                          type: string
+                                      type: object
+                                  required:
+                                  - spec
+                                  type: object
+                              type: object
+                            fc:
+                              description: fc represents a Fibre Channel resource
+                                that is attached to a kubelet's host machine and then
+                                exposed to the pod.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                lun:
+                                  description: 'lun is Optional: FC target lun number'
+                                  format: int32
+                                  type: integer
+                                readOnly:
+                                  description: |-
+                                    readOnly is Optional: Defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                targetWWNs:
+                                  description: 'targetWWNs is Optional: FC target
+                                    worldwide names (WWNs)'
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                wwids:
+                                  description: |-
+                                    wwids Optional: FC volume world wide identifiers (wwids)
+                                    Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              type: object
+                            flexVolume:
+                              description: |-
+                                flexVolume represents a generic volume resource that is
+                                provisioned/attached using an exec based plugin.
+                                Deprecated: FlexVolume is deprecated. Consider using a CSIDriver instead.
+                              properties:
+                                driver:
+                                  description: driver is the name of the driver to
+                                    use for this volume.
+                                  type: string
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script.
+                                  type: string
+                                options:
+                                  additionalProperties:
+                                    type: string
+                                  description: 'options is Optional: this field holds
+                                    extra command options if any.'
+                                  type: object
+                                readOnly:
+                                  description: |-
+                                    readOnly is Optional: defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                secretRef:
+                                  description: |-
+                                    secretRef is Optional: secretRef is reference to the secret object containing
+                                    sensitive information to pass to the plugin scripts. This may be
+                                    empty if no secret object is specified. If the secret object
+                                    contains more than one secret, all secrets are passed to the plugin
+                                    scripts.
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                              required:
+                              - driver
+                              type: object
+                            flocker:
+                              description: |-
+                                flocker represents a Flocker volume attached to a kubelet's host machine. This depends on the Flocker control service being running.
+                                Deprecated: Flocker is deprecated and the in-tree flocker type is no longer supported.
+                              properties:
+                                datasetName:
+                                  description: |-
+                                    datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker
+                                    should be considered as deprecated
+                                  type: string
+                                datasetUUID:
+                                  description: datasetUUID is the UUID of the dataset.
+                                    This is unique identifier of a Flocker dataset
+                                  type: string
+                              type: object
+                            gcePersistentDisk:
+                              description: |-
+                                gcePersistentDisk represents a GCE Disk resource that is attached to a
+                                kubelet's host machine and then exposed to the pod.
+                                Deprecated: GCEPersistentDisk is deprecated. All operations for the in-tree
+                                gcePersistentDisk type are redirected to the pd.csi.storage.gke.io CSI driver.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is filesystem type of the volume that you want to mount.
+                                    Tip: Ensure that the filesystem type is supported by the host operating system.
+                                    Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
+                                  type: string
+                                partition:
+                                  description: |-
+                                    partition is the partition in the volume that you want to mount.
+                                    If omitted, the default is to mount by volume name.
+                                    Examples: For volume /dev/sda1, you specify the partition as "1".
+                                    Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty).
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
+                                  format: int32
+                                  type: integer
+                                pdName:
+                                  description: |-
+                                    pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the ReadOnly setting in VolumeMounts.
+                                    Defaults to false.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
+                                  type: boolean
+                              required:
+                              - pdName
+                              type: object
+                            gitRepo:
+                              description: |-
+                                gitRepo represents a git repository at a particular revision.
+                                Deprecated: GitRepo is deprecated. To provision a container with a git repo, mount an
+                                EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir
+                                into the Pod's container.
+                              properties:
+                                directory:
+                                  description: |-
+                                    directory is the target directory name.
+                                    Must not contain or start with '..'.  If '.' is supplied, the volume directory will be the
+                                    git repository.  Otherwise, if specified, the volume will contain the git repository in
+                                    the subdirectory with the given name.
+                                  type: string
+                                repository:
+                                  description: repository is the URL
+                                  type: string
+                                revision:
+                                  description: revision is the commit hash for the
+                                    specified revision.
+                                  type: string
+                              required:
+                              - repository
+                              type: object
+                            glusterfs:
+                              description: |-
+                                glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
+                                Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
+                              properties:
+                                endpoints:
+                                  description: endpoints is the endpoint name that
+                                    details Glusterfs topology.
+                                  type: string
+                                path:
+                                  description: |-
+                                    path is the Glusterfs volume path.
+                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the Glusterfs volume to be mounted with read-only permissions.
+                                    Defaults to false.
+                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                  type: boolean
+                              required:
+                              - endpoints
+                              - path
+                              type: object
+                            hostPath:
+                              description: |-
+                                hostPath represents a pre-existing file or directory on the host
+                                machine that is directly exposed to the container. This is generally
+                                used for system agents or other privileged things that are allowed
+                                to see the host machine. Most containers will NOT need this.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
+                              properties:
+                                path:
+                                  description: |-
+                                    path of the directory on the host.
+                                    If the path is a symlink, it will follow the link to the real path.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
+                                  type: string
+                                type:
+                                  description: |-
+                                    type for HostPath Volume
+                                    Defaults to ""
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
+                                  type: string
+                              required:
+                              - path
+                              type: object
+                            image:
+                              description: |-
+                                image represents an OCI object (a container image or artifact) pulled and mounted on the kubelet's host machine.
+                                The volume is resolved at pod startup depending on which PullPolicy value is provided:
+
+                                - Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.
+                                - Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.
+                                - IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.
+
+                                The volume gets re-resolved if the pod gets deleted and recreated, which means that new remote content will become available on pod recreation.
+                                A failure to resolve or pull the image during pod startup will block containers from starting and may add significant latency. Failures will be retried using normal volume backoff and will be reported on the pod reason and message.
+                                The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
+                                The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
+                                The volume will be mounted read-only (ro) and non-executable files (noexec).
+                                Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
+                                The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
+                              properties:
+                                pullPolicy:
+                                  description: |-
+                                    Policy for pulling OCI objects. Possible values are:
+                                    Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.
+                                    Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.
+                                    IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.
+                                    Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+                                  type: string
+                                reference:
+                                  description: |-
+                                    Required: Image or artifact reference to be used.
+                                    Behaves in the same way as pod.spec.containers[*].image.
+                                    Pull secrets will be assembled in the same way as for the container image by looking up node credentials, SA image pull secrets, and pod spec image pull secrets.
+                                    More info: https://kubernetes.io/docs/concepts/containers/images
+                                    This field is optional to allow higher level config management to default or override
+                                    container images in workload controllers like Deployments and StatefulSets.
+                                  type: string
+                              type: object
+                            iscsi:
+                              description: |-
+                                iscsi represents an ISCSI Disk resource that is attached to a
+                                kubelet's host machine and then exposed to the pod.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
+                              properties:
+                                chapAuthDiscovery:
+                                  description: chapAuthDiscovery defines whether support
+                                    iSCSI Discovery CHAP authentication
+                                  type: boolean
+                                chapAuthSession:
+                                  description: chapAuthSession defines whether support
+                                    iSCSI Session CHAP authentication
+                                  type: boolean
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type of the volume that you want to mount.
+                                    Tip: Ensure that the filesystem type is supported by the host operating system.
+                                    Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi
+                                  type: string
+                                initiatorName:
+                                  description: |-
+                                    initiatorName is the custom iSCSI Initiator Name.
+                                    If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface
+                                    <target portal>:<volume name> will be created for the connection.
+                                  type: string
+                                iqn:
+                                  description: iqn is the target iSCSI Qualified Name.
+                                  type: string
+                                iscsiInterface:
+                                  default: default
+                                  description: |-
+                                    iscsiInterface is the interface Name that uses an iSCSI transport.
+                                    Defaults to 'default' (tcp).
+                                  type: string
+                                lun:
+                                  description: lun represents iSCSI Target Lun number.
+                                  format: int32
+                                  type: integer
+                                portals:
+                                  description: |-
+                                    portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port
+                                    is other than default (typically TCP ports 860 and 3260).
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the ReadOnly setting in VolumeMounts.
+                                    Defaults to false.
+                                  type: boolean
+                                secretRef:
+                                  description: secretRef is the CHAP Secret for iSCSI
+                                    target and initiator authentication
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                targetPortal:
+                                  description: |-
+                                    targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port
+                                    is other than default (typically TCP ports 860 and 3260).
+                                  type: string
+                              required:
+                              - iqn
+                              - lun
+                              - targetPortal
+                              type: object
+                            name:
+                              description: |-
+                                name of the volume.
+                                Must be a DNS_LABEL and unique within the pod.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                            nfs:
+                              description: |-
+                                nfs represents an NFS mount on the host that shares a pod's lifetime
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
+                              properties:
+                                path:
+                                  description: |-
+                                    path that is exported by the NFS server.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the NFS export to be mounted with read-only permissions.
+                                    Defaults to false.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
+                                  type: boolean
+                                server:
+                                  description: |-
+                                    server is the hostname or IP address of the NFS server.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
+                                  type: string
+                              required:
+                              - path
+                              - server
+                              type: object
+                            persistentVolumeClaim:
+                              description: |-
+                                persistentVolumeClaimVolumeSource represents a reference to a
+                                PersistentVolumeClaim in the same namespace.
+                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
+                              properties:
+                                claimName:
+                                  description: |-
+                                    claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.
+                                    More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly Will force the ReadOnly setting in VolumeMounts.
+                                    Default false.
+                                  type: boolean
+                              required:
+                              - claimName
+                              type: object
+                            photonPersistentDisk:
+                              description: |-
+                                photonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine.
+                                Deprecated: PhotonPersistentDisk is deprecated and the in-tree photonPersistentDisk type is no longer supported.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                pdID:
+                                  description: pdID is the ID that identifies Photon
+                                    Controller persistent disk
+                                  type: string
+                              required:
+                              - pdID
+                              type: object
+                            portworxVolume:
+                              description: |-
+                                portworxVolume represents a portworx volume attached and mounted on kubelets host machine.
+                                Deprecated: PortworxVolume is deprecated. All operations for the in-tree portworxVolume type
+                                are redirected to the pxd.portworx.com CSI driver when the CSIMigrationPortworx feature-gate
+                                is on.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fSType represents the filesystem type to mount
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                volumeID:
+                                  description: volumeID uniquely identifies a Portworx
+                                    volume
+                                  type: string
+                              required:
+                              - volumeID
+                              type: object
+                            projected:
+                              description: projected items for all in one resources
+                                secrets, configmaps, and downward API
+                              properties:
+                                defaultMode:
+                                  description: |-
+                                    defaultMode are the mode bits used to set permissions on created files by default.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                    Directories within the path are not affected by this setting.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  format: int32
+                                  type: integer
+                                sources:
+                                  description: |-
+                                    sources is the list of volume projections. Each entry in this list
+                                    handles one source.
+                                  items:
+                                    description: |-
+                                      Projection that may be projected along with other supported volume types.
+                                      Exactly one of these fields must be set.
+                                    properties:
+                                      clusterTrustBundle:
+                                        description: |-
+                                          ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field
+                                          of ClusterTrustBundle objects in an auto-updating file.
+
+                                          Alpha, gated by the ClusterTrustBundleProjection feature gate.
+
+                                          ClusterTrustBundle objects can either be selected by name, or by the
+                                          combination of signer name and a label selector.
+
+                                          Kubelet performs aggressive normalization of the PEM contents written
+                                          into the pod filesystem.  Esoteric PEM features such as inter-block
+                                          comments and block headers are stripped.  Certificates are deduplicated.
+                                          The ordering of certificates within the file is arbitrary, and Kubelet
+                                          may change the order over time.
+                                        properties:
+                                          labelSelector:
+                                            description: |-
+                                              Select all ClusterTrustBundles that match this label selector.  Only has
+                                              effect if signerName is set.  Mutually-exclusive with name.  If unset,
+                                              interpreted as "match nothing".  If set but empty, interpreted as "match
+                                              everything".
+                                            properties:
+                                              matchExpressions:
+                                                description: matchExpressions is a
+                                                  list of label selector requirements.
+                                                  The requirements are ANDed.
+                                                items:
+                                                  description: |-
+                                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                                    relates the key and values.
+                                                  properties:
+                                                    key:
+                                                      description: key is the label
+                                                        key that the selector applies
+                                                        to.
+                                                      type: string
+                                                    operator:
+                                                      description: |-
+                                                        operator represents a key's relationship to a set of values.
+                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                      type: string
+                                                    values:
+                                                      description: |-
+                                                        values is an array of string values. If the operator is In or NotIn,
+                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                        the values array must be empty. This array is replaced during a strategic
+                                                        merge patch.
+                                                      items:
+                                                        type: string
+                                                      type: array
+                                                      x-kubernetes-list-type: atomic
+                                                  required:
+                                                  - key
+                                                  - operator
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              matchLabels:
+                                                additionalProperties:
+                                                  type: string
+                                                description: |-
+                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                type: object
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          name:
+                                            description: |-
+                                              Select a single ClusterTrustBundle by object name.  Mutually-exclusive
+                                              with signerName and labelSelector.
+                                            type: string
+                                          optional:
+                                            description: |-
+                                              If true, don't block pod startup if the referenced ClusterTrustBundle(s)
+                                              aren't available.  If using name, then the named ClusterTrustBundle is
+                                              allowed not to exist.  If using signerName, then the combination of
+                                              signerName and labelSelector is allowed to match zero
+                                              ClusterTrustBundles.
+                                            type: boolean
+                                          path:
+                                            description: Relative path from the volume
+                                              root to write the bundle.
+                                            type: string
+                                          signerName:
+                                            description: |-
+                                              Select all ClusterTrustBundles that match this signer name.
+                                              Mutually-exclusive with name.  The contents of all selected
+                                              ClusterTrustBundles will be unified and deduplicated.
+                                            type: string
+                                        required:
+                                        - path
+                                        type: object
+                                      configMap:
+                                        description: configMap information about the
+                                          configMap data to project
+                                        properties:
+                                          items:
+                                            description: |-
+                                              items if unspecified, each key-value pair in the Data field of the referenced
+                                              ConfigMap will be projected into the volume as a file whose name is the
+                                              key and content is the value. If specified, the listed keys will be
+                                              projected into the specified paths, and unlisted keys will not be
+                                              present. If a key is specified which is not present in the ConfigMap,
+                                              the volume setup will error unless it is marked optional. Paths must be
+                                              relative and may not contain the '..' path or start with '..'.
+                                            items:
+                                              description: Maps a string key to a
+                                                path within a volume.
+                                              properties:
+                                                key:
+                                                  description: key is the key to project.
+                                                  type: string
+                                                mode:
+                                                  description: |-
+                                                    mode is Optional: mode bits used to set permissions on this file.
+                                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                    If not specified, the volume defaultMode will be used.
+                                                    This might be in conflict with other options that affect the file
+                                                    mode, like fsGroup, and the result can be other mode bits set.
+                                                  format: int32
+                                                  type: integer
+                                                path:
+                                                  description: |-
+                                                    path is the relative path of the file to map the key to.
+                                                    May not be an absolute path.
+                                                    May not contain the path element '..'.
+                                                    May not start with the string '..'.
+                                                  type: string
+                                              required:
+                                              - key
+                                              - path
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          name:
+                                            default: ""
+                                            description: |-
+                                              Name of the referent.
+                                              This field is effectively required, but due to backwards compatibility is
+                                              allowed to be empty. Instances of this type with an empty value here are
+                                              almost certainly wrong.
+                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                            type: string
+                                          optional:
+                                            description: optional specify whether
+                                              the ConfigMap or its keys must be defined
+                                            type: boolean
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      downwardAPI:
+                                        description: downwardAPI information about
+                                          the downwardAPI data to project
+                                        properties:
+                                          items:
+                                            description: Items is a list of DownwardAPIVolume
+                                              file
+                                            items:
+                                              description: DownwardAPIVolumeFile represents
+                                                information to create the file containing
+                                                the pod field
+                                              properties:
+                                                fieldRef:
+                                                  description: 'Required: Selects
+                                                    a field of the pod: only annotations,
+                                                    labels, name, namespace and uid
+                                                    are supported.'
+                                                  properties:
+                                                    apiVersion:
+                                                      description: Version of the
+                                                        schema the FieldPath is written
+                                                        in terms of, defaults to "v1".
+                                                      type: string
+                                                    fieldPath:
+                                                      description: Path of the field
+                                                        to select in the specified
+                                                        API version.
+                                                      type: string
+                                                  required:
+                                                  - fieldPath
+                                                  type: object
+                                                  x-kubernetes-map-type: atomic
+                                                mode:
+                                                  description: |-
+                                                    Optional: mode bits used to set permissions on this file, must be an octal value
+                                                    between 0000 and 0777 or a decimal value between 0 and 511.
+                                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                    If not specified, the volume defaultMode will be used.
+                                                    This might be in conflict with other options that affect the file
+                                                    mode, like fsGroup, and the result can be other mode bits set.
+                                                  format: int32
+                                                  type: integer
+                                                path:
+                                                  description: 'Required: Path is  the
+                                                    relative path name of the file
+                                                    to be created. Must not be absolute
+                                                    or contain the ''..'' path. Must
+                                                    be utf-8 encoded. The first item
+                                                    of the relative path must not
+                                                    start with ''..'''
+                                                  type: string
+                                                resourceFieldRef:
+                                                  description: |-
+                                                    Selects a resource of the container: only resources limits and requests
+                                                    (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
+                                                  properties:
+                                                    containerName:
+                                                      description: 'Container name:
+                                                        required for volumes, optional
+                                                        for env vars'
+                                                      type: string
+                                                    divisor:
+                                                      anyOf:
+                                                      - type: integer
+                                                      - type: string
+                                                      description: Specifies the output
+                                                        format of the exposed resources,
+                                                        defaults to "1"
+                                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                      x-kubernetes-int-or-string: true
+                                                    resource:
+                                                      description: 'Required: resource
+                                                        to select'
+                                                      type: string
+                                                  required:
+                                                  - resource
+                                                  type: object
+                                                  x-kubernetes-map-type: atomic
+                                              required:
+                                              - path
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                      podCertificate:
+                                        description: |-
+                                          Projects an auto-rotating credential bundle (private key and certificate
+                                          chain) that the pod can use either as a TLS client or server.
+
+                                          Kubelet generates a private key and uses it to send a
+                                          PodCertificateRequest to the named signer.  Once the signer approves the
+                                          request and issues a certificate chain, Kubelet writes the key and
+                                          certificate chain to the pod filesystem.  The pod does not start until
+                                          certificates have been issued for each podCertificate projected volume
+                                          source in its spec.
+
+                                          Kubelet will begin trying to rotate the certificate at the time indicated
+                                          by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                          timestamp.
+
+                                          Kubelet can write a single file, indicated by the credentialBundlePath
+                                          field, or separate files, indicated by the keyPath and
+                                          certificateChainPath fields.
+
+                                          The credential bundle is a single file in PEM format.  The first PEM
+                                          entry is the private key (in PKCS#8 format), and the remaining PEM
+                                          entries are the certificate chain issued by the signer (typically,
+                                          signers will return their certificate chain in leaf-to-root order).
+
+                                          Prefer using the credential bundle format, since your application code
+                                          can read it atomically.  If you use keyPath and certificateChainPath,
+                                          your application must make two separate file reads. If these coincide
+                                          with a certificate rotation, it is possible that the private key and leaf
+                                          certificate you read may not correspond to each other.  Your application
+                                          will need to check for this condition, and re-read until they are
+                                          consistent.
+
+                                          The named signer controls chooses the format of the certificate it
+                                          issues; consult the signer implementation's documentation to learn how to
+                                          use the certificates it issues.
+                                        properties:
+                                          certificateChainPath:
+                                            description: |-
+                                              Write the certificate chain at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          credentialBundlePath:
+                                            description: |-
+                                              Write the credential bundle at this path in the projected volume.
+
+                                              The credential bundle is a single file that contains multiple PEM blocks.
+                                              The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                              key.
+
+                                              The remaining blocks are CERTIFICATE blocks, containing the issued
+                                              certificate chain from the signer (leaf and any intermediates).
+
+                                              Using credentialBundlePath lets your Pod's application code make a single
+                                              atomic read that retrieves a consistent key and certificate chain.  If you
+                                              project them to separate files, your application code will need to
+                                              additionally check that the leaf certificate was issued to the key.
+                                            type: string
+                                          keyPath:
+                                            description: |-
+                                              Write the key at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          keyType:
+                                            description: |-
+                                              The type of keypair Kubelet will generate for the pod.
+
+                                              Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                              "ECDSAP521", and "ED25519".
+                                            type: string
+                                          maxExpirationSeconds:
+                                            description: |-
+                                              maxExpirationSeconds is the maximum lifetime permitted for the
+                                              certificate.
+
+                                              Kubelet copies this value verbatim into the PodCertificateRequests it
+                                              generates for this projection.
+
+                                              If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                              will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                              value is 7862400 (91 days).
+
+                                              The signer implementation is then free to issue a certificate with any
+                                              lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                              seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                              `kubernetes.io` signers will never issue certificates with a lifetime
+                                              longer than 24 hours.
+                                            format: int32
+                                            type: integer
+                                          signerName:
+                                            description: Kubelet's generated CSRs
+                                              will be addressed to this signer.
+                                            type: string
+                                        required:
+                                        - keyType
+                                        - signerName
+                                        type: object
+                                      secret:
+                                        description: secret information about the
+                                          secret data to project
+                                        properties:
+                                          items:
+                                            description: |-
+                                              items if unspecified, each key-value pair in the Data field of the referenced
+                                              Secret will be projected into the volume as a file whose name is the
+                                              key and content is the value. If specified, the listed keys will be
+                                              projected into the specified paths, and unlisted keys will not be
+                                              present. If a key is specified which is not present in the Secret,
+                                              the volume setup will error unless it is marked optional. Paths must be
+                                              relative and may not contain the '..' path or start with '..'.
+                                            items:
+                                              description: Maps a string key to a
+                                                path within a volume.
+                                              properties:
+                                                key:
+                                                  description: key is the key to project.
+                                                  type: string
+                                                mode:
+                                                  description: |-
+                                                    mode is Optional: mode bits used to set permissions on this file.
+                                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                    If not specified, the volume defaultMode will be used.
+                                                    This might be in conflict with other options that affect the file
+                                                    mode, like fsGroup, and the result can be other mode bits set.
+                                                  format: int32
+                                                  type: integer
+                                                path:
+                                                  description: |-
+                                                    path is the relative path of the file to map the key to.
+                                                    May not be an absolute path.
+                                                    May not contain the path element '..'.
+                                                    May not start with the string '..'.
+                                                  type: string
+                                              required:
+                                              - key
+                                              - path
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          name:
+                                            default: ""
+                                            description: |-
+                                              Name of the referent.
+                                              This field is effectively required, but due to backwards compatibility is
+                                              allowed to be empty. Instances of this type with an empty value here are
+                                              almost certainly wrong.
+                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                            type: string
+                                          optional:
+                                            description: optional field specify whether
+                                              the Secret or its key must be defined
+                                            type: boolean
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      serviceAccountToken:
+                                        description: serviceAccountToken is information
+                                          about the serviceAccountToken data to project
+                                        properties:
+                                          audience:
+                                            description: |-
+                                              audience is the intended audience of the token. A recipient of a token
+                                              must identify itself with an identifier specified in the audience of the
+                                              token, and otherwise should reject the token. The audience defaults to the
+                                              identifier of the apiserver.
+                                            type: string
+                                          expirationSeconds:
+                                            description: |-
+                                              expirationSeconds is the requested duration of validity of the service
+                                              account token. As the token approaches expiration, the kubelet volume
+                                              plugin will proactively rotate the service account token. The kubelet will
+                                              start trying to rotate the token if the token is older than 80 percent of
+                                              its time to live or if the token is older than 24 hours.Defaults to 1 hour
+                                              and must be at least 10 minutes.
+                                            format: int64
+                                            type: integer
+                                          path:
+                                            description: |-
+                                              path is the path relative to the mount point of the file to project the
+                                              token into.
+                                            type: string
+                                        required:
+                                        - path
+                                        type: object
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              type: object
+                            quobyte:
+                              description: |-
+                                quobyte represents a Quobyte mount on the host that shares a pod's lifetime.
+                                Deprecated: Quobyte is deprecated and the in-tree quobyte type is no longer supported.
+                              properties:
+                                group:
+                                  description: |-
+                                    group to map volume access to
+                                    Default is no group
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the Quobyte volume to be mounted with read-only permissions.
+                                    Defaults to false.
+                                  type: boolean
+                                registry:
+                                  description: |-
+                                    registry represents a single or multiple Quobyte Registry services
+                                    specified as a string as host:port pair (multiple entries are separated with commas)
+                                    which acts as the central registry for volumes
+                                  type: string
+                                tenant:
+                                  description: |-
+                                    tenant owning the given Quobyte volume in the Backend
+                                    Used with dynamically provisioned Quobyte volumes, value is set by the plugin
+                                  type: string
+                                user:
+                                  description: |-
+                                    user to map volume access to
+                                    Defaults to serivceaccount user
+                                  type: string
+                                volume:
+                                  description: volume is a string that references
+                                    an already created Quobyte volume by name.
+                                  type: string
+                              required:
+                              - registry
+                              - volume
+                              type: object
+                            rbd:
+                              description: |-
+                                rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
+                                Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type of the volume that you want to mount.
+                                    Tip: Ensure that the filesystem type is supported by the host operating system.
+                                    Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd
+                                  type: string
+                                image:
+                                  description: |-
+                                    image is the rados image name.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  type: string
+                                keyring:
+                                  default: /etc/ceph/keyring
+                                  description: |-
+                                    keyring is the path to key ring for RBDUser.
+                                    Default is /etc/ceph/keyring.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  type: string
+                                monitors:
+                                  description: |-
+                                    monitors is a collection of Ceph monitors.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                pool:
+                                  default: rbd
+                                  description: |-
+                                    pool is the rados pool name.
+                                    Default is rbd.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the ReadOnly setting in VolumeMounts.
+                                    Defaults to false.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  type: boolean
+                                secretRef:
+                                  description: |-
+                                    secretRef is name of the authentication secret for RBDUser. If provided
+                                    overrides keyring.
+                                    Default is nil.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                user:
+                                  default: admin
+                                  description: |-
+                                    user is the rados user name.
+                                    Default is admin.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  type: string
+                              required:
+                              - image
+                              - monitors
+                              type: object
+                            scaleIO:
+                              description: |-
+                                scaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.
+                                Deprecated: ScaleIO is deprecated and the in-tree scaleIO type is no longer supported.
+                              properties:
+                                fsType:
+                                  default: xfs
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs".
+                                    Default is "xfs".
+                                  type: string
+                                gateway:
+                                  description: gateway is the host address of the
+                                    ScaleIO API Gateway.
+                                  type: string
+                                protectionDomain:
+                                  description: protectionDomain is the name of the
+                                    ScaleIO Protection Domain for the configured storage.
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly Defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                secretRef:
+                                  description: |-
+                                    secretRef references to the secret for ScaleIO user and other
+                                    sensitive information. If this is not provided, Login operation will fail.
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                sslEnabled:
+                                  description: sslEnabled Flag enable/disable SSL
+                                    communication with Gateway, default false
+                                  type: boolean
+                                storageMode:
+                                  default: ThinProvisioned
+                                  description: |-
+                                    storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.
+                                    Default is ThinProvisioned.
+                                  type: string
+                                storagePool:
+                                  description: storagePool is the ScaleIO Storage
+                                    Pool associated with the protection domain.
+                                  type: string
+                                system:
+                                  description: system is the name of the storage system
+                                    as configured in ScaleIO.
+                                  type: string
+                                volumeName:
+                                  description: |-
+                                    volumeName is the name of a volume already created in the ScaleIO system
+                                    that is associated with this volume source.
+                                  type: string
+                              required:
+                              - gateway
+                              - secretRef
+                              - system
+                              type: object
+                            secret:
+                              description: |-
+                                secret represents a secret that should populate this volume.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                              properties:
+                                defaultMode:
+                                  description: |-
+                                    defaultMode is Optional: mode bits used to set permissions on created files by default.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values
+                                    for mode bits. Defaults to 0644.
+                                    Directories within the path are not affected by this setting.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  format: int32
+                                  type: integer
+                                items:
+                                  description: |-
+                                    items If unspecified, each key-value pair in the Data field of the referenced
+                                    Secret will be projected into the volume as a file whose name is the
+                                    key and content is the value. If specified, the listed keys will be
+                                    projected into the specified paths, and unlisted keys will not be
+                                    present. If a key is specified which is not present in the Secret,
+                                    the volume setup will error unless it is marked optional. Paths must be
+                                    relative and may not contain the '..' path or start with '..'.
+                                  items:
+                                    description: Maps a string key to a path within
+                                      a volume.
+                                    properties:
+                                      key:
+                                        description: key is the key to project.
+                                        type: string
+                                      mode:
+                                        description: |-
+                                          mode is Optional: mode bits used to set permissions on this file.
+                                          Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                          YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                          If not specified, the volume defaultMode will be used.
+                                          This might be in conflict with other options that affect the file
+                                          mode, like fsGroup, and the result can be other mode bits set.
+                                        format: int32
+                                        type: integer
+                                      path:
+                                        description: |-
+                                          path is the relative path of the file to map the key to.
+                                          May not be an absolute path.
+                                          May not contain the path element '..'.
+                                          May not start with the string '..'.
+                                        type: string
+                                    required:
+                                    - key
+                                    - path
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                optional:
+                                  description: optional field specify whether the
+                                    Secret or its keys must be defined
+                                  type: boolean
+                                secretName:
+                                  description: |-
+                                    secretName is the name of the secret in the pod's namespace to use.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                                  type: string
+                              type: object
+                            storageos:
+                              description: |-
+                                storageOS represents a StorageOS volume attached and mounted on Kubernetes nodes.
+                                Deprecated: StorageOS is deprecated and the in-tree storageos type is no longer supported.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                secretRef:
+                                  description: |-
+                                    secretRef specifies the secret to use for obtaining the StorageOS API
+                                    credentials.  If not specified, default values will be attempted.
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                volumeName:
+                                  description: |-
+                                    volumeName is the human-readable name of the StorageOS volume.  Volume
+                                    names are only unique within a namespace.
+                                  type: string
+                                volumeNamespace:
+                                  description: |-
+                                    volumeNamespace specifies the scope of the volume within StorageOS.  If no
+                                    namespace is specified then the Pod's namespace will be used.  This allows the
+                                    Kubernetes name scoping to be mirrored within StorageOS for tighter integration.
+                                    Set VolumeName to any name to override the default behaviour.
+                                    Set to "default" if you are not using namespaces within StorageOS.
+                                    Namespaces that do not pre-exist within StorageOS will be created.
+                                  type: string
+                              type: object
+                            vsphereVolume:
+                              description: |-
+                                vsphereVolume represents a vSphere volume attached and mounted on kubelets host machine.
+                                Deprecated: VsphereVolume is deprecated. All operations for the in-tree vsphereVolume type
+                                are redirected to the csi.vsphere.vmware.com CSI driver.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                storagePolicyID:
+                                  description: storagePolicyID is the storage Policy
+                                    Based Management (SPBM) profile ID associated
+                                    with the StoragePolicyName.
+                                  type: string
+                                storagePolicyName:
+                                  description: storagePolicyName is the storage Policy
+                                    Based Management (SPBM) profile name.
+                                  type: string
+                                volumePath:
+                                  description: volumePath is the path that identifies
+                                    vSphere volume vmdk
+                                  type: string
+                              required:
+                              - volumePath
+                              type: object
+                          required:
+                          - name
+                          type: object
+                        type: array
+                      xdsAddress:
+                        description: The customized XDS address to retrieve configuration.
+                        type: string
+                    type: object
+                type: object
+              version:
+                default: v1.28.0
+                description: |-
+                  Defines the version of Istio to install.
+                  Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, v1.25-latest, v1.24-latest, master, v1.29-alpha.b2f713a9.
+                enum:
+                - v1.28-latest
+                - v1.28.0
+                - v1.27-latest
+                - v1.27.3
+                - v1.27.2
+                - v1.27.1
+                - v1.27.0
+                - v1.26-latest
+                - v1.26.6
+                - v1.26.5
+                - v1.26.4
+                - v1.26.3
+                - v1.26.2
+                - v1.26.1
+                - v1.26.0
+                - v1.25-latest
+                - v1.24-latest
+                - master
+                - v1.29-alpha.b2f713a9
+                type: string
+            required:
+            - namespace
+            - version
+            type: object
+          status:
+            description: ZTunnelStatus defines the observed state of ZTunnel
+            properties:
+              conditions:
+                description: Represents the latest available observations of the object's
+                  current state.
+                items:
+                  description: ZTunnelCondition represents a specific observation
+                    of the ZTunnel object's state.
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        the last transition.
+                      type: string
+                    reason:
+                      description: Unique, single-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: The status of this condition. Can be True, False
+                        or Unknown.
+                      type: string
+                    type:
+                      description: The type of this condition.
+                      type: string
+                  type: object
+                type: array
+              observedGeneration:
+                description: |-
+                  ObservedGeneration is the most recent generation observed for this
+                  ZTunnel object. It corresponds to the object's generation, which is
+                  updated on mutation by the API Server. The information in the status
+                  pertains to this particular generation of the object.
+                format: int64
+                type: integer
+              state:
+                description: Reports the current state of the object.
+                type: string
+            type: object
+        type: object
+        x-kubernetes-validations:
+        - message: metadata.name must be 'default'
+          rule: self.metadata.name == 'default'
+    served: true
+    storage: true
+    subresources:
+      status: {}
+  - additionalPrinterColumns:
+    - description: The namespace for the ztunnel component.
+      jsonPath: .spec.namespace
+      name: Namespace
+      type: string
+    - description: The selected profile (collection of value presets).
+      jsonPath: .spec.values.profile
+      name: Profile
+      type: string
+    - description: Whether the Istio ztunnel installation is ready to handle requests.
+      jsonPath: .status.conditions[?(@.type=="Ready")].status
+      name: Ready
+      type: string
+    - description: The current state of this object.
+      jsonPath: .status.state
+      name: Status
+      type: string
+    - description: The version of the Istio ztunnel installation.
+      jsonPath: .spec.version
+      name: Version
+      type: string
+    - description: The age of the object
+      jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    deprecated: true
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: ZTunnel represents a deployment of the Istio ztunnel component.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            default:
+              namespace: ztunnel
+              profile: ambient
+              version: v1.28.0
+            description: ZTunnelSpec defines the desired state of ZTunnel
+            properties:
+              namespace:
+                default: ztunnel
+                description: Namespace to which the Istio ztunnel component should
+                  be installed.
+                type: string
+              profile:
+                default: ambient
+                description: |-
+                  The built-in installation configuration profile to use.
+                  The 'default' profile is 'ambient' and it is always applied.
+                  Must be one of: ambient, default, demo, empty, external, preview, remote, stable.
+                enum:
+                - ambient
+                - default
+                - demo
+                - empty
+                - external
+                - openshift-ambient
+                - openshift
+                - preview
+                - remote
+                - stable
+                type: string
+              values:
+                description: Defines the values to be passed to the Helm charts when
+                  installing Istio ztunnel.
+                properties:
+                  global:
+                    description: Part of the global configuration applicable to the
+                      Istio ztunnel component.
+                    properties:
+                      defaultResources:
+                        description: |-
+                          See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container
+
+                          Deprecated: Marked as deprecated in pkg/apis/values_types.proto.
+                        properties:
+                          claims:
+                            description: |-
+                              Claims lists the names of resources, defined in spec.resourceClaims,
+                              that are used by this container.
+
+                              This field depends on the
+                              DynamicResourceAllocation feature gate.
+
+                              This field is immutable. It can only be set for containers.
+                            items:
+                              description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                              properties:
+                                name:
+                                  description: |-
+                                    Name must match the name of one entry in pod.spec.resourceClaims of
+                                    the Pod where this field is used. It makes that resource available
+                                    inside a container.
+                                  type: string
+                                request:
+                                  description: |-
+                                    Request is the name chosen for a request in the referenced claim.
+                                    If empty, everything from the claim is made available, otherwise
+                                    only the result of this request.
+                                  type: string
+                              required:
+                              - name
+                              type: object
+                            type: array
+                            x-kubernetes-list-map-keys:
+                            - name
+                            x-kubernetes-list-type: map
+                          limits:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            description: |-
+                              Limits describes the maximum amount of compute resources allowed.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                          requests:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            description: |-
+                              Requests describes the minimum amount of compute resources required.
+                              If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                              otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                        type: object
+                      hub:
+                        description: Specifies the docker hub for Istio images.
+                        type: string
+                      imagePullPolicy:
+                        description: |-
+                          Specifies the image pull policy for the Istio images. one of Always, Never, IfNotPresent.
+                          Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated.
+
+                          More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+                        enum:
+                        - Always
+                        - Never
+                        - IfNotPresent
+                        type: string
+                      imagePullSecrets:
+                        description: |-
+                          ImagePullSecrets for the control plane ServiceAccount, list of secrets in the same namespace
+                          to use for pulling any images in pods that reference this ServiceAccount.
+                          Must be set for any cluster configured with private docker registry.
+                        items:
+                          type: string
+                        type: array
+                      logAsJson:
+                        description: Specifies whether istio components should output
+                          logs in json format by adding --log_as_json argument to
+                          each container.
+                        type: boolean
+                      logging:
+                        description: Specifies the global logging level settings for
+                          the Istio control plane components.
+                        properties:
+                          level:
+                            description: |-
+                              Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+                              The control plane has different scopes depending on component, but can configure default log level across all components
+                              If empty, default scope and level will be used as configured in code
+                            type: string
+                        type: object
+                      platform:
+                        description: |-
+                          Platform in which Istio is deployed. Possible values are: "openshift" and "gcp"
+                          An empty value means it is a vanilla Kubernetes distribution, therefore no special
+                          treatment will be considered.
+                        type: string
+                      tag:
+                        description: Specifies the tag for the Istio docker images.
+                        type: string
+                      variant:
+                        description: The variant of the Istio container images to
+                          use. Options are "debug" or "distroless". Unset will use
+                          the default for the given version.
+                        type: string
+                    type: object
+                  ztunnel:
+                    description: Configuration for the Istio ztunnel plugin.
+                    properties:
+                      Annotations:
+                        additionalProperties:
+                          type: string
+                        description: Annotations to apply to all top level resources
+                        type: object
+                      Labels:
+                        additionalProperties:
+                          type: string
+                        description: Labels to apply to all top level resources
+                        type: object
+                      affinity:
+                        description: K8s affinity to set on the ztunnel Pods. Can
+                          be used to exclude ztunnel from being scheduled on specified
+                          nodes.
+                        properties:
+                          nodeAffinity:
+                            description: Describes node affinity scheduling rules
+                              for the pod.
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  The scheduler will prefer to schedule pods to nodes that satisfy
+                                  the affinity expressions specified by this field, but it may choose
+                                  a node that violates one or more of the expressions. The node that is
+                                  most preferred is the one with the greatest sum of weights, i.e.
+                                  for each node that meets all of the scheduling requirements (resource
+                                  request, requiredDuringScheduling affinity expressions, etc.),
+                                  compute a sum by iterating through the elements of this field and adding
+                                  "weight" to the sum if the node matches the corresponding matchExpressions; the
+                                  node(s) with the highest sum are the most preferred.
+                                items:
+                                  description: |-
+                                    An empty preferred scheduling term matches all objects with implicit weight 0
+                                    (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                                  properties:
+                                    preference:
+                                      description: A node selector term, associated
+                                        with the corresponding weight.
+                                      properties:
+                                        matchExpressions:
+                                          description: A list of node selector requirements
+                                            by node's labels.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchFields:
+                                          description: A list of node selector requirements
+                                            by node's fields.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    weight:
+                                      description: Weight associated with matching
+                                        the corresponding nodeSelectorTerm, in the
+                                        range 1-100.
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - preference
+                                  - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  If the affinity requirements specified by this field are not met at
+                                  scheduling time, the pod will not be scheduled onto the node.
+                                  If the affinity requirements specified by this field cease to be met
+                                  at some point during pod execution (e.g. due to an update), the system
+                                  may or may not try to eventually evict the pod from its node.
+                                properties:
+                                  nodeSelectorTerms:
+                                    description: Required. A list of node selector
+                                      terms. The terms are ORed.
+                                    items:
+                                      description: |-
+                                        A null or empty node selector term matches no objects. The requirements of
+                                        them are ANDed.
+                                        The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                      properties:
+                                        matchExpressions:
+                                          description: A list of node selector requirements
+                                            by node's labels.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchFields:
+                                          description: A list of node selector requirements
+                                            by node's fields.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - nodeSelectorTerms
+                                type: object
+                                x-kubernetes-map-type: atomic
+                            type: object
+                          podAffinity:
+                            description: Describes pod affinity scheduling rules (e.g.
+                              co-locate this pod in the same node, zone, etc. as some
+                              other pod(s)).
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  The scheduler will prefer to schedule pods to nodes that satisfy
+                                  the affinity expressions specified by this field, but it may choose
+                                  a node that violates one or more of the expressions. The node that is
+                                  most preferred is the one with the greatest sum of weights, i.e.
+                                  for each node that meets all of the scheduling requirements (resource
+                                  request, requiredDuringScheduling affinity expressions, etc.),
+                                  compute a sum by iterating through the elements of this field and adding
+                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  node(s) with the highest sum are the most preferred.
+                                items:
+                                  description: The weights of all of the matched WeightedPodAffinityTerm
+                                    fields are added per-node to find the most preferred
+                                    node(s)
+                                  properties:
+                                    podAffinityTerm:
+                                      description: Required. A pod affinity term,
+                                        associated with the corresponding weight.
+                                      properties:
+                                        labelSelector:
+                                          description: |-
+                                            A label query over a set of resources, in this case pods.
+                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        matchLabelKeys:
+                                          description: |-
+                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        mismatchLabelKeys:
+                                          description: |-
+                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        namespaceSelector:
+                                          description: |-
+                                            A label query over the set of namespaces that the term applies to.
+                                            The term is applied to the union of the namespaces selected by this field
+                                            and the ones listed in the namespaces field.
+                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                            An empty selector ({}) matches all namespaces.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        namespaces:
+                                          description: |-
+                                            namespaces specifies a static list of namespace names that the term applies to.
+                                            The term is applied to the union of the namespaces listed in this field
+                                            and the ones selected by namespaceSelector.
+                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        topologyKey:
+                                          description: |-
+                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                            selected pods is running.
+                                            Empty topologyKey is not allowed.
+                                          type: string
+                                      required:
+                                      - topologyKey
+                                      type: object
+                                    weight:
+                                      description: |-
+                                        weight associated with matching the corresponding podAffinityTerm,
+                                        in the range 1-100.
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - podAffinityTerm
+                                  - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  If the affinity requirements specified by this field are not met at
+                                  scheduling time, the pod will not be scheduled onto the node.
+                                  If the affinity requirements specified by this field cease to be met
+                                  at some point during pod execution (e.g. due to a pod label update), the
+                                  system may or may not try to eventually evict the pod from its node.
+                                  When there are multiple elements, the lists of nodes corresponding to each
+                                  podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                items:
+                                  description: |-
+                                    Defines a set of pods (namely those matching the labelSelector
+                                    relative to the given namespace(s)) that this pod should be
+                                    co-located (affinity) or not co-located (anti-affinity) with,
+                                    where co-located is defined as running on a node whose value of
+                                    the label with key <topologyKey> matches that of any node on which
+                                    a pod of the set of pods is running
+                                  properties:
+                                    labelSelector:
+                                      description: |-
+                                        A label query over a set of resources, in this case pods.
+                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      description: |-
+                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      description: |-
+                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      description: |-
+                                        A label query over the set of namespaces that the term applies to.
+                                        The term is applied to the union of the namespaces selected by this field
+                                        and the ones listed in the namespaces field.
+                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                        An empty selector ({}) matches all namespaces.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      description: |-
+                                        namespaces specifies a static list of namespace names that the term applies to.
+                                        The term is applied to the union of the namespaces listed in this field
+                                        and the ones selected by namespaceSelector.
+                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      description: |-
+                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                        selected pods is running.
+                                        Empty topologyKey is not allowed.
+                                      type: string
+                                  required:
+                                  - topologyKey
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                          podAntiAffinity:
+                            description: Describes pod anti-affinity scheduling rules
+                              (e.g. avoid putting this pod in the same node, zone,
+                              etc. as some other pod(s)).
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  The scheduler will prefer to schedule pods to nodes that satisfy
+                                  the anti-affinity expressions specified by this field, but it may choose
+                                  a node that violates one or more of the expressions. The node that is
+                                  most preferred is the one with the greatest sum of weights, i.e.
+                                  for each node that meets all of the scheduling requirements (resource
+                                  request, requiredDuringScheduling anti-affinity expressions, etc.),
+                                  compute a sum by iterating through the elements of this field and subtracting
+                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  node(s) with the highest sum are the most preferred.
+                                items:
+                                  description: The weights of all of the matched WeightedPodAffinityTerm
+                                    fields are added per-node to find the most preferred
+                                    node(s)
+                                  properties:
+                                    podAffinityTerm:
+                                      description: Required. A pod affinity term,
+                                        associated with the corresponding weight.
+                                      properties:
+                                        labelSelector:
+                                          description: |-
+                                            A label query over a set of resources, in this case pods.
+                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        matchLabelKeys:
+                                          description: |-
+                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        mismatchLabelKeys:
+                                          description: |-
+                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        namespaceSelector:
+                                          description: |-
+                                            A label query over the set of namespaces that the term applies to.
+                                            The term is applied to the union of the namespaces selected by this field
+                                            and the ones listed in the namespaces field.
+                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                            An empty selector ({}) matches all namespaces.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        namespaces:
+                                          description: |-
+                                            namespaces specifies a static list of namespace names that the term applies to.
+                                            The term is applied to the union of the namespaces listed in this field
+                                            and the ones selected by namespaceSelector.
+                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        topologyKey:
+                                          description: |-
+                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                            selected pods is running.
+                                            Empty topologyKey is not allowed.
+                                          type: string
+                                      required:
+                                      - topologyKey
+                                      type: object
+                                    weight:
+                                      description: |-
+                                        weight associated with matching the corresponding podAffinityTerm,
+                                        in the range 1-100.
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - podAffinityTerm
+                                  - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  If the anti-affinity requirements specified by this field are not met at
+                                  scheduling time, the pod will not be scheduled onto the node.
+                                  If the anti-affinity requirements specified by this field cease to be met
+                                  at some point during pod execution (e.g. due to a pod label update), the
+                                  system may or may not try to eventually evict the pod from its node.
+                                  When there are multiple elements, the lists of nodes corresponding to each
+                                  podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                items:
+                                  description: |-
+                                    Defines a set of pods (namely those matching the labelSelector
+                                    relative to the given namespace(s)) that this pod should be
+                                    co-located (affinity) or not co-located (anti-affinity) with,
+                                    where co-located is defined as running on a node whose value of
+                                    the label with key <topologyKey> matches that of any node on which
+                                    a pod of the set of pods is running
+                                  properties:
+                                    labelSelector:
+                                      description: |-
+                                        A label query over a set of resources, in this case pods.
+                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      description: |-
+                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      description: |-
+                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      description: |-
+                                        A label query over the set of namespaces that the term applies to.
+                                        The term is applied to the union of the namespaces selected by this field
+                                        and the ones listed in the namespaces field.
+                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                        An empty selector ({}) matches all namespaces.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      description: |-
+                                        namespaces specifies a static list of namespace names that the term applies to.
+                                        The term is applied to the union of the namespaces listed in this field
+                                        and the ones selected by namespaceSelector.
+                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      description: |-
+                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                        selected pods is running.
+                                        Empty topologyKey is not allowed.
+                                      type: string
+                                  required:
+                                  - topologyKey
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
                             type: object
                         type: object
-                      hub:
-                        description: Specifies the docker hub for Istio images.
-                        type: string
-                      imagePullPolicy:
-                        description: |-
-                          Specifies the image pull policy for the Istio images. one of Always, Never, IfNotPresent.
-                          Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated.
-
-                          More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
-                        enum:
-                        - Always
-                        - Never
-                        - IfNotPresent
-                        type: string
-                      imagePullSecrets:
-                        description: |-
-                          ImagePullSecrets for the control plane ServiceAccount, list of secrets in the same namespace
-                          to use for pulling any images in pods that reference this ServiceAccount.
-                          Must be set for any cluster configured with private docker registry.
-                        items:
-                          type: string
-                        type: array
-                      logAsJson:
-                        description: Specifies whether istio components should output
-                          logs in json format by adding --log_as_json argument to
-                          each container.
-                        type: boolean
-                      logging:
-                        description: Specifies the global logging level settings for
-                          the Istio control plane components.
-                        properties:
-                          level:
-                            description: |-
-                              Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-                              The control plane has different scopes depending on component, but can configure default log level across all components
-                              If empty, default scope and level will be used as configured in code
-                            type: string
-                        type: object
-                      platform:
-                        description: |-
-                          Platform in which Istio is deployed. Possible values are: "openshift" and "gcp"
-                          An empty value means it is a vanilla Kubernetes distribution, therefore no special
-                          treatment will be considered.
-                        type: string
-                      tag:
-                        description: Specifies the tag for the Istio docker images.
-                        type: string
-                      variant:
-                        description: The variant of the Istio container images to
-                          use. Options are "debug" or "distroless". Unset will use
-                          the default for the given version.
-                        type: string
-                    type: object
-                  ztunnel:
-                    description: Configuration for the Istio ztunnel plugin.
-                    properties:
-                      Annotations:
-                        additionalProperties:
-                          type: string
-                        description: Annotations to apply to all top level resources
-                        type: object
-                      Labels:
-                        additionalProperties:
-                          type: string
-                        description: Labels to apply to all top level resources
-                        type: object
                       caAddress:
                         description: The address of the CA for CSR.
                         type: string
@@ -310,6 +4726,18 @@ spec:
                               to cluster local suffix for cross cluster communication.
                             type: boolean
                         type: object
+                      network:
+                        description: defines the network this cluster belong to. This
+                          name corresponds to the networks in the map of mesh networks.
+                        type: string
+                      nodeSelector:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          K8s node selector settings.
+
+                          See https://kubernetes.io/docs/user-guide/node-selection/
+                        type: object
                       podAnnotations:
                         additionalProperties:
                           type: string
@@ -326,6 +4754,19 @@ spec:
                           resourceName, if set, will override the naming of resources. If not set, will default to the release name.
                           It is recommended to not set this; this is primarily for backwards compatibility.
                         type: string
+                      resourceQuotas:
+                        description: The resource quotas configuration for ztunnel
+                        properties:
+                          enabled:
+                            description: Controls whether to create resource quotas
+                              or not for the CNI DaemonSet.
+                            type: boolean
+                          pods:
+                            description: The hard limit on the number of pods in the
+                              namespace where the CNI DaemonSet is deployed.
+                            format: int64
+                            type: integer
+                        type: object
                       resources:
                         description: The k8s resource requests and limits for the
                           ztunnel Pods.
@@ -390,6 +4831,26 @@ spec:
                         description: Configures the revision this control plane is
                           a part of
                         type: string
+                      seLinuxOptions:
+                        description: Set seLinux options for the ztunnel pod
+                        properties:
+                          level:
+                            description: Level is SELinux level label that applies
+                              to the container.
+                            type: string
+                          role:
+                            description: Role is a SELinux role label that applies
+                              to the container.
+                            type: string
+                          type:
+                            description: Type is a SELinux type label that applies
+                              to the container.
+                            type: string
+                          user:
+                            description: User is a SELinux user label that applies
+                              to the container.
+                            type: string
+                        type: object
                       tag:
                         description: The container image tag to pull. Image will be
                           `Hub/Image:Tag-Variant`.
@@ -403,6 +4864,103 @@ spec:
                         format: int64
                         minimum: 0
                         type: integer
+                      tolerations:
+                        description: Tolerations for the ztunnel pod
+                        items:
+                          description: |-
+                            The pod this Toleration is attached to tolerates any taint that matches
+                            the triple <key,value,effect> using the matching operator <operator>.
+                          properties:
+                            effect:
+                              description: |-
+                                Effect indicates the taint effect to match. Empty means match all taint effects.
+                                When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                              type: string
+                            key:
+                              description: |-
+                                Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                                If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                              type: string
+                            operator:
+                              description: |-
+                                Operator represents a key's relationship to the value.
+                                Valid operators are Exists and Equal. Defaults to Equal.
+                                Exists is equivalent to wildcard for value, so that a pod can
+                                tolerate all taints of a particular category.
+                              type: string
+                            tolerationSeconds:
+                              description: |-
+                                TolerationSeconds represents the period of time the toleration (which must be
+                                of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                                it is not set, which means tolerate the taint forever (do not evict). Zero and
+                                negative values will be treated as 0 (evict immediately) by the system.
+                              format: int64
+                              type: integer
+                            value:
+                              description: |-
+                                Value is the taint value the toleration matches to.
+                                If the operator is Exists, the value should be empty, otherwise just a regular string.
+                              type: string
+                          type: object
+                        type: array
+                      updateStrategy:
+                        description: Defines the update strategy to use when the version
+                          in the Ztunnel CR is updated.
+                        properties:
+                          rollingUpdate:
+                            description: Rolling update config params. Present only
+                              if type = "RollingUpdate".
+                            properties:
+                              maxSurge:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  The maximum number of nodes with an existing available DaemonSet pod that
+                                  can have an updated DaemonSet pod during during an update.
+                                  Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
+                                  This can not be 0 if MaxUnavailable is 0.
+                                  Absolute number is calculated from percentage by rounding up to a minimum of 1.
+                                  Default value is 0.
+                                  Example: when this is set to 30%, at most 30% of the total number of nodes
+                                  that should be running the daemon pod (i.e. status.desiredNumberScheduled)
+                                  can have their a new pod created before the old pod is marked as deleted.
+                                  The update starts by launching new pods on 30% of nodes. Once an updated
+                                  pod is available (Ready for at least minReadySeconds) the old DaemonSet pod
+                                  on that node is marked deleted. If the old pod becomes unavailable for any
+                                  reason (Ready transitions to false, is evicted, or is drained) an updated
+                                  pod is immediately created on that node without considering surge limits.
+                                  Allowing surge implies the possibility that the resources consumed by the
+                                  daemonset on any given node can double if the readiness check fails, and
+                                  so resource intensive daemonsets should take into account that they may
+                                  cause evictions during disruption.
+                                x-kubernetes-int-or-string: true
+                              maxUnavailable:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  The maximum number of DaemonSet pods that can be unavailable during the
+                                  update. Value can be an absolute number (ex: 5) or a percentage of total
+                                  number of DaemonSet pods at the start of the update (ex: 10%). Absolute
+                                  number is calculated from percentage by rounding up.
+                                  This cannot be 0 if MaxSurge is 0
+                                  Default value is 1.
+                                  Example: when this is set to 30%, at most 30% of the total number of nodes
+                                  that should be running the daemon pod (i.e. status.desiredNumberScheduled)
+                                  can have their pods stopped for an update at any given time. The update
+                                  starts by stopping at most 30% of those DaemonSet pods and then brings
+                                  up new DaemonSet pods in their place. Once the new pods are available,
+                                  it then proceeds onto other DaemonSet pods, thus ensuring that at least
+                                  70% of original number of DaemonSet pods are available at all times during
+                                  the update.
+                                x-kubernetes-int-or-string: true
+                            type: object
+                          type:
+                            description: Type of daemon set update. Can be "RollingUpdate"
+                              or "OnDelete". Default is RollingUpdate.
+                            type: string
+                        type: object
                       variant:
                         description: The container image variant to pull. Options
                           are "debug" or "distroless". Unset will use the default
@@ -2379,35 +6937,30 @@ spec:
                     type: object
                 type: object
               version:
-                default: v1.27.1
+                default: v1.28.0
                 description: |-
                   Defines the version of Istio to install.
-                  Must be one of: v1.27-latest, v1.27.1, v1.27.0, v1.26-latest, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25-latest, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, master, v1.28-alpha.724e2360.
+                  Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, v1.25-latest, v1.24-latest, master, v1.29-alpha.b2f713a9.
                 enum:
+                - v1.28-latest
+                - v1.28.0
                 - v1.27-latest
+                - v1.27.3
+                - v1.27.2
                 - v1.27.1
                 - v1.27.0
                 - v1.26-latest
+                - v1.26.6
+                - v1.26.5
                 - v1.26.4
                 - v1.26.3
                 - v1.26.2
+                - v1.26.1
                 - v1.26.0
                 - v1.25-latest
-                - v1.25.5
-                - v1.25.4
-                - v1.25.3
-                - v1.25.2
-                - v1.25.1
                 - v1.24-latest
-                - v1.24.6
-                - v1.24.5
-                - v1.24.4
-                - v1.24.3
-                - v1.24.2
-                - v1.24.1
-                - v1.24.0
                 - master
-                - v1.28-alpha.724e2360
+                - v1.29-alpha.b2f713a9
                 type: string
             required:
             - namespace
@@ -2462,7 +7015,7 @@ spec:
         - message: metadata.name must be 'default'
           rule: self.metadata.name == 'default'
     served: true
-    storage: true
+    storage: false
     subresources:
       status: {}
 status:
diff --git a/bundle/manifests/servicemeshoperator3.clusterserviceversion.yaml b/bundle/manifests/servicemeshoperator3.clusterserviceversion.yaml
index c4ca3119f..b3ce6d9c1 100644
--- a/bundle/manifests/servicemeshoperator3.clusterserviceversion.yaml
+++ b/bundle/manifests/servicemeshoperator3.clusterserviceversion.yaml
@@ -16,7 +16,7 @@ metadata:
               "inactiveRevisionDeletionGracePeriodSeconds": 30,
               "type": "InPlace"
             },
-            "version": "v1.27.1"
+            "version": "v1.28.0"
           }
         },
         {
@@ -27,14 +27,25 @@ metadata:
           },
           "spec": {
             "namespace": "istio-cni",
-            "version": "v1.27.1"
+            "version": "v1.28.0"
+          }
+        },
+        {
+          "apiVersion": "sailoperator.io/v1",
+          "kind": "ZTunnel",
+          "metadata": {
+            "name": "default"
+          },
+          "spec": {
+            "namespace": "ztunnel",
+            "version": "v1.27.3"
           }
         }
       ]
     capabilities: Seamless Upgrades
     categories: OpenShift Optional, Integration & Delivery, Networking, Security
     containerImage: quay.io/maistra-dev/sail-operator:3.0-latest
-    createdAt: "2025-10-07T06:12:33Z"
+    createdAt: "2025-11-28T12:06:40Z"
     description: The OpenShift Service Mesh Operator enables you to install, configure, and manage an instance of Red Hat OpenShift Service Mesh. OpenShift Service Mesh is based on the open source Istio project.
     features.operators.openshift.io/cnf: "false"
     features.operators.openshift.io/cni: "true"
@@ -47,7 +58,7 @@ metadata:
     features.operators.openshift.io/token-auth-azure: "false"
     features.operators.openshift.io/token-auth-gcp: "false"
     operators.openshift.io/valid-subscription: '["OpenShift Container Platform", "OpenShift Platform Plus"]'
-    operators.operatorframework.io/builder: operator-sdk-v1.41.1
+    operators.operatorframework.io/builder: operator-sdk-v1.42.0
     operators.operatorframework.io/internal-objects: '["wasmplugins.extensions.istio.io","destinationrules.networking.istio.io","envoyfilters.networking.istio.io","gateways.networking.istio.io","proxyconfigs.networking.istio.io","serviceentries.networking.istio.io","sidecars.networking.istio.io","virtualservices.networking.istio.io","workloadentries.networking.istio.io","workloadgroups.networking.istio.io","authorizationpolicies.security.istio.io","peerauthentications.security.istio.io","requestauthentications.security.istio.io","telemetries.telemetry.istio.io"]'
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
     repository: https://github.com/istio-ecosystem/sail-operator
@@ -135,6 +146,9 @@ spec:
       - kind: WorkloadGroup
         name: workloadgroups.networking.istio.io
         version: v1beta1
+      - kind: ZTunnel
+        name: ztunnels.sailoperator.io
+        version: v1alpha1
       - kind: AuthorizationPolicy
         name: authorizationpolicies.security.istio.io
         version: v1
@@ -166,35 +180,28 @@ spec:
         specDescriptors:
           - description: |-
               Defines the version of Istio to install.
-              Must be one of: v1.27-latest, v1.27.1, v1.27.0, v1.26-latest, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25-latest, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, master, v1.28-alpha.724e2360.
+              Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, master, v1.29-alpha.b2f713a9.
             displayName: Istio Version
             path: version
             x-descriptors:
               - urn:alm:descriptor:com.tectonic.ui:fieldGroup:General
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.28-latest
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.28.0
               - urn:alm:descriptor:com.tectonic.ui:select:v1.27-latest
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.27.3
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.27.2
               - urn:alm:descriptor:com.tectonic.ui:select:v1.27.1
               - urn:alm:descriptor:com.tectonic.ui:select:v1.27.0
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26-latest
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.26.6
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.26.5
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.4
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.3
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.2
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.26.1
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.0
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25-latest
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.5
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.4
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.3
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.2
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.1
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24-latest
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.6
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.5
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.4
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.3
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.2
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.1
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.0
               - urn:alm:descriptor:com.tectonic.ui:select:master
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.28-alpha.724e2360
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.29-alpha.b2f713a9
           - description: Namespace to which the Istio CNI component should be installed. Note that this field is immutable.
             displayName: Namespace
             path: namespace
@@ -232,30 +239,24 @@ spec:
         specDescriptors:
           - description: |-
               Defines the version of Istio to install.
-              Must be one of: v1.27.1, v1.27.0, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, v1.28-alpha.724e2360.
+              Must be one of: v1.28.0, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, v1.29-alpha.b2f713a9.
             displayName: Istio Version
             path: version
             x-descriptors:
               - urn:alm:descriptor:com.tectonic.ui:fieldGroup:General
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.28.0
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.27.3
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.27.2
               - urn:alm:descriptor:com.tectonic.ui:select:v1.27.1
               - urn:alm:descriptor:com.tectonic.ui:select:v1.27.0
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.26.6
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.26.5
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.4
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.3
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.2
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.26.1
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.0
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.5
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.4
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.3
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.2
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.1
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.6
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.5
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.4
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.3
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.2
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.1
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.0
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.28-alpha.724e2360
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.29-alpha.b2f713a9
           - description: Namespace to which the Istio components should be installed.
             displayName: Namespace
             path: namespace
@@ -290,35 +291,28 @@ spec:
               - urn:alm:descriptor:com.tectonic.ui:select:RevisionBased
           - description: |-
               Defines the version of Istio to install.
-              Must be one of: v1.27-latest, v1.27.1, v1.27.0, v1.26-latest, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25-latest, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, master, v1.28-alpha.724e2360.
+              Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, master, v1.29-alpha.b2f713a9.
             displayName: Istio Version
             path: version
             x-descriptors:
               - urn:alm:descriptor:com.tectonic.ui:fieldGroup:General
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.28-latest
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.28.0
               - urn:alm:descriptor:com.tectonic.ui:select:v1.27-latest
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.27.3
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.27.2
               - urn:alm:descriptor:com.tectonic.ui:select:v1.27.1
               - urn:alm:descriptor:com.tectonic.ui:select:v1.27.0
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26-latest
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.26.6
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.26.5
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.4
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.3
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.2
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.26.1
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.0
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25-latest
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.5
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.4
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.3
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.2
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.1
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24-latest
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.6
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.5
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.4
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.3
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.2
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.1
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.0
               - urn:alm:descriptor:com.tectonic.ui:select:master
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.28-alpha.724e2360
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.29-alpha.b2f713a9
           - description: |-
               Defines how many seconds the operator should wait before removing a non-active revision after all
               the workloads have stopped using it. You may want to set this value on the order of minutes.
@@ -374,52 +368,39 @@ spec:
         specDescriptors:
           - description: |-
               Defines the version of Istio to install.
-              Must be one of: v1.27-latest, v1.27.1, v1.27.0, v1.26-latest, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25-latest, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, master, v1.28-alpha.724e2360.
+              Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, v1.25-latest, v1.24-latest, master, v1.29-alpha.b2f713a9.
             displayName: Istio Version
             path: version
             x-descriptors:
               - urn:alm:descriptor:com.tectonic.ui:fieldGroup:General
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.28-latest
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.28.0
               - urn:alm:descriptor:com.tectonic.ui:select:v1.27-latest
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.27.3
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.27.2
               - urn:alm:descriptor:com.tectonic.ui:select:v1.27.1
               - urn:alm:descriptor:com.tectonic.ui:select:v1.27.0
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26-latest
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.26.6
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.26.5
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.4
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.3
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.2
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.26.1
               - urn:alm:descriptor:com.tectonic.ui:select:v1.26.0
               - urn:alm:descriptor:com.tectonic.ui:select:v1.25-latest
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.5
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.4
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.3
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.2
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.25.1
               - urn:alm:descriptor:com.tectonic.ui:select:v1.24-latest
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.6
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.5
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.4
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.3
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.2
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.1
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.24.0
               - urn:alm:descriptor:com.tectonic.ui:select:master
-              - urn:alm:descriptor:com.tectonic.ui:select:v1.28-alpha.724e2360
+              - urn:alm:descriptor:com.tectonic.ui:select:v1.29-alpha.b2f713a9
           - description: Namespace to which the Istio ztunnel component should be installed.
             displayName: Namespace
             path: namespace
             x-descriptors:
               - urn:alm:descriptor:io.kubernetes:Namespace
-          - description: |-
-              The built-in installation configuration profile to use.
-              The 'default' profile is 'ambient' and it is always applied.
-              Must be one of: ambient, default, demo, empty, external, preview, remote, stable.
-            displayName: Profile
-            path: profile
-            x-descriptors:
-              - urn:alm:descriptor:com.tectonic.ui:hidden
           - description: Defines the values to be passed to the Helm charts when installing Istio ztunnel.
             displayName: Helm Values
             path: values
-        version: v1alpha1
+        version: v1
   description: |-
     Red Hat OpenShift Service Mesh is a platform that provides behavioral insight and operational control over a service mesh, providing a uniform way to connect, secure, and monitor microservice applications.
 
@@ -745,59 +726,19 @@ spec:
             template:
               metadata:
                 annotations:
-                  images.v1_24_0.cni: gcr.io/istio-release/install-cni:1.24.0
-                  images.v1_24_0.istiod: gcr.io/istio-release/pilot:1.24.0
-                  images.v1_24_0.proxy: gcr.io/istio-release/proxyv2:1.24.0
-                  images.v1_24_0.ztunnel: gcr.io/istio-release/ztunnel:1.24.0
-                  images.v1_24_1.cni: gcr.io/istio-release/install-cni:1.24.1
-                  images.v1_24_1.istiod: gcr.io/istio-release/pilot:1.24.1
-                  images.v1_24_1.proxy: gcr.io/istio-release/proxyv2:1.24.1
-                  images.v1_24_1.ztunnel: gcr.io/istio-release/ztunnel:1.24.1
-                  images.v1_24_2.cni: gcr.io/istio-release/install-cni:1.24.2
-                  images.v1_24_2.istiod: gcr.io/istio-release/pilot:1.24.2
-                  images.v1_24_2.proxy: gcr.io/istio-release/proxyv2:1.24.2
-                  images.v1_24_2.ztunnel: gcr.io/istio-release/ztunnel:1.24.2
-                  images.v1_24_3.cni: gcr.io/istio-release/install-cni:1.24.3
-                  images.v1_24_3.istiod: gcr.io/istio-release/pilot:1.24.3
-                  images.v1_24_3.proxy: gcr.io/istio-release/proxyv2:1.24.3
-                  images.v1_24_3.ztunnel: gcr.io/istio-release/ztunnel:1.24.3
                   images.v1_24_4.cni: registry.redhat.io/openshift-service-mesh/istio-cni-rhel9:1.24.4
                   images.v1_24_4.istiod: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9:1.24.4
                   images.v1_24_4.must-gather: registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9:3.0.1
                   images.v1_24_4.proxy: registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9:1.24.4
                   images.v1_24_4.ztunnel: registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9:1.24.4
-                  images.v1_24_5.cni: gcr.io/istio-release/install-cni:1.24.5
-                  images.v1_24_5.istiod: gcr.io/istio-release/pilot:1.24.5
-                  images.v1_24_5.proxy: gcr.io/istio-release/proxyv2:1.24.5
-                  images.v1_24_5.ztunnel: gcr.io/istio-release/ztunnel:1.24.5
-                  images.v1_24_6.cni: gcr.io/istio-release/install-cni:1.24.6
-                  images.v1_24_6.istiod: gcr.io/istio-release/pilot:1.24.6
-                  images.v1_24_6.proxy: gcr.io/istio-release/proxyv2:1.24.6
-                  images.v1_24_6.ztunnel: gcr.io/istio-release/ztunnel:1.24.6
-                  images.v1_25_1.cni: gcr.io/istio-release/install-cni:1.25.1
-                  images.v1_25_1.istiod: gcr.io/istio-release/pilot:1.25.1
-                  images.v1_25_1.proxy: gcr.io/istio-release/proxyv2:1.25.1
-                  images.v1_25_1.ztunnel: gcr.io/istio-release/ztunnel:1.25.1
-                  images.v1_25_2.cni: gcr.io/istio-release/install-cni:1.25.2
-                  images.v1_25_2.istiod: gcr.io/istio-release/pilot:1.25.2
-                  images.v1_25_2.proxy: gcr.io/istio-release/proxyv2:1.25.2
-                  images.v1_25_2.ztunnel: gcr.io/istio-release/ztunnel:1.25.2
-                  images.v1_25_3.cni: gcr.io/istio-release/install-cni:1.25.3
-                  images.v1_25_3.istiod: gcr.io/istio-release/pilot:1.25.3
-                  images.v1_25_3.proxy: gcr.io/istio-release/proxyv2:1.25.3
-                  images.v1_25_3.ztunnel: gcr.io/istio-release/ztunnel:1.25.3
-                  images.v1_25_4.cni: gcr.io/istio-release/install-cni:1.25.4
-                  images.v1_25_4.istiod: gcr.io/istio-release/pilot:1.25.4
-                  images.v1_25_4.proxy: gcr.io/istio-release/proxyv2:1.25.4
-                  images.v1_25_4.ztunnel: gcr.io/istio-release/ztunnel:1.25.4
-                  images.v1_25_5.cni: gcr.io/istio-release/install-cni:1.25.5
-                  images.v1_25_5.istiod: gcr.io/istio-release/pilot:1.25.5
-                  images.v1_25_5.proxy: gcr.io/istio-release/proxyv2:1.25.5
-                  images.v1_25_5.ztunnel: gcr.io/istio-release/ztunnel:1.25.5
                   images.v1_26_0.cni: gcr.io/istio-release/install-cni:1.26.0
                   images.v1_26_0.istiod: gcr.io/istio-release/pilot:1.26.0
                   images.v1_26_0.proxy: gcr.io/istio-release/proxyv2:1.26.0
                   images.v1_26_0.ztunnel: gcr.io/istio-release/ztunnel:1.26.0
+                  images.v1_26_1.cni: gcr.io/istio-release/install-cni:1.26.1
+                  images.v1_26_1.istiod: gcr.io/istio-release/pilot:1.26.1
+                  images.v1_26_1.proxy: gcr.io/istio-release/proxyv2:1.26.1
+                  images.v1_26_1.ztunnel: gcr.io/istio-release/ztunnel:1.26.1
                   images.v1_26_2.cni: gcr.io/istio-release/install-cni:1.26.2
                   images.v1_26_2.istiod: gcr.io/istio-release/pilot:1.26.2
                   images.v1_26_2.proxy: gcr.io/istio-release/proxyv2:1.26.2
@@ -810,6 +751,14 @@ spec:
                   images.v1_26_4.istiod: gcr.io/istio-release/pilot:1.26.4
                   images.v1_26_4.proxy: gcr.io/istio-release/proxyv2:1.26.4
                   images.v1_26_4.ztunnel: gcr.io/istio-release/ztunnel:1.26.4
+                  images.v1_26_5.cni: gcr.io/istio-release/install-cni:1.26.5
+                  images.v1_26_5.istiod: gcr.io/istio-release/pilot:1.26.5
+                  images.v1_26_5.proxy: gcr.io/istio-release/proxyv2:1.26.5
+                  images.v1_26_5.ztunnel: gcr.io/istio-release/ztunnel:1.26.5
+                  images.v1_26_6.cni: gcr.io/istio-release/install-cni:1.26.6
+                  images.v1_26_6.istiod: gcr.io/istio-release/pilot:1.26.6
+                  images.v1_26_6.proxy: gcr.io/istio-release/proxyv2:1.26.6
+                  images.v1_26_6.ztunnel: gcr.io/istio-release/ztunnel:1.26.6
                   images.v1_27_0.cni: gcr.io/istio-release/install-cni:1.27.0
                   images.v1_27_0.istiod: gcr.io/istio-release/pilot:1.27.0
                   images.v1_27_0.proxy: gcr.io/istio-release/proxyv2:1.27.0
@@ -818,10 +767,22 @@ spec:
                   images.v1_27_1.istiod: gcr.io/istio-release/pilot:1.27.1
                   images.v1_27_1.proxy: gcr.io/istio-release/proxyv2:1.27.1
                   images.v1_27_1.ztunnel: gcr.io/istio-release/ztunnel:1.27.1
-                  images.v1_28-alpha_724e2360.cni: gcr.io/istio-testing/install-cni:1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-                  images.v1_28-alpha_724e2360.istiod: gcr.io/istio-testing/pilot:1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-                  images.v1_28-alpha_724e2360.proxy: gcr.io/istio-testing/proxyv2:1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-                  images.v1_28-alpha_724e2360.ztunnel: gcr.io/istio-testing/ztunnel:1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
+                  images.v1_27_2.cni: gcr.io/istio-release/install-cni:1.27.2
+                  images.v1_27_2.istiod: gcr.io/istio-release/pilot:1.27.2
+                  images.v1_27_2.proxy: gcr.io/istio-release/proxyv2:1.27.2
+                  images.v1_27_2.ztunnel: gcr.io/istio-release/ztunnel:1.27.2
+                  images.v1_27_3.cni: gcr.io/istio-release/install-cni:1.27.3
+                  images.v1_27_3.istiod: gcr.io/istio-release/pilot:1.27.3
+                  images.v1_27_3.proxy: gcr.io/istio-release/proxyv2:1.27.3
+                  images.v1_27_3.ztunnel: gcr.io/istio-release/ztunnel:1.27.3
+                  images.v1_28_0.cni: gcr.io/istio-release/install-cni:1.28.0
+                  images.v1_28_0.istiod: gcr.io/istio-release/pilot:1.28.0
+                  images.v1_28_0.proxy: gcr.io/istio-release/proxyv2:1.28.0
+                  images.v1_28_0.ztunnel: gcr.io/istio-release/ztunnel:1.28.0
+                  images.v1_29-alpha_b2f713a9.cni: gcr.io/istio-testing/install-cni:1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+                  images.v1_29-alpha_b2f713a9.istiod: gcr.io/istio-testing/pilot:1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+                  images.v1_29-alpha_b2f713a9.proxy: gcr.io/istio-testing/proxyv2:1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+                  images.v1_29-alpha_b2f713a9.ztunnel: gcr.io/istio-testing/ztunnel:1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
                   kubectl.kubernetes.io/default-container: sail-operator
                 labels:
                   app.kubernetes.io/created-by: servicemeshoperator3
diff --git a/bundle/manifests/telemetry.istio.io_telemetries.yaml b/bundle/manifests/telemetry.istio.io_telemetries.yaml
index 5fa69fd40..9bc6ebe6c 100644
--- a/bundle/manifests/telemetry.istio.io_telemetries.yaml
+++ b/bundle/manifests/telemetry.istio.io_telemetries.yaml
@@ -289,12 +289,16 @@ spec:
                               - environment
                             - required:
                               - header
+                            - required:
+                              - formatter
                         - required:
                           - literal
                         - required:
                           - environment
                         - required:
                           - header
+                        - required:
+                          - formatter
                         properties:
                           environment:
                             description: Environment adds the value of an environment
@@ -311,6 +315,18 @@ spec:
                             required:
                             - name
                             type: object
+                          formatter:
+                            description: Formatter adds the value of access logging
+                              substitution formatter.
+                            properties:
+                              value:
+                                description: The formatter tag value to use, same
+                                  formatter as HTTP access logging (e.g.
+                                minLength: 1
+                                type: string
+                            required:
+                            - value
+                            type: object
                           header:
                             description: RequestHeader adds the value of an header
                               from the request to each span.
@@ -737,12 +753,16 @@ spec:
                               - environment
                             - required:
                               - header
+                            - required:
+                              - formatter
                         - required:
                           - literal
                         - required:
                           - environment
                         - required:
                           - header
+                        - required:
+                          - formatter
                         properties:
                           environment:
                             description: Environment adds the value of an environment
@@ -759,6 +779,18 @@ spec:
                             required:
                             - name
                             type: object
+                          formatter:
+                            description: Formatter adds the value of access logging
+                              substitution formatter.
+                            properties:
+                              value:
+                                description: The formatter tag value to use, same
+                                  formatter as HTTP access logging (e.g.
+                                minLength: 1
+                                type: string
+                            required:
+                            - value
+                            type: object
                           header:
                             description: RequestHeader adds the value of an header
                               from the request to each span.
diff --git a/bundle/metadata/annotations.yaml b/bundle/metadata/annotations.yaml
index d53d5df8f..1b741b9f5 100644
--- a/bundle/metadata/annotations.yaml
+++ b/bundle/metadata/annotations.yaml
@@ -6,7 +6,7 @@ annotations:
   operators.operatorframework.io.bundle.package.v1: servicemeshoperator3
   operators.operatorframework.io.bundle.channels.v1: "stable,stable-3.0"
   operators.operatorframework.io.bundle.channel.default.v1: stable
-  operators.operatorframework.io.metrics.builder: operator-sdk-v1.41.1
+  operators.operatorframework.io.metrics.builder: operator-sdk-v1.42.0
   operators.operatorframework.io.metrics.mediatype.v1: metrics+v1
   operators.operatorframework.io.metrics.project_layout: go.kubebuilder.io/v4
 
diff --git a/bundle/tests/scorecard/config.yaml b/bundle/tests/scorecard/config.yaml
index 70251e19e..903107ef2 100644
--- a/bundle/tests/scorecard/config.yaml
+++ b/bundle/tests/scorecard/config.yaml
@@ -8,7 +8,7 @@ stages:
   - entrypoint:
     - scorecard-test
     - basic-check-spec
-    image: quay.io/operator-framework/scorecard-test:v1.41.1
+    image: quay.io/operator-framework/scorecard-test:v1.42.0
     labels:
       suite: basic
       test: basic-check-spec-test
@@ -18,7 +18,7 @@ stages:
   - entrypoint:
     - scorecard-test
     - olm-bundle-validation
-    image: quay.io/operator-framework/scorecard-test:v1.41.1
+    image: quay.io/operator-framework/scorecard-test:v1.42.0
     labels:
       suite: olm
       test: olm-bundle-validation-test
@@ -28,7 +28,7 @@ stages:
   - entrypoint:
     - scorecard-test
     - olm-crds-have-validation
-    image: quay.io/operator-framework/scorecard-test:v1.41.1
+    image: quay.io/operator-framework/scorecard-test:v1.42.0
     labels:
       suite: olm
       test: olm-crds-have-validation-test
@@ -38,7 +38,7 @@ stages:
   - entrypoint:
     - scorecard-test
     - olm-spec-descriptors
-    image: quay.io/operator-framework/scorecard-test:v1.41.1
+    image: quay.io/operator-framework/scorecard-test:v1.42.0
     labels:
       suite: olm
       test: olm-spec-descriptors-test
@@ -48,7 +48,7 @@ stages:
   - entrypoint:
     - scorecard-test
     - olm-status-descriptors
-    image: quay.io/operator-framework/scorecard-test:v1.41.1
+    image: quay.io/operator-framework/scorecard-test:v1.42.0
     labels:
       suite: olm
       test: olm-status-descriptors-test
diff --git a/chart/crds/networking.istio.io_destinationrules.yaml b/chart/crds/networking.istio.io_destinationrules.yaml
index eeeb5b059..db1f19479 100644
--- a/chart/crds/networking.istio.io_destinationrules.yaml
+++ b/chart/crds/networking.istio.io_destinationrules.yaml
@@ -362,7 +362,7 @@ spec:
                                   description: This parameter controls the speed of
                                     traffic increase over the warmup duration.
                                   format: double
-                                  minimum: 1
+                                  minimum: 0
                                   nullable: true
                                   type: number
                                 duration:
@@ -745,7 +745,7 @@ spec:
                                         description: This parameter controls the speed
                                           of traffic increase over the warmup duration.
                                         format: double
-                                        minimum: 1
+                                        minimum: 0
                                         nullable: true
                                         type: number
                                       duration:
@@ -1294,7 +1294,7 @@ spec:
                             description: This parameter controls the speed of traffic
                               increase over the warmup duration.
                             format: double
-                            minimum: 1
+                            minimum: 0
                             nullable: true
                             type: number
                           duration:
@@ -1668,7 +1668,7 @@ spec:
                                   description: This parameter controls the speed of
                                     traffic increase over the warmup duration.
                                   format: double
-                                  minimum: 1
+                                  minimum: 0
                                   nullable: true
                                   type: number
                                 duration:
@@ -2363,7 +2363,7 @@ spec:
                                   description: This parameter controls the speed of
                                     traffic increase over the warmup duration.
                                   format: double
-                                  minimum: 1
+                                  minimum: 0
                                   nullable: true
                                   type: number
                                 duration:
@@ -2746,7 +2746,7 @@ spec:
                                         description: This parameter controls the speed
                                           of traffic increase over the warmup duration.
                                         format: double
-                                        minimum: 1
+                                        minimum: 0
                                         nullable: true
                                         type: number
                                       duration:
@@ -3295,7 +3295,7 @@ spec:
                             description: This parameter controls the speed of traffic
                               increase over the warmup duration.
                             format: double
-                            minimum: 1
+                            minimum: 0
                             nullable: true
                             type: number
                           duration:
@@ -3669,7 +3669,7 @@ spec:
                                   description: This parameter controls the speed of
                                     traffic increase over the warmup duration.
                                   format: double
-                                  minimum: 1
+                                  minimum: 0
                                   nullable: true
                                   type: number
                                 duration:
@@ -4364,7 +4364,7 @@ spec:
                                   description: This parameter controls the speed of
                                     traffic increase over the warmup duration.
                                   format: double
-                                  minimum: 1
+                                  minimum: 0
                                   nullable: true
                                   type: number
                                 duration:
@@ -4747,7 +4747,7 @@ spec:
                                         description: This parameter controls the speed
                                           of traffic increase over the warmup duration.
                                         format: double
-                                        minimum: 1
+                                        minimum: 0
                                         nullable: true
                                         type: number
                                       duration:
@@ -5296,7 +5296,7 @@ spec:
                             description: This parameter controls the speed of traffic
                               increase over the warmup duration.
                             format: double
-                            minimum: 1
+                            minimum: 0
                             nullable: true
                             type: number
                           duration:
@@ -5670,7 +5670,7 @@ spec:
                                   description: This parameter controls the speed of
                                     traffic increase over the warmup duration.
                                   format: double
-                                  minimum: 1
+                                  minimum: 0
                                   nullable: true
                                   type: number
                                 duration:
diff --git a/chart/crds/networking.istio.io_envoyfilters.yaml b/chart/crds/networking.istio.io_envoyfilters.yaml
index b976f41da..592a403f3 100644
--- a/chart/crds/networking.istio.io_envoyfilters.yaml
+++ b/chart/crds/networking.istio.io_envoyfilters.yaml
@@ -63,12 +63,16 @@ spec:
                             - routeConfiguration
                           - required:
                             - cluster
+                          - required:
+                            - waypoint
                       - required:
                         - listener
                       - required:
                         - routeConfiguration
                       - required:
                         - cluster
+                      - required:
+                        - waypoint
                       properties:
                         cluster:
                           description: Match on envoy cluster attributes.
@@ -94,12 +98,13 @@ spec:
                           description: |-
                             The specific config generation context to match on.
 
-                            Valid Options: ANY, SIDECAR_INBOUND, SIDECAR_OUTBOUND, GATEWAY
+                            Valid Options: ANY, SIDECAR_INBOUND, SIDECAR_OUTBOUND, GATEWAY, WAYPOINT
                           enum:
                           - ANY
                           - SIDECAR_INBOUND
                           - SIDECAR_OUTBOUND
                           - GATEWAY
+                          - WAYPOINT
                           type: string
                         listener:
                           description: Match on envoy listener attributes.
@@ -229,7 +234,47 @@ spec:
                                   type: object
                               type: object
                           type: object
+                        waypoint:
+                          description: Match on waypoint attributes.
+                          properties:
+                            filter:
+                              description: The name of a specific filter to apply
+                                the patch to.
+                              properties:
+                                name:
+                                  description: The filter name to match on.
+                                  type: string
+                                subFilter:
+                                  description: The next level filter within this filter
+                                    to match on.
+                                  properties:
+                                    name:
+                                      description: The filter name to match on.
+                                      type: string
+                                  type: object
+                              type: object
+                            portNumber:
+                              description: The service port to match on.
+                              maximum: 4294967295
+                              minimum: 0
+                              type: integer
+                              x-kubernetes-validations:
+                              - message: port must be between 1-65535
+                                rule: 0 < self && self <= 6553
+                            route:
+                              description: Match a specific route.
+                              properties:
+                                name:
+                                  description: The Route objects generated by default
+                                    are named as default.
+                                  type: string
+                              type: object
+                          type: object
                       type: object
+                      x-kubernetes-validations:
+                      - message: only support waypointMatch when context is WAYPOINT
+                        rule: 'has(self.context) ? ((self.context == "WAYPOINT") ?
+                          has(self.waypoint) : !has(self.waypoint)) : !has(self.waypoint)'
                     patch:
                       description: The patch to apply along with the operation.
                       properties:
diff --git a/chart/crds/networking.istio.io_workloadgroups.yaml b/chart/crds/networking.istio.io_workloadgroups.yaml
index d5a5e7ff8..c1e02618f 100644
--- a/chart/crds/networking.istio.io_workloadgroups.yaml
+++ b/chart/crds/networking.istio.io_workloadgroups.yaml
@@ -1,6 +1,8 @@
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
+  annotations:
+    "helm.sh/resource-policy": keep
   labels:
     app: istio-pilot
     chart: istio
diff --git a/chart/crds/sailoperator.io_istiocnis.yaml b/chart/crds/sailoperator.io_istiocnis.yaml
index 292876427..6033f5ce9 100644
--- a/chart/crds/sailoperator.io_istiocnis.yaml
+++ b/chart/crds/sailoperator.io_istiocnis.yaml
@@ -66,7 +66,7 @@ spec:
           spec:
             default:
               namespace: istio-cni
-              version: v1.27.1
+              version: v1.28.0
             description: IstioCNISpec defines the desired state of IstioCNI
             properties:
               namespace:
@@ -1463,18 +1463,25 @@ spec:
                     type: object
                 type: object
               version:
-                default: v1.27.1
+                default: v1.28.0
                 description: |-
                   Defines the version of Istio to install.
-                  Must be one of: v1.27-latest, v1.27.1, v1.27.0, v1.26-latest, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25-latest, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, master, v1.28-alpha.724e2360.
+                  Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, master, v1.29-alpha.b2f713a9.
                 enum:
+                - v1.28-latest
+                - v1.28.0
                 - v1.27-latest
+                - v1.27.3
+                - v1.27.2
                 - v1.27.1
                 - v1.27.0
                 - v1.26-latest
+                - v1.26.6
+                - v1.26.5
                 - v1.26.4
                 - v1.26.3
                 - v1.26.2
+                - v1.26.1
                 - v1.26.0
                 - v1.25-latest
                 - v1.25.5
@@ -1503,7 +1510,7 @@ spec:
                 - v1.22.5
                 - v1.21.6
                 - master
-                - v1.28-alpha.724e2360
+                - v1.29-alpha.b2f713a9
                 type: string
             required:
             - namespace
diff --git a/chart/crds/sailoperator.io_istiorevisions.yaml b/chart/crds/sailoperator.io_istiorevisions.yaml
index 3f8021896..6404cb3ac 100644
--- a/chart/crds/sailoperator.io_istiorevisions.yaml
+++ b/chart/crds/sailoperator.io_istiorevisions.yaml
@@ -1113,6 +1113,16 @@ spec:
                         description: Specifies the Istio control plane’s pilot Pod
                           IP address or remote cluster DNS resolvable hostname.
                         type: string
+                      resourceScope:
+                        description: |-
+                          Specifies resource scope for discovery selectors.
+                          This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
+                        enum:
+                        - undefined
+                        - all
+                        - cluster
+                        - namespace
+                        type: string
                       revision:
                         description: Configures the revision this control plane is
                           a part of
@@ -5303,6 +5313,35 @@ spec:
                                     Optional. A 128 bit trace id will be used in Istio.
                                     If true, will result in a 64 bit trace id being used.
                                   type: boolean
+                                headers:
+                                  description: |-
+                                    Optional. Additional HTTP headers to include in the request to the Zipkin collector.
+                                    These headers will be added to the HTTP request when sending spans to the collector.
+                                  items:
+                                    properties:
+                                      envName:
+                                        description: |-
+                                          The HTTP header value from the environment variable.
+
+                                          Warning:
+                                          - The environment variable must be set in the istiod pod spec.
+                                          - This is not a end-to-end secure.
+                                        type: string
+                                      name:
+                                        description: REQUIRED. The HTTP header name.
+                                        type: string
+                                      value:
+                                        description: The HTTP header value.
+                                        type: string
+                                    required:
+                                    - name
+                                    type: object
+                                    x-kubernetes-validations:
+                                    - message: At most one of [value envName] should
+                                        be set
+                                      rule: (has(self.value)?1:0) + (has(self.envName)?1:0)
+                                        <= 1
+                                  type: array
                                 maxTagLength:
                                   description: |-
                                     Optional. Controls the overall path length allowed in a reported span.
@@ -5328,6 +5367,11 @@ spec:
 
                                     Example: "zipkin.default.svc.cluster.local" or "bar/zipkin.example.com".
                                   type: string
+                                timeout:
+                                  description: |-
+                                    Optional. The timeout for the HTTP request to the Zipkin collector.
+                                    If not specified, the default timeout from Envoy's configuration will be used (which is 5 seconds currently).
+                                  type: string
                                 traceContextOption:
                                   description: |-
                                     Optional. Determines which trace context format to use for trace header extraction and propagation.
@@ -7157,6 +7201,10 @@ spec:
                             format: int32
                             type: integer
                         type: object
+                      crlConfigMapName:
+                        description: Select a custom name for istiod's plugged-in
+                          CA CRL ConfigMap.
+                        type: string
                       deploymentLabels:
                         additionalProperties:
                           type: string
@@ -9993,13 +10041,19 @@ spec:
               version:
                 description: |-
                   Defines the version of Istio to install.
-                  Must be one of: v1.27.1, v1.27.0, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, v1.28-alpha.724e2360.
+                  Must be one of: v1.28.0, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, v1.29-alpha.b2f713a9.
                 enum:
+                - v1.28.0
+                - v1.27.3
+                - v1.27.2
                 - v1.27.1
                 - v1.27.0
+                - v1.26.6
+                - v1.26.5
                 - v1.26.4
                 - v1.26.3
                 - v1.26.2
+                - v1.26.1
                 - v1.26.0
                 - v1.25.5
                 - v1.25.4
@@ -10023,7 +10077,7 @@ spec:
                 - v1.22.6
                 - v1.22.5
                 - v1.21.6
-                - v1.28-alpha.724e2360
+                - v1.29-alpha.b2f713a9
                 type: string
             required:
             - namespace
diff --git a/chart/crds/sailoperator.io_istios.yaml b/chart/crds/sailoperator.io_istios.yaml
index 911a8575e..eb032920b 100644
--- a/chart/crds/sailoperator.io_istios.yaml
+++ b/chart/crds/sailoperator.io_istios.yaml
@@ -88,7 +88,7 @@ spec:
               namespace: istio-system
               updateStrategy:
                 type: InPlace
-              version: v1.27.1
+              version: v1.28.0
             description: IstioSpec defines the desired state of Istio
             properties:
               namespace:
@@ -1186,6 +1186,16 @@ spec:
                         description: Specifies the Istio control plane’s pilot Pod
                           IP address or remote cluster DNS resolvable hostname.
                         type: string
+                      resourceScope:
+                        description: |-
+                          Specifies resource scope for discovery selectors.
+                          This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
+                        enum:
+                        - undefined
+                        - all
+                        - cluster
+                        - namespace
+                        type: string
                       revision:
                         description: Configures the revision this control plane is
                           a part of
@@ -5376,6 +5386,35 @@ spec:
                                     Optional. A 128 bit trace id will be used in Istio.
                                     If true, will result in a 64 bit trace id being used.
                                   type: boolean
+                                headers:
+                                  description: |-
+                                    Optional. Additional HTTP headers to include in the request to the Zipkin collector.
+                                    These headers will be added to the HTTP request when sending spans to the collector.
+                                  items:
+                                    properties:
+                                      envName:
+                                        description: |-
+                                          The HTTP header value from the environment variable.
+
+                                          Warning:
+                                          - The environment variable must be set in the istiod pod spec.
+                                          - This is not a end-to-end secure.
+                                        type: string
+                                      name:
+                                        description: REQUIRED. The HTTP header name.
+                                        type: string
+                                      value:
+                                        description: The HTTP header value.
+                                        type: string
+                                    required:
+                                    - name
+                                    type: object
+                                    x-kubernetes-validations:
+                                    - message: At most one of [value envName] should
+                                        be set
+                                      rule: (has(self.value)?1:0) + (has(self.envName)?1:0)
+                                        <= 1
+                                  type: array
                                 maxTagLength:
                                   description: |-
                                     Optional. Controls the overall path length allowed in a reported span.
@@ -5401,6 +5440,11 @@ spec:
 
                                     Example: "zipkin.default.svc.cluster.local" or "bar/zipkin.example.com".
                                   type: string
+                                timeout:
+                                  description: |-
+                                    Optional. The timeout for the HTTP request to the Zipkin collector.
+                                    If not specified, the default timeout from Envoy's configuration will be used (which is 5 seconds currently).
+                                  type: string
                                 traceContextOption:
                                   description: |-
                                     Optional. Determines which trace context format to use for trace header extraction and propagation.
@@ -7230,6 +7274,10 @@ spec:
                             format: int32
                             type: integer
                         type: object
+                      crlConfigMapName:
+                        description: Select a custom name for istiod's plugged-in
+                          CA CRL ConfigMap.
+                        type: string
                       deploymentLabels:
                         additionalProperties:
                           type: string
@@ -10064,18 +10112,25 @@ spec:
                     type: object
                 type: object
               version:
-                default: v1.27.1
+                default: v1.28.0
                 description: |-
                   Defines the version of Istio to install.
-                  Must be one of: v1.27-latest, v1.27.1, v1.27.0, v1.26-latest, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25-latest, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, master, v1.28-alpha.724e2360.
+                  Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, master, v1.29-alpha.b2f713a9.
                 enum:
+                - v1.28-latest
+                - v1.28.0
                 - v1.27-latest
+                - v1.27.3
+                - v1.27.2
                 - v1.27.1
                 - v1.27.0
                 - v1.26-latest
+                - v1.26.6
+                - v1.26.5
                 - v1.26.4
                 - v1.26.3
                 - v1.26.2
+                - v1.26.1
                 - v1.26.0
                 - v1.25-latest
                 - v1.25.5
@@ -10104,7 +10159,7 @@ spec:
                 - v1.22.5
                 - v1.21.6
                 - master
-                - v1.28-alpha.724e2360
+                - v1.29-alpha.b2f713a9
                 type: string
             required:
             - namespace
diff --git a/chart/crds/sailoperator.io_ztunnels.yaml b/chart/crds/sailoperator.io_ztunnels.yaml
index e3e7c42fb..ef4cf5be9 100644
--- a/chart/crds/sailoperator.io_ztunnels.yaml
+++ b/chart/crds/sailoperator.io_ztunnels.yaml
@@ -21,10 +21,6 @@ spec:
       jsonPath: .spec.namespace
       name: Namespace
       type: string
-    - description: The selected profile (collection of value presets).
-      jsonPath: .spec.values.profile
-      name: Profile
-      type: string
     - description: Whether the Istio ztunnel installation is ready to handle requests.
       jsonPath: .status.conditions[?(@.type=="Ready")].status
       name: Ready
@@ -41,7 +37,7 @@ spec:
       jsonPath: .metadata.creationTimestamp
       name: Age
       type: date
-    name: v1alpha1
+    name: v1
     schema:
       openAPIV3Schema:
         description: ZTunnel represents a deployment of the Istio ztunnel component.
@@ -66,8 +62,7 @@ spec:
           spec:
             default:
               namespace: ztunnel
-              profile: ambient
-              version: v1.27.1
+              version: v1.28.0
             description: ZTunnelSpec defines the desired state of ZTunnel
             properties:
               namespace:
@@ -75,24 +70,6 @@ spec:
                 description: Namespace to which the Istio ztunnel component should
                   be installed.
                 type: string
-              profile:
-                default: ambient
-                description: |-
-                  The built-in installation configuration profile to use.
-                  The 'default' profile is 'ambient' and it is always applied.
-                  Must be one of: ambient, default, demo, empty, external, preview, remote, stable.
-                enum:
-                - ambient
-                - default
-                - demo
-                - empty
-                - external
-                - openshift-ambient
-                - openshift
-                - preview
-                - remote
-                - stable
-                type: string
               values:
                 description: Defines the values to be passed to the Helm charts when
                   installing Istio ztunnel.
@@ -127,108 +104,4547 @@ spec:
                                   type: string
                                 request:
                                   description: |-
-                                    Request is the name chosen for a request in the referenced claim.
-                                    If empty, everything from the claim is made available, otherwise
-                                    only the result of this request.
-                                  type: string
-                              required:
-                              - name
-                              type: object
-                            type: array
-                            x-kubernetes-list-map-keys:
-                            - name
-                            x-kubernetes-list-type: map
-                          limits:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: |-
-                              Limits describes the maximum amount of compute resources allowed.
-                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-                            type: object
-                          requests:
-                            additionalProperties:
-                              anyOf:
-                              - type: integer
-                              - type: string
-                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
-                              x-kubernetes-int-or-string: true
-                            description: |-
-                              Requests describes the minimum amount of compute resources required.
-                              If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
-                              otherwise to an implementation-defined value. Requests cannot exceed Limits.
-                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                    Request is the name chosen for a request in the referenced claim.
+                                    If empty, everything from the claim is made available, otherwise
+                                    only the result of this request.
+                                  type: string
+                              required:
+                              - name
+                              type: object
+                            type: array
+                            x-kubernetes-list-map-keys:
+                            - name
+                            x-kubernetes-list-type: map
+                          limits:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            description: |-
+                              Limits describes the maximum amount of compute resources allowed.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                          requests:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            description: |-
+                              Requests describes the minimum amount of compute resources required.
+                              If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                              otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                        type: object
+                      hub:
+                        description: Specifies the docker hub for Istio images.
+                        type: string
+                      imagePullPolicy:
+                        description: |-
+                          Specifies the image pull policy for the Istio images. one of Always, Never, IfNotPresent.
+                          Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated.
+
+                          More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+                        enum:
+                        - Always
+                        - Never
+                        - IfNotPresent
+                        type: string
+                      imagePullSecrets:
+                        description: |-
+                          ImagePullSecrets for the control plane ServiceAccount, list of secrets in the same namespace
+                          to use for pulling any images in pods that reference this ServiceAccount.
+                          Must be set for any cluster configured with private docker registry.
+                        items:
+                          type: string
+                        type: array
+                      logAsJson:
+                        description: Specifies whether istio components should output
+                          logs in json format by adding --log_as_json argument to
+                          each container.
+                        type: boolean
+                      logging:
+                        description: Specifies the global logging level settings for
+                          the Istio control plane components.
+                        properties:
+                          level:
+                            description: |-
+                              Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+                              The control plane has different scopes depending on component, but can configure default log level across all components
+                              If empty, default scope and level will be used as configured in code
+                            type: string
+                        type: object
+                      platform:
+                        description: |-
+                          Platform in which Istio is deployed. Possible values are: "openshift" and "gcp"
+                          An empty value means it is a vanilla Kubernetes distribution, therefore no special
+                          treatment will be considered.
+                        type: string
+                      tag:
+                        description: Specifies the tag for the Istio docker images.
+                        type: string
+                      variant:
+                        description: The variant of the Istio container images to
+                          use. Options are "debug" or "distroless". Unset will use
+                          the default for the given version.
+                        type: string
+                    type: object
+                  ztunnel:
+                    description: Configuration for the Istio ztunnel plugin.
+                    properties:
+                      Annotations:
+                        additionalProperties:
+                          type: string
+                        description: Annotations to apply to all top level resources
+                        type: object
+                      Labels:
+                        additionalProperties:
+                          type: string
+                        description: Labels to apply to all top level resources
+                        type: object
+                      affinity:
+                        description: K8s affinity to set on the ztunnel Pods. Can
+                          be used to exclude ztunnel from being scheduled on specified
+                          nodes.
+                        properties:
+                          nodeAffinity:
+                            description: Describes node affinity scheduling rules
+                              for the pod.
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  The scheduler will prefer to schedule pods to nodes that satisfy
+                                  the affinity expressions specified by this field, but it may choose
+                                  a node that violates one or more of the expressions. The node that is
+                                  most preferred is the one with the greatest sum of weights, i.e.
+                                  for each node that meets all of the scheduling requirements (resource
+                                  request, requiredDuringScheduling affinity expressions, etc.),
+                                  compute a sum by iterating through the elements of this field and adding
+                                  "weight" to the sum if the node matches the corresponding matchExpressions; the
+                                  node(s) with the highest sum are the most preferred.
+                                items:
+                                  description: |-
+                                    An empty preferred scheduling term matches all objects with implicit weight 0
+                                    (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                                  properties:
+                                    preference:
+                                      description: A node selector term, associated
+                                        with the corresponding weight.
+                                      properties:
+                                        matchExpressions:
+                                          description: A list of node selector requirements
+                                            by node's labels.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchFields:
+                                          description: A list of node selector requirements
+                                            by node's fields.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    weight:
+                                      description: Weight associated with matching
+                                        the corresponding nodeSelectorTerm, in the
+                                        range 1-100.
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - preference
+                                  - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  If the affinity requirements specified by this field are not met at
+                                  scheduling time, the pod will not be scheduled onto the node.
+                                  If the affinity requirements specified by this field cease to be met
+                                  at some point during pod execution (e.g. due to an update), the system
+                                  may or may not try to eventually evict the pod from its node.
+                                properties:
+                                  nodeSelectorTerms:
+                                    description: Required. A list of node selector
+                                      terms. The terms are ORed.
+                                    items:
+                                      description: |-
+                                        A null or empty node selector term matches no objects. The requirements of
+                                        them are ANDed.
+                                        The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                      properties:
+                                        matchExpressions:
+                                          description: A list of node selector requirements
+                                            by node's labels.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchFields:
+                                          description: A list of node selector requirements
+                                            by node's fields.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - nodeSelectorTerms
+                                type: object
+                                x-kubernetes-map-type: atomic
+                            type: object
+                          podAffinity:
+                            description: Describes pod affinity scheduling rules (e.g.
+                              co-locate this pod in the same node, zone, etc. as some
+                              other pod(s)).
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  The scheduler will prefer to schedule pods to nodes that satisfy
+                                  the affinity expressions specified by this field, but it may choose
+                                  a node that violates one or more of the expressions. The node that is
+                                  most preferred is the one with the greatest sum of weights, i.e.
+                                  for each node that meets all of the scheduling requirements (resource
+                                  request, requiredDuringScheduling affinity expressions, etc.),
+                                  compute a sum by iterating through the elements of this field and adding
+                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  node(s) with the highest sum are the most preferred.
+                                items:
+                                  description: The weights of all of the matched WeightedPodAffinityTerm
+                                    fields are added per-node to find the most preferred
+                                    node(s)
+                                  properties:
+                                    podAffinityTerm:
+                                      description: Required. A pod affinity term,
+                                        associated with the corresponding weight.
+                                      properties:
+                                        labelSelector:
+                                          description: |-
+                                            A label query over a set of resources, in this case pods.
+                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        matchLabelKeys:
+                                          description: |-
+                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        mismatchLabelKeys:
+                                          description: |-
+                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        namespaceSelector:
+                                          description: |-
+                                            A label query over the set of namespaces that the term applies to.
+                                            The term is applied to the union of the namespaces selected by this field
+                                            and the ones listed in the namespaces field.
+                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                            An empty selector ({}) matches all namespaces.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        namespaces:
+                                          description: |-
+                                            namespaces specifies a static list of namespace names that the term applies to.
+                                            The term is applied to the union of the namespaces listed in this field
+                                            and the ones selected by namespaceSelector.
+                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        topologyKey:
+                                          description: |-
+                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                            selected pods is running.
+                                            Empty topologyKey is not allowed.
+                                          type: string
+                                      required:
+                                      - topologyKey
+                                      type: object
+                                    weight:
+                                      description: |-
+                                        weight associated with matching the corresponding podAffinityTerm,
+                                        in the range 1-100.
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - podAffinityTerm
+                                  - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  If the affinity requirements specified by this field are not met at
+                                  scheduling time, the pod will not be scheduled onto the node.
+                                  If the affinity requirements specified by this field cease to be met
+                                  at some point during pod execution (e.g. due to a pod label update), the
+                                  system may or may not try to eventually evict the pod from its node.
+                                  When there are multiple elements, the lists of nodes corresponding to each
+                                  podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                items:
+                                  description: |-
+                                    Defines a set of pods (namely those matching the labelSelector
+                                    relative to the given namespace(s)) that this pod should be
+                                    co-located (affinity) or not co-located (anti-affinity) with,
+                                    where co-located is defined as running on a node whose value of
+                                    the label with key <topologyKey> matches that of any node on which
+                                    a pod of the set of pods is running
+                                  properties:
+                                    labelSelector:
+                                      description: |-
+                                        A label query over a set of resources, in this case pods.
+                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      description: |-
+                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      description: |-
+                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      description: |-
+                                        A label query over the set of namespaces that the term applies to.
+                                        The term is applied to the union of the namespaces selected by this field
+                                        and the ones listed in the namespaces field.
+                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                        An empty selector ({}) matches all namespaces.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      description: |-
+                                        namespaces specifies a static list of namespace names that the term applies to.
+                                        The term is applied to the union of the namespaces listed in this field
+                                        and the ones selected by namespaceSelector.
+                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      description: |-
+                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                        selected pods is running.
+                                        Empty topologyKey is not allowed.
+                                      type: string
+                                  required:
+                                  - topologyKey
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                          podAntiAffinity:
+                            description: Describes pod anti-affinity scheduling rules
+                              (e.g. avoid putting this pod in the same node, zone,
+                              etc. as some other pod(s)).
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  The scheduler will prefer to schedule pods to nodes that satisfy
+                                  the anti-affinity expressions specified by this field, but it may choose
+                                  a node that violates one or more of the expressions. The node that is
+                                  most preferred is the one with the greatest sum of weights, i.e.
+                                  for each node that meets all of the scheduling requirements (resource
+                                  request, requiredDuringScheduling anti-affinity expressions, etc.),
+                                  compute a sum by iterating through the elements of this field and subtracting
+                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  node(s) with the highest sum are the most preferred.
+                                items:
+                                  description: The weights of all of the matched WeightedPodAffinityTerm
+                                    fields are added per-node to find the most preferred
+                                    node(s)
+                                  properties:
+                                    podAffinityTerm:
+                                      description: Required. A pod affinity term,
+                                        associated with the corresponding weight.
+                                      properties:
+                                        labelSelector:
+                                          description: |-
+                                            A label query over a set of resources, in this case pods.
+                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        matchLabelKeys:
+                                          description: |-
+                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        mismatchLabelKeys:
+                                          description: |-
+                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        namespaceSelector:
+                                          description: |-
+                                            A label query over the set of namespaces that the term applies to.
+                                            The term is applied to the union of the namespaces selected by this field
+                                            and the ones listed in the namespaces field.
+                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                            An empty selector ({}) matches all namespaces.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        namespaces:
+                                          description: |-
+                                            namespaces specifies a static list of namespace names that the term applies to.
+                                            The term is applied to the union of the namespaces listed in this field
+                                            and the ones selected by namespaceSelector.
+                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        topologyKey:
+                                          description: |-
+                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                            selected pods is running.
+                                            Empty topologyKey is not allowed.
+                                          type: string
+                                      required:
+                                      - topologyKey
+                                      type: object
+                                    weight:
+                                      description: |-
+                                        weight associated with matching the corresponding podAffinityTerm,
+                                        in the range 1-100.
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - podAffinityTerm
+                                  - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  If the anti-affinity requirements specified by this field are not met at
+                                  scheduling time, the pod will not be scheduled onto the node.
+                                  If the anti-affinity requirements specified by this field cease to be met
+                                  at some point during pod execution (e.g. due to a pod label update), the
+                                  system may or may not try to eventually evict the pod from its node.
+                                  When there are multiple elements, the lists of nodes corresponding to each
+                                  podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                items:
+                                  description: |-
+                                    Defines a set of pods (namely those matching the labelSelector
+                                    relative to the given namespace(s)) that this pod should be
+                                    co-located (affinity) or not co-located (anti-affinity) with,
+                                    where co-located is defined as running on a node whose value of
+                                    the label with key <topologyKey> matches that of any node on which
+                                    a pod of the set of pods is running
+                                  properties:
+                                    labelSelector:
+                                      description: |-
+                                        A label query over a set of resources, in this case pods.
+                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      description: |-
+                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      description: |-
+                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      description: |-
+                                        A label query over the set of namespaces that the term applies to.
+                                        The term is applied to the union of the namespaces selected by this field
+                                        and the ones listed in the namespaces field.
+                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                        An empty selector ({}) matches all namespaces.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      description: |-
+                                        namespaces specifies a static list of namespace names that the term applies to.
+                                        The term is applied to the union of the namespaces listed in this field
+                                        and the ones selected by namespaceSelector.
+                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      description: |-
+                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                        selected pods is running.
+                                        Empty topologyKey is not allowed.
+                                      type: string
+                                  required:
+                                  - topologyKey
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                        type: object
+                      caAddress:
+                        description: The address of the CA for CSR.
+                        type: string
+                      env:
+                        additionalProperties:
+                          type: string
+                        description: 'A `key: value` mapping of environment variables
+                          to add to the pod'
+                        type: object
+                      hub:
+                        description: Hub to pull the container image from. Image will
+                          be `Hub/Image:Tag-Variant`.
+                        type: string
+                      image:
+                        description: |-
+                          Image name to pull from. Image will be `Hub/Image:Tag-Variant`.
+                          If Image contains a "/", it will replace the entire `image` in the pod.
+                        type: string
+                      imagePullPolicy:
+                        description: |-
+                          Specifies the image pull policy for the Istio images. one of Always, Never, IfNotPresent.
+                          Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated.
+
+                          More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+                        enum:
+                        - Always
+                        - Never
+                        - IfNotPresent
+                        type: string
+                      imagePullSecrets:
+                        description: |-
+                          List of secret names to add to the service account as image pull secrets
+                          to use for pulling any images in pods that reference this ServiceAccount.
+                          Must be set for any cluster configured with private docker registry.
+                        items:
+                          type: string
+                        type: array
+                      istioNamespace:
+                        description: Specifies the default namespace for the Istio
+                          control plane components.
+                        type: string
+                      logAsJson:
+                        description: Specifies whether istio components should output
+                          logs in json format by adding --log_as_json argument to
+                          each container.
+                        type: boolean
+                      logLevel:
+                        default: info
+                        description: 'Configuration log level of ztunnel binary, default
+                          is info. Valid values are: trace, debug, info, warn, error.'
+                        enum:
+                        - trace
+                        - debug
+                        - info
+                        - warn
+                        - error
+                        type: string
+                      multiCluster:
+                        description: |-
+                          Settings for multicluster.
+                          The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
+                          with Istiod configuration.
+                        properties:
+                          clusterName:
+                            description: |-
+                              The name of the cluster this installation will run in. This is required for sidecar injection
+                              to properly label proxies
+                            type: string
+                          enabled:
+                            description: |-
+                              Enables the connection between two kubernetes clusters via their respective ingressgateway services.
+                              Use if the pods in each cluster cannot directly talk to one another.
+                            type: boolean
+                          globalDomainSuffix:
+                            description: The suffix for global service names.
+                            type: string
+                          includeEnvoyFilter:
+                            description: Enable envoy filter to translate `globalDomainSuffix`
+                              to cluster local suffix for cross cluster communication.
+                            type: boolean
+                        type: object
+                      network:
+                        description: defines the network this cluster belong to. This
+                          name corresponds to the networks in the map of mesh networks.
+                        type: string
+                      nodeSelector:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          K8s node selector settings.
+
+                          See https://kubernetes.io/docs/user-guide/node-selection/
+                        type: object
+                      podAnnotations:
+                        additionalProperties:
+                          type: string
+                        description: Annotations added to each pod. The default annotations
+                          are required for scraping prometheus (in most environments).
+                        type: object
+                      podLabels:
+                        additionalProperties:
+                          type: string
+                        description: Additional labels to apply on the pod level.
+                        type: object
+                      resourceName:
+                        description: |-
+                          resourceName, if set, will override the naming of resources. If not set, will default to the release name.
+                          It is recommended to not set this; this is primarily for backwards compatibility.
+                        type: string
+                      resourceQuotas:
+                        description: The resource quotas configuration for ztunnel
+                        properties:
+                          enabled:
+                            description: Controls whether to create resource quotas
+                              or not for the CNI DaemonSet.
+                            type: boolean
+                          pods:
+                            description: The hard limit on the number of pods in the
+                              namespace where the CNI DaemonSet is deployed.
+                            format: int64
+                            type: integer
+                        type: object
+                      resources:
+                        description: The k8s resource requests and limits for the
+                          ztunnel Pods.
+                        properties:
+                          claims:
+                            description: |-
+                              Claims lists the names of resources, defined in spec.resourceClaims,
+                              that are used by this container.
+
+                              This field depends on the
+                              DynamicResourceAllocation feature gate.
+
+                              This field is immutable. It can only be set for containers.
+                            items:
+                              description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                              properties:
+                                name:
+                                  description: |-
+                                    Name must match the name of one entry in pod.spec.resourceClaims of
+                                    the Pod where this field is used. It makes that resource available
+                                    inside a container.
+                                  type: string
+                                request:
+                                  description: |-
+                                    Request is the name chosen for a request in the referenced claim.
+                                    If empty, everything from the claim is made available, otherwise
+                                    only the result of this request.
+                                  type: string
+                              required:
+                              - name
+                              type: object
+                            type: array
+                            x-kubernetes-list-map-keys:
+                            - name
+                            x-kubernetes-list-type: map
+                          limits:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            description: |-
+                              Limits describes the maximum amount of compute resources allowed.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                          requests:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            description: |-
+                              Requests describes the minimum amount of compute resources required.
+                              If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                              otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                        type: object
+                      revision:
+                        description: Configures the revision this control plane is
+                          a part of
+                        type: string
+                      seLinuxOptions:
+                        description: Set seLinux options for the ztunnel pod
+                        properties:
+                          level:
+                            description: Level is SELinux level label that applies
+                              to the container.
+                            type: string
+                          role:
+                            description: Role is a SELinux role label that applies
+                              to the container.
+                            type: string
+                          type:
+                            description: Type is a SELinux type label that applies
+                              to the container.
+                            type: string
+                          user:
+                            description: User is a SELinux user label that applies
+                              to the container.
+                            type: string
+                        type: object
+                      tag:
+                        description: The container image tag to pull. Image will be
+                          `Hub/Image:Tag-Variant`.
+                        type: string
+                      terminationGracePeriodSeconds:
+                        default: 30
+                        description: |-
+                          This value defines:
+                          1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
+                          2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
+                        format: int64
+                        minimum: 0
+                        type: integer
+                      tolerations:
+                        description: Tolerations for the ztunnel pod
+                        items:
+                          description: |-
+                            The pod this Toleration is attached to tolerates any taint that matches
+                            the triple <key,value,effect> using the matching operator <operator>.
+                          properties:
+                            effect:
+                              description: |-
+                                Effect indicates the taint effect to match. Empty means match all taint effects.
+                                When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                              type: string
+                            key:
+                              description: |-
+                                Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                                If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                              type: string
+                            operator:
+                              description: |-
+                                Operator represents a key's relationship to the value.
+                                Valid operators are Exists and Equal. Defaults to Equal.
+                                Exists is equivalent to wildcard for value, so that a pod can
+                                tolerate all taints of a particular category.
+                              type: string
+                            tolerationSeconds:
+                              description: |-
+                                TolerationSeconds represents the period of time the toleration (which must be
+                                of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                                it is not set, which means tolerate the taint forever (do not evict). Zero and
+                                negative values will be treated as 0 (evict immediately) by the system.
+                              format: int64
+                              type: integer
+                            value:
+                              description: |-
+                                Value is the taint value the toleration matches to.
+                                If the operator is Exists, the value should be empty, otherwise just a regular string.
+                              type: string
+                          type: object
+                        type: array
+                      updateStrategy:
+                        description: Defines the update strategy to use when the version
+                          in the Ztunnel CR is updated.
+                        properties:
+                          rollingUpdate:
+                            description: Rolling update config params. Present only
+                              if type = "RollingUpdate".
+                            properties:
+                              maxSurge:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  The maximum number of nodes with an existing available DaemonSet pod that
+                                  can have an updated DaemonSet pod during during an update.
+                                  Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
+                                  This can not be 0 if MaxUnavailable is 0.
+                                  Absolute number is calculated from percentage by rounding up to a minimum of 1.
+                                  Default value is 0.
+                                  Example: when this is set to 30%, at most 30% of the total number of nodes
+                                  that should be running the daemon pod (i.e. status.desiredNumberScheduled)
+                                  can have their a new pod created before the old pod is marked as deleted.
+                                  The update starts by launching new pods on 30% of nodes. Once an updated
+                                  pod is available (Ready for at least minReadySeconds) the old DaemonSet pod
+                                  on that node is marked deleted. If the old pod becomes unavailable for any
+                                  reason (Ready transitions to false, is evicted, or is drained) an updated
+                                  pod is immediately created on that node without considering surge limits.
+                                  Allowing surge implies the possibility that the resources consumed by the
+                                  daemonset on any given node can double if the readiness check fails, and
+                                  so resource intensive daemonsets should take into account that they may
+                                  cause evictions during disruption.
+                                x-kubernetes-int-or-string: true
+                              maxUnavailable:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  The maximum number of DaemonSet pods that can be unavailable during the
+                                  update. Value can be an absolute number (ex: 5) or a percentage of total
+                                  number of DaemonSet pods at the start of the update (ex: 10%). Absolute
+                                  number is calculated from percentage by rounding up.
+                                  This cannot be 0 if MaxSurge is 0
+                                  Default value is 1.
+                                  Example: when this is set to 30%, at most 30% of the total number of nodes
+                                  that should be running the daemon pod (i.e. status.desiredNumberScheduled)
+                                  can have their pods stopped for an update at any given time. The update
+                                  starts by stopping at most 30% of those DaemonSet pods and then brings
+                                  up new DaemonSet pods in their place. Once the new pods are available,
+                                  it then proceeds onto other DaemonSet pods, thus ensuring that at least
+                                  70% of original number of DaemonSet pods are available at all times during
+                                  the update.
+                                x-kubernetes-int-or-string: true
+                            type: object
+                          type:
+                            description: Type of daemon set update. Can be "RollingUpdate"
+                              or "OnDelete". Default is RollingUpdate.
+                            type: string
+                        type: object
+                      variant:
+                        description: The container image variant to pull. Options
+                          are "debug" or "distroless". Unset will use the default
+                          for the given version.
+                        type: string
+                      volumeMounts:
+                        description: Additional volumeMounts to the ztunnel container
+                        items:
+                          description: VolumeMount describes a mounting of a Volume
+                            within a container.
+                          properties:
+                            mountPath:
+                              description: |-
+                                Path within the container at which the volume should be mounted.  Must
+                                not contain ':'.
+                              type: string
+                            mountPropagation:
+                              description: |-
+                                mountPropagation determines how mounts are propagated from the host
+                                to container and the other way around.
+                                When not set, MountPropagationNone is used.
+                                This field is beta in 1.10.
+                                When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified
+                                (which defaults to None).
+                              type: string
+                            name:
+                              description: This must match the Name of a Volume.
+                              type: string
+                            readOnly:
+                              description: |-
+                                Mounted read-only if true, read-write otherwise (false or unspecified).
+                                Defaults to false.
+                              type: boolean
+                            recursiveReadOnly:
+                              description: |-
+                                RecursiveReadOnly specifies whether read-only mounts should be handled
+                                recursively.
+
+                                If ReadOnly is false, this field has no meaning and must be unspecified.
+
+                                If ReadOnly is true, and this field is set to Disabled, the mount is not made
+                                recursively read-only.  If this field is set to IfPossible, the mount is made
+                                recursively read-only, if it is supported by the container runtime.  If this
+                                field is set to Enabled, the mount is made recursively read-only if it is
+                                supported by the container runtime, otherwise the pod will not be started and
+                                an error will be generated to indicate the reason.
+
+                                If this field is set to IfPossible or Enabled, MountPropagation must be set to
+                                None (or be unspecified, which defaults to None).
+
+                                If this field is not specified, it is treated as an equivalent of Disabled.
+                              type: string
+                            subPath:
+                              description: |-
+                                Path within the volume from which the container's volume should be mounted.
+                                Defaults to "" (volume's root).
+                              type: string
+                            subPathExpr:
+                              description: |-
+                                Expanded path within the volume from which the container's volume should be mounted.
+                                Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
+                                Defaults to "" (volume's root).
+                                SubPathExpr and SubPath are mutually exclusive.
+                              type: string
+                          required:
+                          - mountPath
+                          - name
+                          type: object
+                        type: array
+                      volumes:
+                        description: Additional volumes to add to the ztunnel Pod.
+                        items:
+                          description: Volume represents a named volume in a pod that
+                            may be accessed by any container in the pod.
+                          properties:
+                            awsElasticBlockStore:
+                              description: |-
+                                awsElasticBlockStore represents an AWS Disk resource that is attached to a
+                                kubelet's host machine and then exposed to the pod.
+                                Deprecated: AWSElasticBlockStore is deprecated. All operations for the in-tree
+                                awsElasticBlockStore type are redirected to the ebs.csi.aws.com CSI driver.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type of the volume that you want to mount.
+                                    Tip: Ensure that the filesystem type is supported by the host operating system.
+                                    Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
+                                  type: string
+                                partition:
+                                  description: |-
+                                    partition is the partition in the volume that you want to mount.
+                                    If omitted, the default is to mount by volume name.
+                                    Examples: For volume /dev/sda1, you specify the partition as "1".
+                                    Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty).
+                                  format: int32
+                                  type: integer
+                                readOnly:
+                                  description: |-
+                                    readOnly value true will force the readOnly setting in VolumeMounts.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
+                                  type: boolean
+                                volumeID:
+                                  description: |-
+                                    volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume).
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
+                                  type: string
+                              required:
+                              - volumeID
+                              type: object
+                            azureDisk:
+                              description: |-
+                                azureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.
+                                Deprecated: AzureDisk is deprecated. All operations for the in-tree azureDisk type
+                                are redirected to the disk.csi.azure.com CSI driver.
+                              properties:
+                                cachingMode:
+                                  description: 'cachingMode is the Host Caching mode:
+                                    None, Read Only, Read Write.'
+                                  type: string
+                                diskName:
+                                  description: diskName is the Name of the data disk
+                                    in the blob storage
+                                  type: string
+                                diskURI:
+                                  description: diskURI is the URI of data disk in
+                                    the blob storage
+                                  type: string
+                                fsType:
+                                  default: ext4
+                                  description: |-
+                                    fsType is Filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                kind:
+                                  description: 'kind expected values are Shared: multiple
+                                    blob disks per storage account  Dedicated: single
+                                    blob disk per storage account  Managed: azure
+                                    managed data disk (only in managed availability
+                                    set). defaults to shared'
+                                  type: string
+                                readOnly:
+                                  default: false
+                                  description: |-
+                                    readOnly Defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                              required:
+                              - diskName
+                              - diskURI
+                              type: object
+                            azureFile:
+                              description: |-
+                                azureFile represents an Azure File Service mount on the host and bind mount to the pod.
+                                Deprecated: AzureFile is deprecated. All operations for the in-tree azureFile type
+                                are redirected to the file.csi.azure.com CSI driver.
+                              properties:
+                                readOnly:
+                                  description: |-
+                                    readOnly defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                secretName:
+                                  description: secretName is the  name of secret that
+                                    contains Azure Storage Account Name and Key
+                                  type: string
+                                shareName:
+                                  description: shareName is the azure share Name
+                                  type: string
+                              required:
+                              - secretName
+                              - shareName
+                              type: object
+                            cephfs:
+                              description: |-
+                                cephFS represents a Ceph FS mount on the host that shares a pod's lifetime.
+                                Deprecated: CephFS is deprecated and the in-tree cephfs type is no longer supported.
+                              properties:
+                                monitors:
+                                  description: |-
+                                    monitors is Required: Monitors is a collection of Ceph monitors
+                                    More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                path:
+                                  description: 'path is Optional: Used as the mounted
+                                    root, rather than the full Ceph tree, default
+                                    is /'
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly is Optional: Defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                    More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
+                                  type: boolean
+                                secretFile:
+                                  description: |-
+                                    secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret
+                                    More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
+                                  type: string
+                                secretRef:
+                                  description: |-
+                                    secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty.
+                                    More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                user:
+                                  description: |-
+                                    user is optional: User is the rados user name, default is admin
+                                    More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
+                                  type: string
+                              required:
+                              - monitors
+                              type: object
+                            cinder:
+                              description: |-
+                                cinder represents a cinder volume attached and mounted on kubelets host machine.
+                                Deprecated: Cinder is deprecated. All operations for the in-tree cinder type
+                                are redirected to the cinder.csi.openstack.org CSI driver.
+                                More info: https://examples.k8s.io/mysql-cinder-pd/README.md
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                    More info: https://examples.k8s.io/mysql-cinder-pd/README.md
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                    More info: https://examples.k8s.io/mysql-cinder-pd/README.md
+                                  type: boolean
+                                secretRef:
+                                  description: |-
+                                    secretRef is optional: points to a secret object containing parameters used to connect
+                                    to OpenStack.
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                volumeID:
+                                  description: |-
+                                    volumeID used to identify the volume in cinder.
+                                    More info: https://examples.k8s.io/mysql-cinder-pd/README.md
+                                  type: string
+                              required:
+                              - volumeID
+                              type: object
+                            configMap:
+                              description: configMap represents a configMap that should
+                                populate this volume
+                              properties:
+                                defaultMode:
+                                  description: |-
+                                    defaultMode is optional: mode bits used to set permissions on created files by default.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                    Defaults to 0644.
+                                    Directories within the path are not affected by this setting.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  format: int32
+                                  type: integer
+                                items:
+                                  description: |-
+                                    items if unspecified, each key-value pair in the Data field of the referenced
+                                    ConfigMap will be projected into the volume as a file whose name is the
+                                    key and content is the value. If specified, the listed keys will be
+                                    projected into the specified paths, and unlisted keys will not be
+                                    present. If a key is specified which is not present in the ConfigMap,
+                                    the volume setup will error unless it is marked optional. Paths must be
+                                    relative and may not contain the '..' path or start with '..'.
+                                  items:
+                                    description: Maps a string key to a path within
+                                      a volume.
+                                    properties:
+                                      key:
+                                        description: key is the key to project.
+                                        type: string
+                                      mode:
+                                        description: |-
+                                          mode is Optional: mode bits used to set permissions on this file.
+                                          Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                          YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                          If not specified, the volume defaultMode will be used.
+                                          This might be in conflict with other options that affect the file
+                                          mode, like fsGroup, and the result can be other mode bits set.
+                                        format: int32
+                                        type: integer
+                                      path:
+                                        description: |-
+                                          path is the relative path of the file to map the key to.
+                                          May not be an absolute path.
+                                          May not contain the path element '..'.
+                                          May not start with the string '..'.
+                                        type: string
+                                    required:
+                                    - key
+                                    - path
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                name:
+                                  default: ""
+                                  description: |-
+                                    Name of the referent.
+                                    This field is effectively required, but due to backwards compatibility is
+                                    allowed to be empty. Instances of this type with an empty value here are
+                                    almost certainly wrong.
+                                    More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  type: string
+                                optional:
+                                  description: optional specify whether the ConfigMap
+                                    or its keys must be defined
+                                  type: boolean
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            csi:
+                              description: csi (Container Storage Interface) represents
+                                ephemeral storage that is handled by certain external
+                                CSI drivers.
+                              properties:
+                                driver:
+                                  description: |-
+                                    driver is the name of the CSI driver that handles this volume.
+                                    Consult with your admin for the correct name as registered in the cluster.
+                                  type: string
+                                fsType:
+                                  description: |-
+                                    fsType to mount. Ex. "ext4", "xfs", "ntfs".
+                                    If not provided, the empty value is passed to the associated CSI driver
+                                    which will determine the default filesystem to apply.
+                                  type: string
+                                nodePublishSecretRef:
+                                  description: |-
+                                    nodePublishSecretRef is a reference to the secret object containing
+                                    sensitive information to pass to the CSI driver to complete the CSI
+                                    NodePublishVolume and NodeUnpublishVolume calls.
+                                    This field is optional, and  may be empty if no secret is required. If the
+                                    secret object contains more than one secret, all secret references are passed.
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                readOnly:
+                                  description: |-
+                                    readOnly specifies a read-only configuration for the volume.
+                                    Defaults to false (read/write).
+                                  type: boolean
+                                volumeAttributes:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    volumeAttributes stores driver-specific properties that are passed to the CSI
+                                    driver. Consult your driver's documentation for supported values.
+                                  type: object
+                              required:
+                              - driver
+                              type: object
+                            downwardAPI:
+                              description: downwardAPI represents downward API about
+                                the pod that should populate this volume
+                              properties:
+                                defaultMode:
+                                  description: |-
+                                    Optional: mode bits to use on created files by default. Must be a
+                                    Optional: mode bits used to set permissions on created files by default.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                    Defaults to 0644.
+                                    Directories within the path are not affected by this setting.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  format: int32
+                                  type: integer
+                                items:
+                                  description: Items is a list of downward API volume
+                                    file
+                                  items:
+                                    description: DownwardAPIVolumeFile represents
+                                      information to create the file containing the
+                                      pod field
+                                    properties:
+                                      fieldRef:
+                                        description: 'Required: Selects a field of
+                                          the pod: only annotations, labels, name,
+                                          namespace and uid are supported.'
+                                        properties:
+                                          apiVersion:
+                                            description: Version of the schema the
+                                              FieldPath is written in terms of, defaults
+                                              to "v1".
+                                            type: string
+                                          fieldPath:
+                                            description: Path of the field to select
+                                              in the specified API version.
+                                            type: string
+                                        required:
+                                        - fieldPath
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      mode:
+                                        description: |-
+                                          Optional: mode bits used to set permissions on this file, must be an octal value
+                                          between 0000 and 0777 or a decimal value between 0 and 511.
+                                          YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                          If not specified, the volume defaultMode will be used.
+                                          This might be in conflict with other options that affect the file
+                                          mode, like fsGroup, and the result can be other mode bits set.
+                                        format: int32
+                                        type: integer
+                                      path:
+                                        description: 'Required: Path is  the relative
+                                          path name of the file to be created. Must
+                                          not be absolute or contain the ''..'' path.
+                                          Must be utf-8 encoded. The first item of
+                                          the relative path must not start with ''..'''
+                                        type: string
+                                      resourceFieldRef:
+                                        description: |-
+                                          Selects a resource of the container: only resources limits and requests
+                                          (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
+                                        properties:
+                                          containerName:
+                                            description: 'Container name: required
+                                              for volumes, optional for env vars'
+                                            type: string
+                                          divisor:
+                                            anyOf:
+                                            - type: integer
+                                            - type: string
+                                            description: Specifies the output format
+                                              of the exposed resources, defaults to
+                                              "1"
+                                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                            x-kubernetes-int-or-string: true
+                                          resource:
+                                            description: 'Required: resource to select'
+                                            type: string
+                                        required:
+                                        - resource
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                    required:
+                                    - path
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              type: object
+                            emptyDir:
+                              description: |-
+                                emptyDir represents a temporary directory that shares a pod's lifetime.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                              properties:
+                                medium:
+                                  description: |-
+                                    medium represents what type of storage medium should back this directory.
+                                    The default is "" which means to use the node's default medium.
+                                    Must be an empty string (default) or Memory.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                                  type: string
+                                sizeLimit:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  description: |-
+                                    sizeLimit is the total amount of local storage required for this EmptyDir volume.
+                                    The size limit is also applicable for memory medium.
+                                    The maximum usage on memory medium EmptyDir would be the minimum value between
+                                    the SizeLimit specified here and the sum of memory limits of all containers in a pod.
+                                    The default is nil which means that the limit is undefined.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                              type: object
+                            ephemeral:
+                              description: |-
+                                ephemeral represents a volume that is handled by a cluster storage driver.
+                                The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts,
+                                and deleted when the pod is removed.
+
+                                Use this if:
+                                a) the volume is only needed while the pod runs,
+                                b) features of normal volumes like restoring from snapshot or capacity
+                                   tracking are needed,
+                                c) the storage driver is specified through a storage class, and
+                                d) the storage driver supports dynamic volume provisioning through
+                                   a PersistentVolumeClaim (see EphemeralVolumeSource for more
+                                   information on the connection between this volume type
+                                   and PersistentVolumeClaim).
+
+                                Use PersistentVolumeClaim or one of the vendor-specific
+                                APIs for volumes that persist for longer than the lifecycle
+                                of an individual pod.
+
+                                Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to
+                                be used that way - see the documentation of the driver for
+                                more information.
+
+                                A pod can use both types of ephemeral volumes and
+                                persistent volumes at the same time.
+                              properties:
+                                volumeClaimTemplate:
+                                  description: |-
+                                    Will be used to create a stand-alone PVC to provision the volume.
+                                    The pod in which this EphemeralVolumeSource is embedded will be the
+                                    owner of the PVC, i.e. the PVC will be deleted together with the
+                                    pod.  The name of the PVC will be `<pod name>-<volume name>` where
+                                    `<volume name>` is the name from the `PodSpec.Volumes` array
+                                    entry. Pod validation will reject the pod if the concatenated name
+                                    is not valid for a PVC (for example, too long).
+
+                                    An existing PVC with that name that is not owned by the pod
+                                    will *not* be used for the pod to avoid using an unrelated
+                                    volume by mistake. Starting the pod is then blocked until
+                                    the unrelated PVC is removed. If such a pre-created PVC is
+                                    meant to be used by the pod, the PVC has to updated with an
+                                    owner reference to the pod once the pod exists. Normally
+                                    this should not be necessary, but it may be useful when
+                                    manually reconstructing a broken cluster.
+
+                                    This field is read-only and no changes will be made by Kubernetes
+                                    to the PVC after it has been created.
+
+                                    Required, must not be nil.
+                                  properties:
+                                    metadata:
+                                      description: |-
+                                        May contain labels and annotations that will be copied into the PVC
+                                        when creating it. No other fields are allowed and will be rejected during
+                                        validation.
+                                      type: object
+                                    spec:
+                                      description: |-
+                                        The specification for the PersistentVolumeClaim. The entire content is
+                                        copied unchanged into the PVC that gets created from this
+                                        template. The same fields as in a PersistentVolumeClaim
+                                        are also valid here.
+                                      properties:
+                                        accessModes:
+                                          description: |-
+                                            accessModes contains the desired access modes the volume should have.
+                                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        dataSource:
+                                          description: |-
+                                            dataSource field can be used to specify either:
+                                            * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot)
+                                            * An existing PVC (PersistentVolumeClaim)
+                                            If the provisioner or an external controller can support the specified data source,
+                                            it will create a new volume based on the contents of the specified data source.
+                                            When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
+                                            and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
+                                            If the namespace is specified, then dataSourceRef will not be copied to dataSource.
+                                          properties:
+                                            apiGroup:
+                                              description: |-
+                                                APIGroup is the group for the resource being referenced.
+                                                If APIGroup is not specified, the specified Kind must be in the core API group.
+                                                For any other third-party types, APIGroup is required.
+                                              type: string
+                                            kind:
+                                              description: Kind is the type of resource
+                                                being referenced
+                                              type: string
+                                            name:
+                                              description: Name is the name of resource
+                                                being referenced
+                                              type: string
+                                          required:
+                                          - kind
+                                          - name
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        dataSourceRef:
+                                          description: |-
+                                            dataSourceRef specifies the object from which to populate the volume with data, if a non-empty
+                                            volume is desired. This may be any object from a non-empty API group (non
+                                            core object) or a PersistentVolumeClaim object.
+                                            When this field is specified, volume binding will only succeed if the type of
+                                            the specified object matches some installed volume populator or dynamic
+                                            provisioner.
+                                            This field will replace the functionality of the dataSource field and as such
+                                            if both fields are non-empty, they must have the same value. For backwards
+                                            compatibility, when namespace isn't specified in dataSourceRef,
+                                            both fields (dataSource and dataSourceRef) will be set to the same
+                                            value automatically if one of them is empty and the other is non-empty.
+                                            When namespace is specified in dataSourceRef,
+                                            dataSource isn't set to the same value and must be empty.
+                                            There are three important differences between dataSource and dataSourceRef:
+                                            * While dataSource only allows two specific types of objects, dataSourceRef
+                                              allows any non-core object, as well as PersistentVolumeClaim objects.
+                                            * While dataSource ignores disallowed values (dropping them), dataSourceRef
+                                              preserves all values, and generates an error if a disallowed value is
+                                              specified.
+                                            * While dataSource only allows local objects, dataSourceRef allows objects
+                                              in any namespaces.
+                                            (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
+                                            (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
+                                          properties:
+                                            apiGroup:
+                                              description: |-
+                                                APIGroup is the group for the resource being referenced.
+                                                If APIGroup is not specified, the specified Kind must be in the core API group.
+                                                For any other third-party types, APIGroup is required.
+                                              type: string
+                                            kind:
+                                              description: Kind is the type of resource
+                                                being referenced
+                                              type: string
+                                            name:
+                                              description: Name is the name of resource
+                                                being referenced
+                                              type: string
+                                            namespace:
+                                              description: |-
+                                                Namespace is the namespace of resource being referenced
+                                                Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details.
+                                                (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
+                                              type: string
+                                          required:
+                                          - kind
+                                          - name
+                                          type: object
+                                        resources:
+                                          description: |-
+                                            resources represents the minimum resources the volume should have.
+                                            If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements
+                                            that are lower than previous value but must still be higher than capacity recorded in the
+                                            status field of the claim.
+                                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
+                                          properties:
+                                            limits:
+                                              additionalProperties:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                x-kubernetes-int-or-string: true
+                                              description: |-
+                                                Limits describes the maximum amount of compute resources allowed.
+                                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                              type: object
+                                            requests:
+                                              additionalProperties:
+                                                anyOf:
+                                                - type: integer
+                                                - type: string
+                                                pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                x-kubernetes-int-or-string: true
+                                              description: |-
+                                                Requests describes the minimum amount of compute resources required.
+                                                If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                                                otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                                                More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                                              type: object
+                                          type: object
+                                        selector:
+                                          description: selector is a label query over
+                                            volumes to consider for binding.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        storageClassName:
+                                          description: |-
+                                            storageClassName is the name of the StorageClass required by the claim.
+                                            More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
+                                          type: string
+                                        volumeAttributesClassName:
+                                          description: |-
+                                            volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim.
+                                            If specified, the CSI driver will create or update the volume with the attributes defined
+                                            in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName,
+                                            it can be changed after the claim is created. An empty string or nil value indicates that no
+                                            VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state,
+                                            this field can be reset to its previous value (including nil) to cancel the modification.
+                                            If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be
+                                            set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource
+                                            exists.
+                                            More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/
+                                          type: string
+                                        volumeMode:
+                                          description: |-
+                                            volumeMode defines what type of volume is required by the claim.
+                                            Value of Filesystem is implied when not included in claim spec.
+                                          type: string
+                                        volumeName:
+                                          description: volumeName is the binding reference
+                                            to the PersistentVolume backing this claim.
+                                          type: string
+                                      type: object
+                                  required:
+                                  - spec
+                                  type: object
+                              type: object
+                            fc:
+                              description: fc represents a Fibre Channel resource
+                                that is attached to a kubelet's host machine and then
+                                exposed to the pod.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                lun:
+                                  description: 'lun is Optional: FC target lun number'
+                                  format: int32
+                                  type: integer
+                                readOnly:
+                                  description: |-
+                                    readOnly is Optional: Defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                targetWWNs:
+                                  description: 'targetWWNs is Optional: FC target
+                                    worldwide names (WWNs)'
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                wwids:
+                                  description: |-
+                                    wwids Optional: FC volume world wide identifiers (wwids)
+                                    Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              type: object
+                            flexVolume:
+                              description: |-
+                                flexVolume represents a generic volume resource that is
+                                provisioned/attached using an exec based plugin.
+                                Deprecated: FlexVolume is deprecated. Consider using a CSIDriver instead.
+                              properties:
+                                driver:
+                                  description: driver is the name of the driver to
+                                    use for this volume.
+                                  type: string
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script.
+                                  type: string
+                                options:
+                                  additionalProperties:
+                                    type: string
+                                  description: 'options is Optional: this field holds
+                                    extra command options if any.'
+                                  type: object
+                                readOnly:
+                                  description: |-
+                                    readOnly is Optional: defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                secretRef:
+                                  description: |-
+                                    secretRef is Optional: secretRef is reference to the secret object containing
+                                    sensitive information to pass to the plugin scripts. This may be
+                                    empty if no secret object is specified. If the secret object
+                                    contains more than one secret, all secrets are passed to the plugin
+                                    scripts.
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                              required:
+                              - driver
+                              type: object
+                            flocker:
+                              description: |-
+                                flocker represents a Flocker volume attached to a kubelet's host machine. This depends on the Flocker control service being running.
+                                Deprecated: Flocker is deprecated and the in-tree flocker type is no longer supported.
+                              properties:
+                                datasetName:
+                                  description: |-
+                                    datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker
+                                    should be considered as deprecated
+                                  type: string
+                                datasetUUID:
+                                  description: datasetUUID is the UUID of the dataset.
+                                    This is unique identifier of a Flocker dataset
+                                  type: string
+                              type: object
+                            gcePersistentDisk:
+                              description: |-
+                                gcePersistentDisk represents a GCE Disk resource that is attached to a
+                                kubelet's host machine and then exposed to the pod.
+                                Deprecated: GCEPersistentDisk is deprecated. All operations for the in-tree
+                                gcePersistentDisk type are redirected to the pd.csi.storage.gke.io CSI driver.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is filesystem type of the volume that you want to mount.
+                                    Tip: Ensure that the filesystem type is supported by the host operating system.
+                                    Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
+                                  type: string
+                                partition:
+                                  description: |-
+                                    partition is the partition in the volume that you want to mount.
+                                    If omitted, the default is to mount by volume name.
+                                    Examples: For volume /dev/sda1, you specify the partition as "1".
+                                    Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty).
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
+                                  format: int32
+                                  type: integer
+                                pdName:
+                                  description: |-
+                                    pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the ReadOnly setting in VolumeMounts.
+                                    Defaults to false.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
+                                  type: boolean
+                              required:
+                              - pdName
+                              type: object
+                            gitRepo:
+                              description: |-
+                                gitRepo represents a git repository at a particular revision.
+                                Deprecated: GitRepo is deprecated. To provision a container with a git repo, mount an
+                                EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir
+                                into the Pod's container.
+                              properties:
+                                directory:
+                                  description: |-
+                                    directory is the target directory name.
+                                    Must not contain or start with '..'.  If '.' is supplied, the volume directory will be the
+                                    git repository.  Otherwise, if specified, the volume will contain the git repository in
+                                    the subdirectory with the given name.
+                                  type: string
+                                repository:
+                                  description: repository is the URL
+                                  type: string
+                                revision:
+                                  description: revision is the commit hash for the
+                                    specified revision.
+                                  type: string
+                              required:
+                              - repository
+                              type: object
+                            glusterfs:
+                              description: |-
+                                glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
+                                Deprecated: Glusterfs is deprecated and the in-tree glusterfs type is no longer supported.
+                              properties:
+                                endpoints:
+                                  description: endpoints is the endpoint name that
+                                    details Glusterfs topology.
+                                  type: string
+                                path:
+                                  description: |-
+                                    path is the Glusterfs volume path.
+                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the Glusterfs volume to be mounted with read-only permissions.
+                                    Defaults to false.
+                                    More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
+                                  type: boolean
+                              required:
+                              - endpoints
+                              - path
+                              type: object
+                            hostPath:
+                              description: |-
+                                hostPath represents a pre-existing file or directory on the host
+                                machine that is directly exposed to the container. This is generally
+                                used for system agents or other privileged things that are allowed
+                                to see the host machine. Most containers will NOT need this.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
+                              properties:
+                                path:
+                                  description: |-
+                                    path of the directory on the host.
+                                    If the path is a symlink, it will follow the link to the real path.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
+                                  type: string
+                                type:
+                                  description: |-
+                                    type for HostPath Volume
+                                    Defaults to ""
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
+                                  type: string
+                              required:
+                              - path
+                              type: object
+                            image:
+                              description: |-
+                                image represents an OCI object (a container image or artifact) pulled and mounted on the kubelet's host machine.
+                                The volume is resolved at pod startup depending on which PullPolicy value is provided:
+
+                                - Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.
+                                - Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.
+                                - IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.
+
+                                The volume gets re-resolved if the pod gets deleted and recreated, which means that new remote content will become available on pod recreation.
+                                A failure to resolve or pull the image during pod startup will block containers from starting and may add significant latency. Failures will be retried using normal volume backoff and will be reported on the pod reason and message.
+                                The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
+                                The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
+                                The volume will be mounted read-only (ro) and non-executable files (noexec).
+                                Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
+                                The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
+                              properties:
+                                pullPolicy:
+                                  description: |-
+                                    Policy for pulling OCI objects. Possible values are:
+                                    Always: the kubelet always attempts to pull the reference. Container creation will fail If the pull fails.
+                                    Never: the kubelet never pulls the reference and only uses a local image or artifact. Container creation will fail if the reference isn't present.
+                                    IfNotPresent: the kubelet pulls if the reference isn't already present on disk. Container creation will fail if the reference isn't present and the pull fails.
+                                    Defaults to Always if :latest tag is specified, or IfNotPresent otherwise.
+                                  type: string
+                                reference:
+                                  description: |-
+                                    Required: Image or artifact reference to be used.
+                                    Behaves in the same way as pod.spec.containers[*].image.
+                                    Pull secrets will be assembled in the same way as for the container image by looking up node credentials, SA image pull secrets, and pod spec image pull secrets.
+                                    More info: https://kubernetes.io/docs/concepts/containers/images
+                                    This field is optional to allow higher level config management to default or override
+                                    container images in workload controllers like Deployments and StatefulSets.
+                                  type: string
+                              type: object
+                            iscsi:
+                              description: |-
+                                iscsi represents an ISCSI Disk resource that is attached to a
+                                kubelet's host machine and then exposed to the pod.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes/#iscsi
+                              properties:
+                                chapAuthDiscovery:
+                                  description: chapAuthDiscovery defines whether support
+                                    iSCSI Discovery CHAP authentication
+                                  type: boolean
+                                chapAuthSession:
+                                  description: chapAuthSession defines whether support
+                                    iSCSI Session CHAP authentication
+                                  type: boolean
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type of the volume that you want to mount.
+                                    Tip: Ensure that the filesystem type is supported by the host operating system.
+                                    Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi
+                                  type: string
+                                initiatorName:
+                                  description: |-
+                                    initiatorName is the custom iSCSI Initiator Name.
+                                    If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface
+                                    <target portal>:<volume name> will be created for the connection.
+                                  type: string
+                                iqn:
+                                  description: iqn is the target iSCSI Qualified Name.
+                                  type: string
+                                iscsiInterface:
+                                  default: default
+                                  description: |-
+                                    iscsiInterface is the interface Name that uses an iSCSI transport.
+                                    Defaults to 'default' (tcp).
+                                  type: string
+                                lun:
+                                  description: lun represents iSCSI Target Lun number.
+                                  format: int32
+                                  type: integer
+                                portals:
+                                  description: |-
+                                    portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port
+                                    is other than default (typically TCP ports 860 and 3260).
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the ReadOnly setting in VolumeMounts.
+                                    Defaults to false.
+                                  type: boolean
+                                secretRef:
+                                  description: secretRef is the CHAP Secret for iSCSI
+                                    target and initiator authentication
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                targetPortal:
+                                  description: |-
+                                    targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port
+                                    is other than default (typically TCP ports 860 and 3260).
+                                  type: string
+                              required:
+                              - iqn
+                              - lun
+                              - targetPortal
+                              type: object
+                            name:
+                              description: |-
+                                name of the volume.
+                                Must be a DNS_LABEL and unique within the pod.
+                                More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              type: string
+                            nfs:
+                              description: |-
+                                nfs represents an NFS mount on the host that shares a pod's lifetime
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
+                              properties:
+                                path:
+                                  description: |-
+                                    path that is exported by the NFS server.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the NFS export to be mounted with read-only permissions.
+                                    Defaults to false.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
+                                  type: boolean
+                                server:
+                                  description: |-
+                                    server is the hostname or IP address of the NFS server.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
+                                  type: string
+                              required:
+                              - path
+                              - server
+                              type: object
+                            persistentVolumeClaim:
+                              description: |-
+                                persistentVolumeClaimVolumeSource represents a reference to a
+                                PersistentVolumeClaim in the same namespace.
+                                More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
+                              properties:
+                                claimName:
+                                  description: |-
+                                    claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.
+                                    More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly Will force the ReadOnly setting in VolumeMounts.
+                                    Default false.
+                                  type: boolean
+                              required:
+                              - claimName
+                              type: object
+                            photonPersistentDisk:
+                              description: |-
+                                photonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine.
+                                Deprecated: PhotonPersistentDisk is deprecated and the in-tree photonPersistentDisk type is no longer supported.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                pdID:
+                                  description: pdID is the ID that identifies Photon
+                                    Controller persistent disk
+                                  type: string
+                              required:
+                              - pdID
+                              type: object
+                            portworxVolume:
+                              description: |-
+                                portworxVolume represents a portworx volume attached and mounted on kubelets host machine.
+                                Deprecated: PortworxVolume is deprecated. All operations for the in-tree portworxVolume type
+                                are redirected to the pxd.portworx.com CSI driver when the CSIMigrationPortworx feature-gate
+                                is on.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fSType represents the filesystem type to mount
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                volumeID:
+                                  description: volumeID uniquely identifies a Portworx
+                                    volume
+                                  type: string
+                              required:
+                              - volumeID
+                              type: object
+                            projected:
+                              description: projected items for all in one resources
+                                secrets, configmaps, and downward API
+                              properties:
+                                defaultMode:
+                                  description: |-
+                                    defaultMode are the mode bits used to set permissions on created files by default.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                    Directories within the path are not affected by this setting.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  format: int32
+                                  type: integer
+                                sources:
+                                  description: |-
+                                    sources is the list of volume projections. Each entry in this list
+                                    handles one source.
+                                  items:
+                                    description: |-
+                                      Projection that may be projected along with other supported volume types.
+                                      Exactly one of these fields must be set.
+                                    properties:
+                                      clusterTrustBundle:
+                                        description: |-
+                                          ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field
+                                          of ClusterTrustBundle objects in an auto-updating file.
+
+                                          Alpha, gated by the ClusterTrustBundleProjection feature gate.
+
+                                          ClusterTrustBundle objects can either be selected by name, or by the
+                                          combination of signer name and a label selector.
+
+                                          Kubelet performs aggressive normalization of the PEM contents written
+                                          into the pod filesystem.  Esoteric PEM features such as inter-block
+                                          comments and block headers are stripped.  Certificates are deduplicated.
+                                          The ordering of certificates within the file is arbitrary, and Kubelet
+                                          may change the order over time.
+                                        properties:
+                                          labelSelector:
+                                            description: |-
+                                              Select all ClusterTrustBundles that match this label selector.  Only has
+                                              effect if signerName is set.  Mutually-exclusive with name.  If unset,
+                                              interpreted as "match nothing".  If set but empty, interpreted as "match
+                                              everything".
+                                            properties:
+                                              matchExpressions:
+                                                description: matchExpressions is a
+                                                  list of label selector requirements.
+                                                  The requirements are ANDed.
+                                                items:
+                                                  description: |-
+                                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                                    relates the key and values.
+                                                  properties:
+                                                    key:
+                                                      description: key is the label
+                                                        key that the selector applies
+                                                        to.
+                                                      type: string
+                                                    operator:
+                                                      description: |-
+                                                        operator represents a key's relationship to a set of values.
+                                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                      type: string
+                                                    values:
+                                                      description: |-
+                                                        values is an array of string values. If the operator is In or NotIn,
+                                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                        the values array must be empty. This array is replaced during a strategic
+                                                        merge patch.
+                                                      items:
+                                                        type: string
+                                                      type: array
+                                                      x-kubernetes-list-type: atomic
+                                                  required:
+                                                  - key
+                                                  - operator
+                                                  type: object
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                              matchLabels:
+                                                additionalProperties:
+                                                  type: string
+                                                description: |-
+                                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                                type: object
+                                            type: object
+                                            x-kubernetes-map-type: atomic
+                                          name:
+                                            description: |-
+                                              Select a single ClusterTrustBundle by object name.  Mutually-exclusive
+                                              with signerName and labelSelector.
+                                            type: string
+                                          optional:
+                                            description: |-
+                                              If true, don't block pod startup if the referenced ClusterTrustBundle(s)
+                                              aren't available.  If using name, then the named ClusterTrustBundle is
+                                              allowed not to exist.  If using signerName, then the combination of
+                                              signerName and labelSelector is allowed to match zero
+                                              ClusterTrustBundles.
+                                            type: boolean
+                                          path:
+                                            description: Relative path from the volume
+                                              root to write the bundle.
+                                            type: string
+                                          signerName:
+                                            description: |-
+                                              Select all ClusterTrustBundles that match this signer name.
+                                              Mutually-exclusive with name.  The contents of all selected
+                                              ClusterTrustBundles will be unified and deduplicated.
+                                            type: string
+                                        required:
+                                        - path
+                                        type: object
+                                      configMap:
+                                        description: configMap information about the
+                                          configMap data to project
+                                        properties:
+                                          items:
+                                            description: |-
+                                              items if unspecified, each key-value pair in the Data field of the referenced
+                                              ConfigMap will be projected into the volume as a file whose name is the
+                                              key and content is the value. If specified, the listed keys will be
+                                              projected into the specified paths, and unlisted keys will not be
+                                              present. If a key is specified which is not present in the ConfigMap,
+                                              the volume setup will error unless it is marked optional. Paths must be
+                                              relative and may not contain the '..' path or start with '..'.
+                                            items:
+                                              description: Maps a string key to a
+                                                path within a volume.
+                                              properties:
+                                                key:
+                                                  description: key is the key to project.
+                                                  type: string
+                                                mode:
+                                                  description: |-
+                                                    mode is Optional: mode bits used to set permissions on this file.
+                                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                    If not specified, the volume defaultMode will be used.
+                                                    This might be in conflict with other options that affect the file
+                                                    mode, like fsGroup, and the result can be other mode bits set.
+                                                  format: int32
+                                                  type: integer
+                                                path:
+                                                  description: |-
+                                                    path is the relative path of the file to map the key to.
+                                                    May not be an absolute path.
+                                                    May not contain the path element '..'.
+                                                    May not start with the string '..'.
+                                                  type: string
+                                              required:
+                                              - key
+                                              - path
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          name:
+                                            default: ""
+                                            description: |-
+                                              Name of the referent.
+                                              This field is effectively required, but due to backwards compatibility is
+                                              allowed to be empty. Instances of this type with an empty value here are
+                                              almost certainly wrong.
+                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                            type: string
+                                          optional:
+                                            description: optional specify whether
+                                              the ConfigMap or its keys must be defined
+                                            type: boolean
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      downwardAPI:
+                                        description: downwardAPI information about
+                                          the downwardAPI data to project
+                                        properties:
+                                          items:
+                                            description: Items is a list of DownwardAPIVolume
+                                              file
+                                            items:
+                                              description: DownwardAPIVolumeFile represents
+                                                information to create the file containing
+                                                the pod field
+                                              properties:
+                                                fieldRef:
+                                                  description: 'Required: Selects
+                                                    a field of the pod: only annotations,
+                                                    labels, name, namespace and uid
+                                                    are supported.'
+                                                  properties:
+                                                    apiVersion:
+                                                      description: Version of the
+                                                        schema the FieldPath is written
+                                                        in terms of, defaults to "v1".
+                                                      type: string
+                                                    fieldPath:
+                                                      description: Path of the field
+                                                        to select in the specified
+                                                        API version.
+                                                      type: string
+                                                  required:
+                                                  - fieldPath
+                                                  type: object
+                                                  x-kubernetes-map-type: atomic
+                                                mode:
+                                                  description: |-
+                                                    Optional: mode bits used to set permissions on this file, must be an octal value
+                                                    between 0000 and 0777 or a decimal value between 0 and 511.
+                                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                    If not specified, the volume defaultMode will be used.
+                                                    This might be in conflict with other options that affect the file
+                                                    mode, like fsGroup, and the result can be other mode bits set.
+                                                  format: int32
+                                                  type: integer
+                                                path:
+                                                  description: 'Required: Path is  the
+                                                    relative path name of the file
+                                                    to be created. Must not be absolute
+                                                    or contain the ''..'' path. Must
+                                                    be utf-8 encoded. The first item
+                                                    of the relative path must not
+                                                    start with ''..'''
+                                                  type: string
+                                                resourceFieldRef:
+                                                  description: |-
+                                                    Selects a resource of the container: only resources limits and requests
+                                                    (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
+                                                  properties:
+                                                    containerName:
+                                                      description: 'Container name:
+                                                        required for volumes, optional
+                                                        for env vars'
+                                                      type: string
+                                                    divisor:
+                                                      anyOf:
+                                                      - type: integer
+                                                      - type: string
+                                                      description: Specifies the output
+                                                        format of the exposed resources,
+                                                        defaults to "1"
+                                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                                      x-kubernetes-int-or-string: true
+                                                    resource:
+                                                      description: 'Required: resource
+                                                        to select'
+                                                      type: string
+                                                  required:
+                                                  - resource
+                                                  type: object
+                                                  x-kubernetes-map-type: atomic
+                                              required:
+                                              - path
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        type: object
+                                      podCertificate:
+                                        description: |-
+                                          Projects an auto-rotating credential bundle (private key and certificate
+                                          chain) that the pod can use either as a TLS client or server.
+
+                                          Kubelet generates a private key and uses it to send a
+                                          PodCertificateRequest to the named signer.  Once the signer approves the
+                                          request and issues a certificate chain, Kubelet writes the key and
+                                          certificate chain to the pod filesystem.  The pod does not start until
+                                          certificates have been issued for each podCertificate projected volume
+                                          source in its spec.
+
+                                          Kubelet will begin trying to rotate the certificate at the time indicated
+                                          by the signer using the PodCertificateRequest.Status.BeginRefreshAt
+                                          timestamp.
+
+                                          Kubelet can write a single file, indicated by the credentialBundlePath
+                                          field, or separate files, indicated by the keyPath and
+                                          certificateChainPath fields.
+
+                                          The credential bundle is a single file in PEM format.  The first PEM
+                                          entry is the private key (in PKCS#8 format), and the remaining PEM
+                                          entries are the certificate chain issued by the signer (typically,
+                                          signers will return their certificate chain in leaf-to-root order).
+
+                                          Prefer using the credential bundle format, since your application code
+                                          can read it atomically.  If you use keyPath and certificateChainPath,
+                                          your application must make two separate file reads. If these coincide
+                                          with a certificate rotation, it is possible that the private key and leaf
+                                          certificate you read may not correspond to each other.  Your application
+                                          will need to check for this condition, and re-read until they are
+                                          consistent.
+
+                                          The named signer controls chooses the format of the certificate it
+                                          issues; consult the signer implementation's documentation to learn how to
+                                          use the certificates it issues.
+                                        properties:
+                                          certificateChainPath:
+                                            description: |-
+                                              Write the certificate chain at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          credentialBundlePath:
+                                            description: |-
+                                              Write the credential bundle at this path in the projected volume.
+
+                                              The credential bundle is a single file that contains multiple PEM blocks.
+                                              The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private
+                                              key.
+
+                                              The remaining blocks are CERTIFICATE blocks, containing the issued
+                                              certificate chain from the signer (leaf and any intermediates).
+
+                                              Using credentialBundlePath lets your Pod's application code make a single
+                                              atomic read that retrieves a consistent key and certificate chain.  If you
+                                              project them to separate files, your application code will need to
+                                              additionally check that the leaf certificate was issued to the key.
+                                            type: string
+                                          keyPath:
+                                            description: |-
+                                              Write the key at this path in the projected volume.
+
+                                              Most applications should use credentialBundlePath.  When using keyPath
+                                              and certificateChainPath, your application needs to check that the key
+                                              and leaf certificate are consistent, because it is possible to read the
+                                              files mid-rotation.
+                                            type: string
+                                          keyType:
+                                            description: |-
+                                              The type of keypair Kubelet will generate for the pod.
+
+                                              Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384",
+                                              "ECDSAP521", and "ED25519".
+                                            type: string
+                                          maxExpirationSeconds:
+                                            description: |-
+                                              maxExpirationSeconds is the maximum lifetime permitted for the
+                                              certificate.
+
+                                              Kubelet copies this value verbatim into the PodCertificateRequests it
+                                              generates for this projection.
+
+                                              If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver
+                                              will reject values shorter than 3600 (1 hour).  The maximum allowable
+                                              value is 7862400 (91 days).
+
+                                              The signer implementation is then free to issue a certificate with any
+                                              lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600
+                                              seconds (1 hour).  This constraint is enforced by kube-apiserver.
+                                              `kubernetes.io` signers will never issue certificates with a lifetime
+                                              longer than 24 hours.
+                                            format: int32
+                                            type: integer
+                                          signerName:
+                                            description: Kubelet's generated CSRs
+                                              will be addressed to this signer.
+                                            type: string
+                                        required:
+                                        - keyType
+                                        - signerName
+                                        type: object
+                                      secret:
+                                        description: secret information about the
+                                          secret data to project
+                                        properties:
+                                          items:
+                                            description: |-
+                                              items if unspecified, each key-value pair in the Data field of the referenced
+                                              Secret will be projected into the volume as a file whose name is the
+                                              key and content is the value. If specified, the listed keys will be
+                                              projected into the specified paths, and unlisted keys will not be
+                                              present. If a key is specified which is not present in the Secret,
+                                              the volume setup will error unless it is marked optional. Paths must be
+                                              relative and may not contain the '..' path or start with '..'.
+                                            items:
+                                              description: Maps a string key to a
+                                                path within a volume.
+                                              properties:
+                                                key:
+                                                  description: key is the key to project.
+                                                  type: string
+                                                mode:
+                                                  description: |-
+                                                    mode is Optional: mode bits used to set permissions on this file.
+                                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                                    YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                                    If not specified, the volume defaultMode will be used.
+                                                    This might be in conflict with other options that affect the file
+                                                    mode, like fsGroup, and the result can be other mode bits set.
+                                                  format: int32
+                                                  type: integer
+                                                path:
+                                                  description: |-
+                                                    path is the relative path of the file to map the key to.
+                                                    May not be an absolute path.
+                                                    May not contain the path element '..'.
+                                                    May not start with the string '..'.
+                                                  type: string
+                                              required:
+                                              - key
+                                              - path
+                                              type: object
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                          name:
+                                            default: ""
+                                            description: |-
+                                              Name of the referent.
+                                              This field is effectively required, but due to backwards compatibility is
+                                              allowed to be empty. Instances of this type with an empty value here are
+                                              almost certainly wrong.
+                                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                            type: string
+                                          optional:
+                                            description: optional field specify whether
+                                              the Secret or its key must be defined
+                                            type: boolean
+                                        type: object
+                                        x-kubernetes-map-type: atomic
+                                      serviceAccountToken:
+                                        description: serviceAccountToken is information
+                                          about the serviceAccountToken data to project
+                                        properties:
+                                          audience:
+                                            description: |-
+                                              audience is the intended audience of the token. A recipient of a token
+                                              must identify itself with an identifier specified in the audience of the
+                                              token, and otherwise should reject the token. The audience defaults to the
+                                              identifier of the apiserver.
+                                            type: string
+                                          expirationSeconds:
+                                            description: |-
+                                              expirationSeconds is the requested duration of validity of the service
+                                              account token. As the token approaches expiration, the kubelet volume
+                                              plugin will proactively rotate the service account token. The kubelet will
+                                              start trying to rotate the token if the token is older than 80 percent of
+                                              its time to live or if the token is older than 24 hours.Defaults to 1 hour
+                                              and must be at least 10 minutes.
+                                            format: int64
+                                            type: integer
+                                          path:
+                                            description: |-
+                                              path is the path relative to the mount point of the file to project the
+                                              token into.
+                                            type: string
+                                        required:
+                                        - path
+                                        type: object
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              type: object
+                            quobyte:
+                              description: |-
+                                quobyte represents a Quobyte mount on the host that shares a pod's lifetime.
+                                Deprecated: Quobyte is deprecated and the in-tree quobyte type is no longer supported.
+                              properties:
+                                group:
+                                  description: |-
+                                    group to map volume access to
+                                    Default is no group
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the Quobyte volume to be mounted with read-only permissions.
+                                    Defaults to false.
+                                  type: boolean
+                                registry:
+                                  description: |-
+                                    registry represents a single or multiple Quobyte Registry services
+                                    specified as a string as host:port pair (multiple entries are separated with commas)
+                                    which acts as the central registry for volumes
+                                  type: string
+                                tenant:
+                                  description: |-
+                                    tenant owning the given Quobyte volume in the Backend
+                                    Used with dynamically provisioned Quobyte volumes, value is set by the plugin
+                                  type: string
+                                user:
+                                  description: |-
+                                    user to map volume access to
+                                    Defaults to serivceaccount user
+                                  type: string
+                                volume:
+                                  description: volume is a string that references
+                                    an already created Quobyte volume by name.
+                                  type: string
+                              required:
+                              - registry
+                              - volume
+                              type: object
+                            rbd:
+                              description: |-
+                                rbd represents a Rados Block Device mount on the host that shares a pod's lifetime.
+                                Deprecated: RBD is deprecated and the in-tree rbd type is no longer supported.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type of the volume that you want to mount.
+                                    Tip: Ensure that the filesystem type is supported by the host operating system.
+                                    Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd
+                                  type: string
+                                image:
+                                  description: |-
+                                    image is the rados image name.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  type: string
+                                keyring:
+                                  default: /etc/ceph/keyring
+                                  description: |-
+                                    keyring is the path to key ring for RBDUser.
+                                    Default is /etc/ceph/keyring.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  type: string
+                                monitors:
+                                  description: |-
+                                    monitors is a collection of Ceph monitors.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                pool:
+                                  default: rbd
+                                  description: |-
+                                    pool is the rados pool name.
+                                    Default is rbd.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly here will force the ReadOnly setting in VolumeMounts.
+                                    Defaults to false.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  type: boolean
+                                secretRef:
+                                  description: |-
+                                    secretRef is name of the authentication secret for RBDUser. If provided
+                                    overrides keyring.
+                                    Default is nil.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                user:
+                                  default: admin
+                                  description: |-
+                                    user is the rados user name.
+                                    Default is admin.
+                                    More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
+                                  type: string
+                              required:
+                              - image
+                              - monitors
+                              type: object
+                            scaleIO:
+                              description: |-
+                                scaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.
+                                Deprecated: ScaleIO is deprecated and the in-tree scaleIO type is no longer supported.
+                              properties:
+                                fsType:
+                                  default: xfs
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs".
+                                    Default is "xfs".
+                                  type: string
+                                gateway:
+                                  description: gateway is the host address of the
+                                    ScaleIO API Gateway.
+                                  type: string
+                                protectionDomain:
+                                  description: protectionDomain is the name of the
+                                    ScaleIO Protection Domain for the configured storage.
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly Defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                secretRef:
+                                  description: |-
+                                    secretRef references to the secret for ScaleIO user and other
+                                    sensitive information. If this is not provided, Login operation will fail.
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                sslEnabled:
+                                  description: sslEnabled Flag enable/disable SSL
+                                    communication with Gateway, default false
+                                  type: boolean
+                                storageMode:
+                                  default: ThinProvisioned
+                                  description: |-
+                                    storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned.
+                                    Default is ThinProvisioned.
+                                  type: string
+                                storagePool:
+                                  description: storagePool is the ScaleIO Storage
+                                    Pool associated with the protection domain.
+                                  type: string
+                                system:
+                                  description: system is the name of the storage system
+                                    as configured in ScaleIO.
+                                  type: string
+                                volumeName:
+                                  description: |-
+                                    volumeName is the name of a volume already created in the ScaleIO system
+                                    that is associated with this volume source.
+                                  type: string
+                              required:
+                              - gateway
+                              - secretRef
+                              - system
+                              type: object
+                            secret:
+                              description: |-
+                                secret represents a secret that should populate this volume.
+                                More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                              properties:
+                                defaultMode:
+                                  description: |-
+                                    defaultMode is Optional: mode bits used to set permissions on created files by default.
+                                    Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                    YAML accepts both octal and decimal values, JSON requires decimal values
+                                    for mode bits. Defaults to 0644.
+                                    Directories within the path are not affected by this setting.
+                                    This might be in conflict with other options that affect the file
+                                    mode, like fsGroup, and the result can be other mode bits set.
+                                  format: int32
+                                  type: integer
+                                items:
+                                  description: |-
+                                    items If unspecified, each key-value pair in the Data field of the referenced
+                                    Secret will be projected into the volume as a file whose name is the
+                                    key and content is the value. If specified, the listed keys will be
+                                    projected into the specified paths, and unlisted keys will not be
+                                    present. If a key is specified which is not present in the Secret,
+                                    the volume setup will error unless it is marked optional. Paths must be
+                                    relative and may not contain the '..' path or start with '..'.
+                                  items:
+                                    description: Maps a string key to a path within
+                                      a volume.
+                                    properties:
+                                      key:
+                                        description: key is the key to project.
+                                        type: string
+                                      mode:
+                                        description: |-
+                                          mode is Optional: mode bits used to set permissions on this file.
+                                          Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.
+                                          YAML accepts both octal and decimal values, JSON requires decimal values for mode bits.
+                                          If not specified, the volume defaultMode will be used.
+                                          This might be in conflict with other options that affect the file
+                                          mode, like fsGroup, and the result can be other mode bits set.
+                                        format: int32
+                                        type: integer
+                                      path:
+                                        description: |-
+                                          path is the relative path of the file to map the key to.
+                                          May not be an absolute path.
+                                          May not contain the path element '..'.
+                                          May not start with the string '..'.
+                                        type: string
+                                    required:
+                                    - key
+                                    - path
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                optional:
+                                  description: optional field specify whether the
+                                    Secret or its keys must be defined
+                                  type: boolean
+                                secretName:
+                                  description: |-
+                                    secretName is the name of the secret in the pod's namespace to use.
+                                    More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
+                                  type: string
+                              type: object
+                            storageos:
+                              description: |-
+                                storageOS represents a StorageOS volume attached and mounted on Kubernetes nodes.
+                                Deprecated: StorageOS is deprecated and the in-tree storageos type is no longer supported.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is the filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                readOnly:
+                                  description: |-
+                                    readOnly defaults to false (read/write). ReadOnly here will force
+                                    the ReadOnly setting in VolumeMounts.
+                                  type: boolean
+                                secretRef:
+                                  description: |-
+                                    secretRef specifies the secret to use for obtaining the StorageOS API
+                                    credentials.  If not specified, default values will be attempted.
+                                  properties:
+                                    name:
+                                      default: ""
+                                      description: |-
+                                        Name of the referent.
+                                        This field is effectively required, but due to backwards compatibility is
+                                        allowed to be empty. Instances of this type with an empty value here are
+                                        almost certainly wrong.
+                                        More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                      type: string
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                                volumeName:
+                                  description: |-
+                                    volumeName is the human-readable name of the StorageOS volume.  Volume
+                                    names are only unique within a namespace.
+                                  type: string
+                                volumeNamespace:
+                                  description: |-
+                                    volumeNamespace specifies the scope of the volume within StorageOS.  If no
+                                    namespace is specified then the Pod's namespace will be used.  This allows the
+                                    Kubernetes name scoping to be mirrored within StorageOS for tighter integration.
+                                    Set VolumeName to any name to override the default behaviour.
+                                    Set to "default" if you are not using namespaces within StorageOS.
+                                    Namespaces that do not pre-exist within StorageOS will be created.
+                                  type: string
+                              type: object
+                            vsphereVolume:
+                              description: |-
+                                vsphereVolume represents a vSphere volume attached and mounted on kubelets host machine.
+                                Deprecated: VsphereVolume is deprecated. All operations for the in-tree vsphereVolume type
+                                are redirected to the csi.vsphere.vmware.com CSI driver.
+                              properties:
+                                fsType:
+                                  description: |-
+                                    fsType is filesystem type to mount.
+                                    Must be a filesystem type supported by the host operating system.
+                                    Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
+                                  type: string
+                                storagePolicyID:
+                                  description: storagePolicyID is the storage Policy
+                                    Based Management (SPBM) profile ID associated
+                                    with the StoragePolicyName.
+                                  type: string
+                                storagePolicyName:
+                                  description: storagePolicyName is the storage Policy
+                                    Based Management (SPBM) profile name.
+                                  type: string
+                                volumePath:
+                                  description: volumePath is the path that identifies
+                                    vSphere volume vmdk
+                                  type: string
+                              required:
+                              - volumePath
+                              type: object
+                          required:
+                          - name
+                          type: object
+                        type: array
+                      xdsAddress:
+                        description: The customized XDS address to retrieve configuration.
+                        type: string
+                    type: object
+                type: object
+              version:
+                default: v1.28.0
+                description: |-
+                  Defines the version of Istio to install.
+                  Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, v1.25-latest, v1.24-latest, master, v1.29-alpha.b2f713a9.
+                enum:
+                - v1.28-latest
+                - v1.28.0
+                - v1.27-latest
+                - v1.27.3
+                - v1.27.2
+                - v1.27.1
+                - v1.27.0
+                - v1.26-latest
+                - v1.26.6
+                - v1.26.5
+                - v1.26.4
+                - v1.26.3
+                - v1.26.2
+                - v1.26.1
+                - v1.26.0
+                - v1.25-latest
+                - v1.24-latest
+                - master
+                - v1.29-alpha.b2f713a9
+                type: string
+            required:
+            - namespace
+            - version
+            type: object
+          status:
+            description: ZTunnelStatus defines the observed state of ZTunnel
+            properties:
+              conditions:
+                description: Represents the latest available observations of the object's
+                  current state.
+                items:
+                  description: ZTunnelCondition represents a specific observation
+                    of the ZTunnel object's state.
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        the last transition.
+                      type: string
+                    reason:
+                      description: Unique, single-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: The status of this condition. Can be True, False
+                        or Unknown.
+                      type: string
+                    type:
+                      description: The type of this condition.
+                      type: string
+                  type: object
+                type: array
+              observedGeneration:
+                description: |-
+                  ObservedGeneration is the most recent generation observed for this
+                  ZTunnel object. It corresponds to the object's generation, which is
+                  updated on mutation by the API Server. The information in the status
+                  pertains to this particular generation of the object.
+                format: int64
+                type: integer
+              state:
+                description: Reports the current state of the object.
+                type: string
+            type: object
+        type: object
+        x-kubernetes-validations:
+        - message: metadata.name must be 'default'
+          rule: self.metadata.name == 'default'
+    served: true
+    storage: true
+    subresources:
+      status: {}
+  - additionalPrinterColumns:
+    - description: The namespace for the ztunnel component.
+      jsonPath: .spec.namespace
+      name: Namespace
+      type: string
+    - description: The selected profile (collection of value presets).
+      jsonPath: .spec.values.profile
+      name: Profile
+      type: string
+    - description: Whether the Istio ztunnel installation is ready to handle requests.
+      jsonPath: .status.conditions[?(@.type=="Ready")].status
+      name: Ready
+      type: string
+    - description: The current state of this object.
+      jsonPath: .status.state
+      name: Status
+      type: string
+    - description: The version of the Istio ztunnel installation.
+      jsonPath: .spec.version
+      name: Version
+      type: string
+    - description: The age of the object
+      jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    deprecated: true
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: ZTunnel represents a deployment of the Istio ztunnel component.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            default:
+              namespace: ztunnel
+              profile: ambient
+              version: v1.28.0
+            description: ZTunnelSpec defines the desired state of ZTunnel
+            properties:
+              namespace:
+                default: ztunnel
+                description: Namespace to which the Istio ztunnel component should
+                  be installed.
+                type: string
+              profile:
+                default: ambient
+                description: |-
+                  The built-in installation configuration profile to use.
+                  The 'default' profile is 'ambient' and it is always applied.
+                  Must be one of: ambient, default, demo, empty, external, preview, remote, stable.
+                enum:
+                - ambient
+                - default
+                - demo
+                - empty
+                - external
+                - openshift-ambient
+                - openshift
+                - preview
+                - remote
+                - stable
+                type: string
+              values:
+                description: Defines the values to be passed to the Helm charts when
+                  installing Istio ztunnel.
+                properties:
+                  global:
+                    description: Part of the global configuration applicable to the
+                      Istio ztunnel component.
+                    properties:
+                      defaultResources:
+                        description: |-
+                          See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container
+
+                          Deprecated: Marked as deprecated in pkg/apis/values_types.proto.
+                        properties:
+                          claims:
+                            description: |-
+                              Claims lists the names of resources, defined in spec.resourceClaims,
+                              that are used by this container.
+
+                              This field depends on the
+                              DynamicResourceAllocation feature gate.
+
+                              This field is immutable. It can only be set for containers.
+                            items:
+                              description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                              properties:
+                                name:
+                                  description: |-
+                                    Name must match the name of one entry in pod.spec.resourceClaims of
+                                    the Pod where this field is used. It makes that resource available
+                                    inside a container.
+                                  type: string
+                                request:
+                                  description: |-
+                                    Request is the name chosen for a request in the referenced claim.
+                                    If empty, everything from the claim is made available, otherwise
+                                    only the result of this request.
+                                  type: string
+                              required:
+                              - name
+                              type: object
+                            type: array
+                            x-kubernetes-list-map-keys:
+                            - name
+                            x-kubernetes-list-type: map
+                          limits:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            description: |-
+                              Limits describes the maximum amount of compute resources allowed.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                          requests:
+                            additionalProperties:
+                              anyOf:
+                              - type: integer
+                              - type: string
+                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                              x-kubernetes-int-or-string: true
+                            description: |-
+                              Requests describes the minimum amount of compute resources required.
+                              If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                              otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                              More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                            type: object
+                        type: object
+                      hub:
+                        description: Specifies the docker hub for Istio images.
+                        type: string
+                      imagePullPolicy:
+                        description: |-
+                          Specifies the image pull policy for the Istio images. one of Always, Never, IfNotPresent.
+                          Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated.
+
+                          More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
+                        enum:
+                        - Always
+                        - Never
+                        - IfNotPresent
+                        type: string
+                      imagePullSecrets:
+                        description: |-
+                          ImagePullSecrets for the control plane ServiceAccount, list of secrets in the same namespace
+                          to use for pulling any images in pods that reference this ServiceAccount.
+                          Must be set for any cluster configured with private docker registry.
+                        items:
+                          type: string
+                        type: array
+                      logAsJson:
+                        description: Specifies whether istio components should output
+                          logs in json format by adding --log_as_json argument to
+                          each container.
+                        type: boolean
+                      logging:
+                        description: Specifies the global logging level settings for
+                          the Istio control plane components.
+                        properties:
+                          level:
+                            description: |-
+                              Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+                              The control plane has different scopes depending on component, but can configure default log level across all components
+                              If empty, default scope and level will be used as configured in code
+                            type: string
+                        type: object
+                      platform:
+                        description: |-
+                          Platform in which Istio is deployed. Possible values are: "openshift" and "gcp"
+                          An empty value means it is a vanilla Kubernetes distribution, therefore no special
+                          treatment will be considered.
+                        type: string
+                      tag:
+                        description: Specifies the tag for the Istio docker images.
+                        type: string
+                      variant:
+                        description: The variant of the Istio container images to
+                          use. Options are "debug" or "distroless". Unset will use
+                          the default for the given version.
+                        type: string
+                    type: object
+                  ztunnel:
+                    description: Configuration for the Istio ztunnel plugin.
+                    properties:
+                      Annotations:
+                        additionalProperties:
+                          type: string
+                        description: Annotations to apply to all top level resources
+                        type: object
+                      Labels:
+                        additionalProperties:
+                          type: string
+                        description: Labels to apply to all top level resources
+                        type: object
+                      affinity:
+                        description: K8s affinity to set on the ztunnel Pods. Can
+                          be used to exclude ztunnel from being scheduled on specified
+                          nodes.
+                        properties:
+                          nodeAffinity:
+                            description: Describes node affinity scheduling rules
+                              for the pod.
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  The scheduler will prefer to schedule pods to nodes that satisfy
+                                  the affinity expressions specified by this field, but it may choose
+                                  a node that violates one or more of the expressions. The node that is
+                                  most preferred is the one with the greatest sum of weights, i.e.
+                                  for each node that meets all of the scheduling requirements (resource
+                                  request, requiredDuringScheduling affinity expressions, etc.),
+                                  compute a sum by iterating through the elements of this field and adding
+                                  "weight" to the sum if the node matches the corresponding matchExpressions; the
+                                  node(s) with the highest sum are the most preferred.
+                                items:
+                                  description: |-
+                                    An empty preferred scheduling term matches all objects with implicit weight 0
+                                    (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
+                                  properties:
+                                    preference:
+                                      description: A node selector term, associated
+                                        with the corresponding weight.
+                                      properties:
+                                        matchExpressions:
+                                          description: A list of node selector requirements
+                                            by node's labels.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchFields:
+                                          description: A list of node selector requirements
+                                            by node's fields.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    weight:
+                                      description: Weight associated with matching
+                                        the corresponding nodeSelectorTerm, in the
+                                        range 1-100.
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - preference
+                                  - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  If the affinity requirements specified by this field are not met at
+                                  scheduling time, the pod will not be scheduled onto the node.
+                                  If the affinity requirements specified by this field cease to be met
+                                  at some point during pod execution (e.g. due to an update), the system
+                                  may or may not try to eventually evict the pod from its node.
+                                properties:
+                                  nodeSelectorTerms:
+                                    description: Required. A list of node selector
+                                      terms. The terms are ORed.
+                                    items:
+                                      description: |-
+                                        A null or empty node selector term matches no objects. The requirements of
+                                        them are ANDed.
+                                        The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
+                                      properties:
+                                        matchExpressions:
+                                          description: A list of node selector requirements
+                                            by node's labels.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchFields:
+                                          description: A list of node selector requirements
+                                            by node's fields.
+                                          items:
+                                            description: |-
+                                              A node selector requirement is a selector that contains values, a key, and an operator
+                                              that relates the key and values.
+                                            properties:
+                                              key:
+                                                description: The label key that the
+                                                  selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  Represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  An array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. If the operator is Gt or Lt, the values
+                                                  array must have a single element, which will be interpreted as an integer.
+                                                  This array is replaced during a strategic merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - nodeSelectorTerms
+                                type: object
+                                x-kubernetes-map-type: atomic
+                            type: object
+                          podAffinity:
+                            description: Describes pod affinity scheduling rules (e.g.
+                              co-locate this pod in the same node, zone, etc. as some
+                              other pod(s)).
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  The scheduler will prefer to schedule pods to nodes that satisfy
+                                  the affinity expressions specified by this field, but it may choose
+                                  a node that violates one or more of the expressions. The node that is
+                                  most preferred is the one with the greatest sum of weights, i.e.
+                                  for each node that meets all of the scheduling requirements (resource
+                                  request, requiredDuringScheduling affinity expressions, etc.),
+                                  compute a sum by iterating through the elements of this field and adding
+                                  "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  node(s) with the highest sum are the most preferred.
+                                items:
+                                  description: The weights of all of the matched WeightedPodAffinityTerm
+                                    fields are added per-node to find the most preferred
+                                    node(s)
+                                  properties:
+                                    podAffinityTerm:
+                                      description: Required. A pod affinity term,
+                                        associated with the corresponding weight.
+                                      properties:
+                                        labelSelector:
+                                          description: |-
+                                            A label query over a set of resources, in this case pods.
+                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        matchLabelKeys:
+                                          description: |-
+                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        mismatchLabelKeys:
+                                          description: |-
+                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        namespaceSelector:
+                                          description: |-
+                                            A label query over the set of namespaces that the term applies to.
+                                            The term is applied to the union of the namespaces selected by this field
+                                            and the ones listed in the namespaces field.
+                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                            An empty selector ({}) matches all namespaces.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        namespaces:
+                                          description: |-
+                                            namespaces specifies a static list of namespace names that the term applies to.
+                                            The term is applied to the union of the namespaces listed in this field
+                                            and the ones selected by namespaceSelector.
+                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        topologyKey:
+                                          description: |-
+                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                            selected pods is running.
+                                            Empty topologyKey is not allowed.
+                                          type: string
+                                      required:
+                                      - topologyKey
+                                      type: object
+                                    weight:
+                                      description: |-
+                                        weight associated with matching the corresponding podAffinityTerm,
+                                        in the range 1-100.
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - podAffinityTerm
+                                  - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  If the affinity requirements specified by this field are not met at
+                                  scheduling time, the pod will not be scheduled onto the node.
+                                  If the affinity requirements specified by this field cease to be met
+                                  at some point during pod execution (e.g. due to a pod label update), the
+                                  system may or may not try to eventually evict the pod from its node.
+                                  When there are multiple elements, the lists of nodes corresponding to each
+                                  podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                items:
+                                  description: |-
+                                    Defines a set of pods (namely those matching the labelSelector
+                                    relative to the given namespace(s)) that this pod should be
+                                    co-located (affinity) or not co-located (anti-affinity) with,
+                                    where co-located is defined as running on a node whose value of
+                                    the label with key <topologyKey> matches that of any node on which
+                                    a pod of the set of pods is running
+                                  properties:
+                                    labelSelector:
+                                      description: |-
+                                        A label query over a set of resources, in this case pods.
+                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      description: |-
+                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      description: |-
+                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      description: |-
+                                        A label query over the set of namespaces that the term applies to.
+                                        The term is applied to the union of the namespaces selected by this field
+                                        and the ones listed in the namespaces field.
+                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                        An empty selector ({}) matches all namespaces.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      description: |-
+                                        namespaces specifies a static list of namespace names that the term applies to.
+                                        The term is applied to the union of the namespaces listed in this field
+                                        and the ones selected by namespaceSelector.
+                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      description: |-
+                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                        selected pods is running.
+                                        Empty topologyKey is not allowed.
+                                      type: string
+                                  required:
+                                  - topologyKey
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                            type: object
+                          podAntiAffinity:
+                            description: Describes pod anti-affinity scheduling rules
+                              (e.g. avoid putting this pod in the same node, zone,
+                              etc. as some other pod(s)).
+                            properties:
+                              preferredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  The scheduler will prefer to schedule pods to nodes that satisfy
+                                  the anti-affinity expressions specified by this field, but it may choose
+                                  a node that violates one or more of the expressions. The node that is
+                                  most preferred is the one with the greatest sum of weights, i.e.
+                                  for each node that meets all of the scheduling requirements (resource
+                                  request, requiredDuringScheduling anti-affinity expressions, etc.),
+                                  compute a sum by iterating through the elements of this field and subtracting
+                                  "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the
+                                  node(s) with the highest sum are the most preferred.
+                                items:
+                                  description: The weights of all of the matched WeightedPodAffinityTerm
+                                    fields are added per-node to find the most preferred
+                                    node(s)
+                                  properties:
+                                    podAffinityTerm:
+                                      description: Required. A pod affinity term,
+                                        associated with the corresponding weight.
+                                      properties:
+                                        labelSelector:
+                                          description: |-
+                                            A label query over a set of resources, in this case pods.
+                                            If it's null, this PodAffinityTerm matches with no Pods.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        matchLabelKeys:
+                                          description: |-
+                                            MatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                            Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        mismatchLabelKeys:
+                                          description: |-
+                                            MismatchLabelKeys is a set of pod label keys to select which pods will
+                                            be taken into consideration. The keys are used to lookup values from the
+                                            incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                            to select the group of existing pods which pods will be taken into consideration
+                                            for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                            pod labels will be ignored. The default value is empty.
+                                            The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                            Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        namespaceSelector:
+                                          description: |-
+                                            A label query over the set of namespaces that the term applies to.
+                                            The term is applied to the union of the namespaces selected by this field
+                                            and the ones listed in the namespaces field.
+                                            null selector and null or empty namespaces list means "this pod's namespace".
+                                            An empty selector ({}) matches all namespaces.
+                                          properties:
+                                            matchExpressions:
+                                              description: matchExpressions is a list
+                                                of label selector requirements. The
+                                                requirements are ANDed.
+                                              items:
+                                                description: |-
+                                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                                  relates the key and values.
+                                                properties:
+                                                  key:
+                                                    description: key is the label
+                                                      key that the selector applies
+                                                      to.
+                                                    type: string
+                                                  operator:
+                                                    description: |-
+                                                      operator represents a key's relationship to a set of values.
+                                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                    type: string
+                                                  values:
+                                                    description: |-
+                                                      values is an array of string values. If the operator is In or NotIn,
+                                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                      the values array must be empty. This array is replaced during a strategic
+                                                      merge patch.
+                                                    items:
+                                                      type: string
+                                                    type: array
+                                                    x-kubernetes-list-type: atomic
+                                                required:
+                                                - key
+                                                - operator
+                                                type: object
+                                              type: array
+                                              x-kubernetes-list-type: atomic
+                                            matchLabels:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                              type: object
+                                          type: object
+                                          x-kubernetes-map-type: atomic
+                                        namespaces:
+                                          description: |-
+                                            namespaces specifies a static list of namespace names that the term applies to.
+                                            The term is applied to the union of the namespaces listed in this field
+                                            and the ones selected by namespaceSelector.
+                                            null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        topologyKey:
+                                          description: |-
+                                            This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                            the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                            whose value of the label with key topologyKey matches that of any node on which any of the
+                                            selected pods is running.
+                                            Empty topologyKey is not allowed.
+                                          type: string
+                                      required:
+                                      - topologyKey
+                                      type: object
+                                    weight:
+                                      description: |-
+                                        weight associated with matching the corresponding podAffinityTerm,
+                                        in the range 1-100.
+                                      format: int32
+                                      type: integer
+                                  required:
+                                  - podAffinityTerm
+                                  - weight
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              requiredDuringSchedulingIgnoredDuringExecution:
+                                description: |-
+                                  If the anti-affinity requirements specified by this field are not met at
+                                  scheduling time, the pod will not be scheduled onto the node.
+                                  If the anti-affinity requirements specified by this field cease to be met
+                                  at some point during pod execution (e.g. due to a pod label update), the
+                                  system may or may not try to eventually evict the pod from its node.
+                                  When there are multiple elements, the lists of nodes corresponding to each
+                                  podAffinityTerm are intersected, i.e. all terms must be satisfied.
+                                items:
+                                  description: |-
+                                    Defines a set of pods (namely those matching the labelSelector
+                                    relative to the given namespace(s)) that this pod should be
+                                    co-located (affinity) or not co-located (anti-affinity) with,
+                                    where co-located is defined as running on a node whose value of
+                                    the label with key <topologyKey> matches that of any node on which
+                                    a pod of the set of pods is running
+                                  properties:
+                                    labelSelector:
+                                      description: |-
+                                        A label query over a set of resources, in this case pods.
+                                        If it's null, this PodAffinityTerm matches with no Pods.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    matchLabelKeys:
+                                      description: |-
+                                        MatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both matchLabelKeys and labelSelector.
+                                        Also, matchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    mismatchLabelKeys:
+                                      description: |-
+                                        MismatchLabelKeys is a set of pod label keys to select which pods will
+                                        be taken into consideration. The keys are used to lookup values from the
+                                        incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`
+                                        to select the group of existing pods which pods will be taken into consideration
+                                        for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming
+                                        pod labels will be ignored. The default value is empty.
+                                        The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
+                                        Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    namespaceSelector:
+                                      description: |-
+                                        A label query over the set of namespaces that the term applies to.
+                                        The term is applied to the union of the namespaces selected by this field
+                                        and the ones listed in the namespaces field.
+                                        null selector and null or empty namespaces list means "this pod's namespace".
+                                        An empty selector ({}) matches all namespaces.
+                                      properties:
+                                        matchExpressions:
+                                          description: matchExpressions is a list
+                                            of label selector requirements. The requirements
+                                            are ANDed.
+                                          items:
+                                            description: |-
+                                              A label selector requirement is a selector that contains values, a key, and an operator that
+                                              relates the key and values.
+                                            properties:
+                                              key:
+                                                description: key is the label key
+                                                  that the selector applies to.
+                                                type: string
+                                              operator:
+                                                description: |-
+                                                  operator represents a key's relationship to a set of values.
+                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
+                                                type: string
+                                              values:
+                                                description: |-
+                                                  values is an array of string values. If the operator is In or NotIn,
+                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                                  the values array must be empty. This array is replaced during a strategic
+                                                  merge patch.
+                                                items:
+                                                  type: string
+                                                type: array
+                                                x-kubernetes-list-type: atomic
+                                            required:
+                                            - key
+                                            - operator
+                                            type: object
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                        matchLabels:
+                                          additionalProperties:
+                                            type: string
+                                          description: |-
+                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                          type: object
+                                      type: object
+                                      x-kubernetes-map-type: atomic
+                                    namespaces:
+                                      description: |-
+                                        namespaces specifies a static list of namespace names that the term applies to.
+                                        The term is applied to the union of the namespaces listed in this field
+                                        and the ones selected by namespaceSelector.
+                                        null or empty namespaces list and null namespaceSelector means "this pod's namespace".
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    topologyKey:
+                                      description: |-
+                                        This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching
+                                        the labelSelector in the specified namespaces, where co-located is defined as running on a node
+                                        whose value of the label with key topologyKey matches that of any node on which any of the
+                                        selected pods is running.
+                                        Empty topologyKey is not allowed.
+                                      type: string
+                                  required:
+                                  - topologyKey
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
                             type: object
                         type: object
-                      hub:
-                        description: Specifies the docker hub for Istio images.
-                        type: string
-                      imagePullPolicy:
-                        description: |-
-                          Specifies the image pull policy for the Istio images. one of Always, Never, IfNotPresent.
-                          Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated.
-
-                          More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
-                        enum:
-                        - Always
-                        - Never
-                        - IfNotPresent
-                        type: string
-                      imagePullSecrets:
-                        description: |-
-                          ImagePullSecrets for the control plane ServiceAccount, list of secrets in the same namespace
-                          to use for pulling any images in pods that reference this ServiceAccount.
-                          Must be set for any cluster configured with private docker registry.
-                        items:
-                          type: string
-                        type: array
-                      logAsJson:
-                        description: Specifies whether istio components should output
-                          logs in json format by adding --log_as_json argument to
-                          each container.
-                        type: boolean
-                      logging:
-                        description: Specifies the global logging level settings for
-                          the Istio control plane components.
-                        properties:
-                          level:
-                            description: |-
-                              Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-                              The control plane has different scopes depending on component, but can configure default log level across all components
-                              If empty, default scope and level will be used as configured in code
-                            type: string
-                        type: object
-                      platform:
-                        description: |-
-                          Platform in which Istio is deployed. Possible values are: "openshift" and "gcp"
-                          An empty value means it is a vanilla Kubernetes distribution, therefore no special
-                          treatment will be considered.
-                        type: string
-                      tag:
-                        description: Specifies the tag for the Istio docker images.
-                        type: string
-                      variant:
-                        description: The variant of the Istio container images to
-                          use. Options are "debug" or "distroless". Unset will use
-                          the default for the given version.
-                        type: string
-                    type: object
-                  ztunnel:
-                    description: Configuration for the Istio ztunnel plugin.
-                    properties:
-                      Annotations:
-                        additionalProperties:
-                          type: string
-                        description: Annotations to apply to all top level resources
-                        type: object
-                      Labels:
-                        additionalProperties:
-                          type: string
-                        description: Labels to apply to all top level resources
-                        type: object
                       caAddress:
                         description: The address of the CA for CSR.
                         type: string
@@ -310,6 +4726,18 @@ spec:
                               to cluster local suffix for cross cluster communication.
                             type: boolean
                         type: object
+                      network:
+                        description: defines the network this cluster belong to. This
+                          name corresponds to the networks in the map of mesh networks.
+                        type: string
+                      nodeSelector:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          K8s node selector settings.
+
+                          See https://kubernetes.io/docs/user-guide/node-selection/
+                        type: object
                       podAnnotations:
                         additionalProperties:
                           type: string
@@ -326,6 +4754,19 @@ spec:
                           resourceName, if set, will override the naming of resources. If not set, will default to the release name.
                           It is recommended to not set this; this is primarily for backwards compatibility.
                         type: string
+                      resourceQuotas:
+                        description: The resource quotas configuration for ztunnel
+                        properties:
+                          enabled:
+                            description: Controls whether to create resource quotas
+                              or not for the CNI DaemonSet.
+                            type: boolean
+                          pods:
+                            description: The hard limit on the number of pods in the
+                              namespace where the CNI DaemonSet is deployed.
+                            format: int64
+                            type: integer
+                        type: object
                       resources:
                         description: The k8s resource requests and limits for the
                           ztunnel Pods.
@@ -390,6 +4831,26 @@ spec:
                         description: Configures the revision this control plane is
                           a part of
                         type: string
+                      seLinuxOptions:
+                        description: Set seLinux options for the ztunnel pod
+                        properties:
+                          level:
+                            description: Level is SELinux level label that applies
+                              to the container.
+                            type: string
+                          role:
+                            description: Role is a SELinux role label that applies
+                              to the container.
+                            type: string
+                          type:
+                            description: Type is a SELinux type label that applies
+                              to the container.
+                            type: string
+                          user:
+                            description: User is a SELinux user label that applies
+                              to the container.
+                            type: string
+                        type: object
                       tag:
                         description: The container image tag to pull. Image will be
                           `Hub/Image:Tag-Variant`.
@@ -403,6 +4864,103 @@ spec:
                         format: int64
                         minimum: 0
                         type: integer
+                      tolerations:
+                        description: Tolerations for the ztunnel pod
+                        items:
+                          description: |-
+                            The pod this Toleration is attached to tolerates any taint that matches
+                            the triple <key,value,effect> using the matching operator <operator>.
+                          properties:
+                            effect:
+                              description: |-
+                                Effect indicates the taint effect to match. Empty means match all taint effects.
+                                When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                              type: string
+                            key:
+                              description: |-
+                                Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                                If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                              type: string
+                            operator:
+                              description: |-
+                                Operator represents a key's relationship to the value.
+                                Valid operators are Exists and Equal. Defaults to Equal.
+                                Exists is equivalent to wildcard for value, so that a pod can
+                                tolerate all taints of a particular category.
+                              type: string
+                            tolerationSeconds:
+                              description: |-
+                                TolerationSeconds represents the period of time the toleration (which must be
+                                of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                                it is not set, which means tolerate the taint forever (do not evict). Zero and
+                                negative values will be treated as 0 (evict immediately) by the system.
+                              format: int64
+                              type: integer
+                            value:
+                              description: |-
+                                Value is the taint value the toleration matches to.
+                                If the operator is Exists, the value should be empty, otherwise just a regular string.
+                              type: string
+                          type: object
+                        type: array
+                      updateStrategy:
+                        description: Defines the update strategy to use when the version
+                          in the Ztunnel CR is updated.
+                        properties:
+                          rollingUpdate:
+                            description: Rolling update config params. Present only
+                              if type = "RollingUpdate".
+                            properties:
+                              maxSurge:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  The maximum number of nodes with an existing available DaemonSet pod that
+                                  can have an updated DaemonSet pod during during an update.
+                                  Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
+                                  This can not be 0 if MaxUnavailable is 0.
+                                  Absolute number is calculated from percentage by rounding up to a minimum of 1.
+                                  Default value is 0.
+                                  Example: when this is set to 30%, at most 30% of the total number of nodes
+                                  that should be running the daemon pod (i.e. status.desiredNumberScheduled)
+                                  can have their a new pod created before the old pod is marked as deleted.
+                                  The update starts by launching new pods on 30% of nodes. Once an updated
+                                  pod is available (Ready for at least minReadySeconds) the old DaemonSet pod
+                                  on that node is marked deleted. If the old pod becomes unavailable for any
+                                  reason (Ready transitions to false, is evicted, or is drained) an updated
+                                  pod is immediately created on that node without considering surge limits.
+                                  Allowing surge implies the possibility that the resources consumed by the
+                                  daemonset on any given node can double if the readiness check fails, and
+                                  so resource intensive daemonsets should take into account that they may
+                                  cause evictions during disruption.
+                                x-kubernetes-int-or-string: true
+                              maxUnavailable:
+                                anyOf:
+                                - type: integer
+                                - type: string
+                                description: |-
+                                  The maximum number of DaemonSet pods that can be unavailable during the
+                                  update. Value can be an absolute number (ex: 5) or a percentage of total
+                                  number of DaemonSet pods at the start of the update (ex: 10%). Absolute
+                                  number is calculated from percentage by rounding up.
+                                  This cannot be 0 if MaxSurge is 0
+                                  Default value is 1.
+                                  Example: when this is set to 30%, at most 30% of the total number of nodes
+                                  that should be running the daemon pod (i.e. status.desiredNumberScheduled)
+                                  can have their pods stopped for an update at any given time. The update
+                                  starts by stopping at most 30% of those DaemonSet pods and then brings
+                                  up new DaemonSet pods in their place. Once the new pods are available,
+                                  it then proceeds onto other DaemonSet pods, thus ensuring that at least
+                                  70% of original number of DaemonSet pods are available at all times during
+                                  the update.
+                                x-kubernetes-int-or-string: true
+                            type: object
+                          type:
+                            description: Type of daemon set update. Can be "RollingUpdate"
+                              or "OnDelete". Default is RollingUpdate.
+                            type: string
+                        type: object
                       variant:
                         description: The container image variant to pull. Options
                           are "debug" or "distroless". Unset will use the default
@@ -2379,35 +6937,30 @@ spec:
                     type: object
                 type: object
               version:
-                default: v1.27.1
+                default: v1.28.0
                 description: |-
                   Defines the version of Istio to install.
-                  Must be one of: v1.27-latest, v1.27.1, v1.27.0, v1.26-latest, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25-latest, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, master, v1.28-alpha.724e2360.
+                  Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, v1.25-latest, v1.24-latest, master, v1.29-alpha.b2f713a9.
                 enum:
+                - v1.28-latest
+                - v1.28.0
                 - v1.27-latest
+                - v1.27.3
+                - v1.27.2
                 - v1.27.1
                 - v1.27.0
                 - v1.26-latest
+                - v1.26.6
+                - v1.26.5
                 - v1.26.4
                 - v1.26.3
                 - v1.26.2
+                - v1.26.1
                 - v1.26.0
                 - v1.25-latest
-                - v1.25.5
-                - v1.25.4
-                - v1.25.3
-                - v1.25.2
-                - v1.25.1
                 - v1.24-latest
-                - v1.24.6
-                - v1.24.5
-                - v1.24.4
-                - v1.24.3
-                - v1.24.2
-                - v1.24.1
-                - v1.24.0
                 - master
-                - v1.28-alpha.724e2360
+                - v1.29-alpha.b2f713a9
                 type: string
             required:
             - namespace
@@ -2462,6 +7015,6 @@ spec:
         - message: metadata.name must be 'default'
           rule: self.metadata.name == 'default'
     served: true
-    storage: true
+    storage: false
     subresources:
       status: {}
diff --git a/chart/crds/telemetry.istio.io_telemetries.yaml b/chart/crds/telemetry.istio.io_telemetries.yaml
index bacf4ecd5..23747292e 100644
--- a/chart/crds/telemetry.istio.io_telemetries.yaml
+++ b/chart/crds/telemetry.istio.io_telemetries.yaml
@@ -288,12 +288,16 @@ spec:
                               - environment
                             - required:
                               - header
+                            - required:
+                              - formatter
                         - required:
                           - literal
                         - required:
                           - environment
                         - required:
                           - header
+                        - required:
+                          - formatter
                         properties:
                           environment:
                             description: Environment adds the value of an environment
@@ -310,6 +314,18 @@ spec:
                             required:
                             - name
                             type: object
+                          formatter:
+                            description: Formatter adds the value of access logging
+                              substitution formatter.
+                            properties:
+                              value:
+                                description: The formatter tag value to use, same
+                                  formatter as HTTP access logging (e.g.
+                                minLength: 1
+                                type: string
+                            required:
+                            - value
+                            type: object
                           header:
                             description: RequestHeader adds the value of an header
                               from the request to each span.
@@ -736,12 +752,16 @@ spec:
                               - environment
                             - required:
                               - header
+                            - required:
+                              - formatter
                         - required:
                           - literal
                         - required:
                           - environment
                         - required:
                           - header
+                        - required:
+                          - formatter
                         properties:
                           environment:
                             description: Environment adds the value of an environment
@@ -758,6 +778,18 @@ spec:
                             required:
                             - name
                             type: object
+                          formatter:
+                            description: Formatter adds the value of access logging
+                              substitution formatter.
+                            properties:
+                              value:
+                                description: The formatter tag value to use, same
+                                  formatter as HTTP access logging (e.g.
+                                minLength: 1
+                                type: string
+                            required:
+                            - value
+                            type: object
                           header:
                             description: RequestHeader adds the value of an header
                               from the request to each span.
diff --git a/chart/samples/ambient/istio-sample.yaml b/chart/samples/ambient/istio-sample.yaml
index df616cc2e..402174f41 100644
--- a/chart/samples/ambient/istio-sample.yaml
+++ b/chart/samples/ambient/istio-sample.yaml
@@ -3,7 +3,7 @@ kind: Istio
 metadata:
   name: default
 spec:
-  version: v1.27.1
+  version: v1.28.0
   namespace: istio-system
   profile: ambient
   updateStrategy:
diff --git a/chart/samples/ambient/istiocni-sample.yaml b/chart/samples/ambient/istiocni-sample.yaml
index 2ee039f94..05e0e7a3f 100644
--- a/chart/samples/ambient/istiocni-sample.yaml
+++ b/chart/samples/ambient/istiocni-sample.yaml
@@ -3,6 +3,6 @@ kind: IstioCNI
 metadata:
   name: default
 spec:
-  version: v1.27.1
+  version: v1.28.0
   profile: ambient
   namespace: istio-cni
diff --git a/chart/samples/ambient/istioztunnel-sample.yaml b/chart/samples/ambient/istioztunnel-sample.yaml
index 819c0df74..4da6fd322 100644
--- a/chart/samples/ambient/istioztunnel-sample.yaml
+++ b/chart/samples/ambient/istioztunnel-sample.yaml
@@ -1,8 +1,7 @@
-apiVersion: sailoperator.io/v1alpha1
+apiVersion: sailoperator.io/v1
 kind: ZTunnel
 metadata:
   name: default
 spec:
-  version: v1.27.1
+  version: v1.28.0
   namespace: ztunnel
-  profile: ambient
diff --git a/chart/samples/istio-sample-gw-api.yaml b/chart/samples/istio-sample-gw-api.yaml
index 1501caf78..0d4f80db6 100644
--- a/chart/samples/istio-sample-gw-api.yaml
+++ b/chart/samples/istio-sample-gw-api.yaml
@@ -3,7 +3,7 @@ kind: Istio
 metadata:
   name: gateway-controller
 spec:
-  version: v1.27.1
+  version: v1.28.0
   namespace: gateway-controller
   updateStrategy:
     type: InPlace
diff --git a/chart/samples/istio-sample-revisionbased.yaml b/chart/samples/istio-sample-revisionbased.yaml
index fc4209b8b..3201d884b 100644
--- a/chart/samples/istio-sample-revisionbased.yaml
+++ b/chart/samples/istio-sample-revisionbased.yaml
@@ -3,7 +3,7 @@ kind: Istio
 metadata:
   name: default
 spec:
-  version: v1.27.1
+  version: v1.28.0
   namespace: istio-system
   updateStrategy:
     type: RevisionBased
diff --git a/chart/samples/istio-sample.yaml b/chart/samples/istio-sample.yaml
index 024ca821e..424618e78 100644
--- a/chart/samples/istio-sample.yaml
+++ b/chart/samples/istio-sample.yaml
@@ -3,7 +3,7 @@ kind: Istio
 metadata:
   name: default
 spec:
-  version: v1.27.1
+  version: v1.28.0
   namespace: istio-system
   updateStrategy:
     type: InPlace
diff --git a/chart/samples/istiocni-sample.yaml b/chart/samples/istiocni-sample.yaml
index 9d1e86ee1..e2caad24b 100644
--- a/chart/samples/istiocni-sample.yaml
+++ b/chart/samples/istiocni-sample.yaml
@@ -3,5 +3,5 @@ kind: IstioCNI
 metadata:
   name: default
 spec:
-  version: v1.27.1
+  version: v1.28.0
   namespace: istio-cni
diff --git a/chart/samples/ztunnel-sample.yaml b/chart/samples/ztunnel-sample.yaml
new file mode 100644
index 000000000..2894dde18
--- /dev/null
+++ b/chart/samples/ztunnel-sample.yaml
@@ -0,0 +1,7 @@
+apiVersion: sailoperator.io/v1
+kind: ZTunnel
+metadata:
+  name: default
+spec:
+  version: v1.27.3
+  namespace: ztunnel
diff --git a/chart/templates/olm/samples.yaml b/chart/templates/olm/samples.yaml
index db0b34d87..1335ebb64 100644
--- a/chart/templates/olm/samples.yaml
+++ b/chart/templates/olm/samples.yaml
@@ -2,4 +2,6 @@
 {{ .Files.Get "samples/istio-sample.yaml" }}
 ---
 {{ .Files.Get "samples/istiocni-sample.yaml" }}
+---
+{{ .Files.Get "samples/ztunnel-sample.yaml" }}
 {{ end }}
diff --git a/chart/templates/olm/scorecard.yaml b/chart/templates/olm/scorecard.yaml
index 241f9b9a3..711dab4b5 100644
--- a/chart/templates/olm/scorecard.yaml
+++ b/chart/templates/olm/scorecard.yaml
@@ -9,7 +9,7 @@ stages:
   - entrypoint:
     - scorecard-test
     - basic-check-spec
-    image: quay.io/operator-framework/scorecard-test:v1.41.1
+    image: quay.io/operator-framework/scorecard-test:v1.42.0
     labels:
       suite: basic
       test: basic-check-spec-test
@@ -19,7 +19,7 @@ stages:
   - entrypoint:
     - scorecard-test
     - olm-bundle-validation
-    image: quay.io/operator-framework/scorecard-test:v1.41.1
+    image: quay.io/operator-framework/scorecard-test:v1.42.0
     labels:
       suite: olm
       test: olm-bundle-validation-test
@@ -29,7 +29,7 @@ stages:
   - entrypoint:
     - scorecard-test
     - olm-crds-have-validation
-    image: quay.io/operator-framework/scorecard-test:v1.41.1
+    image: quay.io/operator-framework/scorecard-test:v1.42.0
     labels:
       suite: olm
       test: olm-crds-have-validation-test
@@ -39,7 +39,7 @@ stages:
   - entrypoint:
     - scorecard-test
     - olm-spec-descriptors
-    image: quay.io/operator-framework/scorecard-test:v1.41.1
+    image: quay.io/operator-framework/scorecard-test:v1.42.0
     labels:
       suite: olm
       test: olm-spec-descriptors-test
@@ -49,7 +49,7 @@ stages:
   - entrypoint:
     - scorecard-test
     - olm-status-descriptors
-    image: quay.io/operator-framework/scorecard-test:v1.41.1
+    image: quay.io/operator-framework/scorecard-test:v1.42.0
     labels:
       suite: olm
       test: olm-status-descriptors-test
diff --git a/chart/values.yaml b/chart/values.yaml
index d49035f7c..04eff661c 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -2,6 +2,18 @@ name: sailoperator
 deployment:
   name: sail-operator
   annotations:
+    images.v1_28_0.ztunnel: gcr.io/istio-release/ztunnel:1.28.0
+    images.v1_28_0.istiod: gcr.io/istio-release/pilot:1.28.0
+    images.v1_28_0.proxy: gcr.io/istio-release/proxyv2:1.28.0
+    images.v1_28_0.cni: gcr.io/istio-release/install-cni:1.28.0
+    images.v1_27_3.ztunnel: gcr.io/istio-release/ztunnel:1.27.3
+    images.v1_27_3.istiod: gcr.io/istio-release/pilot:1.27.3
+    images.v1_27_3.proxy: gcr.io/istio-release/proxyv2:1.27.3
+    images.v1_27_3.cni: gcr.io/istio-release/install-cni:1.27.3
+    images.v1_27_2.ztunnel: gcr.io/istio-release/ztunnel:1.27.2
+    images.v1_27_2.istiod: gcr.io/istio-release/pilot:1.27.2
+    images.v1_27_2.proxy: gcr.io/istio-release/proxyv2:1.27.2
+    images.v1_27_2.cni: gcr.io/istio-release/install-cni:1.27.2
     images.v1_27_1.ztunnel: gcr.io/istio-release/ztunnel:1.27.1
     images.v1_27_1.istiod: gcr.io/istio-release/pilot:1.27.1
     images.v1_27_1.proxy: gcr.io/istio-release/proxyv2:1.27.1
@@ -10,6 +22,14 @@ deployment:
     images.v1_27_0.istiod: gcr.io/istio-release/pilot:1.27.0
     images.v1_27_0.proxy: gcr.io/istio-release/proxyv2:1.27.0
     images.v1_27_0.cni: gcr.io/istio-release/install-cni:1.27.0
+    images.v1_26_6.ztunnel: gcr.io/istio-release/ztunnel:1.26.6
+    images.v1_26_6.istiod: gcr.io/istio-release/pilot:1.26.6
+    images.v1_26_6.proxy: gcr.io/istio-release/proxyv2:1.26.6
+    images.v1_26_6.cni: gcr.io/istio-release/install-cni:1.26.6
+    images.v1_26_5.ztunnel: gcr.io/istio-release/ztunnel:1.26.5
+    images.v1_26_5.istiod: gcr.io/istio-release/pilot:1.26.5
+    images.v1_26_5.proxy: gcr.io/istio-release/proxyv2:1.26.5
+    images.v1_26_5.cni: gcr.io/istio-release/install-cni:1.26.5
     images.v1_26_4.ztunnel: gcr.io/istio-release/ztunnel:1.26.4
     images.v1_26_4.istiod: gcr.io/istio-release/pilot:1.26.4
     images.v1_26_4.proxy: gcr.io/istio-release/proxyv2:1.26.4
@@ -22,62 +42,18 @@ deployment:
     images.v1_26_2.istiod: gcr.io/istio-release/pilot:1.26.2
     images.v1_26_2.proxy: gcr.io/istio-release/proxyv2:1.26.2
     images.v1_26_2.cni: gcr.io/istio-release/install-cni:1.26.2
+    images.v1_26_1.ztunnel: gcr.io/istio-release/ztunnel:1.26.1
+    images.v1_26_1.istiod: gcr.io/istio-release/pilot:1.26.1
+    images.v1_26_1.proxy: gcr.io/istio-release/proxyv2:1.26.1
+    images.v1_26_1.cni: gcr.io/istio-release/install-cni:1.26.1
     images.v1_26_0.ztunnel: gcr.io/istio-release/ztunnel:1.26.0
     images.v1_26_0.istiod: gcr.io/istio-release/pilot:1.26.0
     images.v1_26_0.proxy: gcr.io/istio-release/proxyv2:1.26.0
     images.v1_26_0.cni: gcr.io/istio-release/install-cni:1.26.0
-    images.v1_25_5.ztunnel: gcr.io/istio-release/ztunnel:1.25.5
-    images.v1_25_5.istiod: gcr.io/istio-release/pilot:1.25.5
-    images.v1_25_5.proxy: gcr.io/istio-release/proxyv2:1.25.5
-    images.v1_25_5.cni: gcr.io/istio-release/install-cni:1.25.5
-    images.v1_25_4.ztunnel: gcr.io/istio-release/ztunnel:1.25.4
-    images.v1_25_4.istiod: gcr.io/istio-release/pilot:1.25.4
-    images.v1_25_4.proxy: gcr.io/istio-release/proxyv2:1.25.4
-    images.v1_25_4.cni: gcr.io/istio-release/install-cni:1.25.4
-    images.v1_25_3.ztunnel: gcr.io/istio-release/ztunnel:1.25.3
-    images.v1_25_3.istiod: gcr.io/istio-release/pilot:1.25.3
-    images.v1_25_3.proxy: gcr.io/istio-release/proxyv2:1.25.3
-    images.v1_25_3.cni: gcr.io/istio-release/install-cni:1.25.3
-    images.v1_25_2.ztunnel: gcr.io/istio-release/ztunnel:1.25.2
-    images.v1_25_2.istiod: gcr.io/istio-release/pilot:1.25.2
-    images.v1_25_2.proxy: gcr.io/istio-release/proxyv2:1.25.2
-    images.v1_25_2.cni: gcr.io/istio-release/install-cni:1.25.2
-    images.v1_25_1.ztunnel: gcr.io/istio-release/ztunnel:1.25.1
-    images.v1_25_1.istiod: gcr.io/istio-release/pilot:1.25.1
-    images.v1_25_1.proxy: gcr.io/istio-release/proxyv2:1.25.1
-    images.v1_25_1.cni: gcr.io/istio-release/install-cni:1.25.1
-    images.v1_24_6.ztunnel: gcr.io/istio-release/ztunnel:1.24.6
-    images.v1_24_6.istiod: gcr.io/istio-release/pilot:1.24.6
-    images.v1_24_6.proxy: gcr.io/istio-release/proxyv2:1.24.6
-    images.v1_24_6.cni: gcr.io/istio-release/install-cni:1.24.6
-    images.v1_24_5.ztunnel: gcr.io/istio-release/ztunnel:1.24.5
-    images.v1_24_5.istiod: gcr.io/istio-release/pilot:1.24.5
-    images.v1_24_5.proxy: gcr.io/istio-release/proxyv2:1.24.5
-    images.v1_24_5.cni: gcr.io/istio-release/install-cni:1.24.5
-    images.v1_24_4.ztunnel: gcr.io/istio-release/ztunnel:1.24.4
-    images.v1_24_4.istiod: gcr.io/istio-release/pilot:1.24.4
-    images.v1_24_4.proxy: gcr.io/istio-release/proxyv2:1.24.4
-    images.v1_24_4.cni: gcr.io/istio-release/install-cni:1.24.4
-    images.v1_24_3.ztunnel: gcr.io/istio-release/ztunnel:1.24.3
-    images.v1_24_3.istiod: gcr.io/istio-release/pilot:1.24.3
-    images.v1_24_3.proxy: gcr.io/istio-release/proxyv2:1.24.3
-    images.v1_24_3.cni: gcr.io/istio-release/install-cni:1.24.3
-    images.v1_24_2.ztunnel: gcr.io/istio-release/ztunnel:1.24.2
-    images.v1_24_2.istiod: gcr.io/istio-release/pilot:1.24.2
-    images.v1_24_2.proxy: gcr.io/istio-release/proxyv2:1.24.2
-    images.v1_24_2.cni: gcr.io/istio-release/install-cni:1.24.2
-    images.v1_24_1.ztunnel: gcr.io/istio-release/ztunnel:1.24.1
-    images.v1_24_1.istiod: gcr.io/istio-release/pilot:1.24.1
-    images.v1_24_1.proxy: gcr.io/istio-release/proxyv2:1.24.1
-    images.v1_24_1.cni: gcr.io/istio-release/install-cni:1.24.1
-    images.v1_24_0.ztunnel: gcr.io/istio-release/ztunnel:1.24.0
-    images.v1_24_0.istiod: gcr.io/istio-release/pilot:1.24.0
-    images.v1_24_0.proxy: gcr.io/istio-release/proxyv2:1.24.0
-    images.v1_24_0.cni: gcr.io/istio-release/install-cni:1.24.0
-    images.v1_28-alpha_724e2360.ztunnel: gcr.io/istio-testing/ztunnel:1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-    images.v1_28-alpha_724e2360.istiod: gcr.io/istio-testing/pilot:1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-    images.v1_28-alpha_724e2360.proxy: gcr.io/istio-testing/proxyv2:1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-    images.v1_28-alpha_724e2360.cni: gcr.io/istio-testing/install-cni:1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
+    images.v1_29-alpha_b2f713a9.ztunnel: gcr.io/istio-testing/ztunnel:1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+    images.v1_29-alpha_b2f713a9.istiod: gcr.io/istio-testing/pilot:1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+    images.v1_29-alpha_b2f713a9.proxy: gcr.io/istio-testing/proxyv2:1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+    images.v1_29-alpha_b2f713a9.cni: gcr.io/istio-testing/install-cni:1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
 revisionHistoryLimit: 10
 service:
   port: 8443
@@ -93,30 +69,23 @@ csv:
 
     This version of the operator supports the following Istio versions:
 
+    - v1.28-latest
+    - v1.28.0
     - v1.27-latest
+    - v1.27.3
+    - v1.27.2
     - v1.27.1
     - v1.27.0
     - v1.26-latest
+    - v1.26.6
+    - v1.26.5
     - v1.26.4
     - v1.26.3
     - v1.26.2
+    - v1.26.1
     - v1.26.0
-    - v1.25-latest
-    - v1.25.5
-    - v1.25.4
-    - v1.25.3
-    - v1.25.2
-    - v1.25.1
-    - v1.24-latest
-    - v1.24.6
-    - v1.24.5
-    - v1.24.4
-    - v1.24.3
-    - v1.24.2
-    - v1.24.1
-    - v1.24.0
     - master
-    - v1.28-alpha.724e2360
+    - v1.29-alpha.b2f713a9
 
     [See this page](https://github.com/istio-ecosystem/sail-operator/blob/main/bundle/README.md) for instructions on how to use it.
   support: Community based
diff --git a/codecov.yml b/codecov.yml
index dd310942c..8ad0da17c 100644
--- a/codecov.yml
+++ b/codecov.yml
@@ -2,4 +2,4 @@ ignore:
   - "api"
   - "hack"
   - "tools"
-  - "tests"
+  - "tests/**"
diff --git a/common/.commonfiles.sha b/common/.commonfiles.sha
index 09bdae112..74cad0294 100644
--- a/common/.commonfiles.sha
+++ b/common/.commonfiles.sha
@@ -1 +1 @@
-be6513cc1433076ebdb636af99c9b171d9a36f27
+f335e7753c209c164f5c2d9d8f183fadc1e1cd98
diff --git a/common/scripts/setup_env.sh b/common/scripts/setup_env.sh
index 49107e642..02b5ce571 100755
--- a/common/scripts/setup_env.sh
+++ b/common/scripts/setup_env.sh
@@ -77,7 +77,7 @@ fi
 TOOLS_REGISTRY_PROVIDER=${TOOLS_REGISTRY_PROVIDER:-gcr.io}
 PROJECT_ID=${PROJECT_ID:-istio-testing}
 if [[ "${IMAGE_VERSION:-}" == "" ]]; then
-  IMAGE_VERSION=master-6ac9cdb3d1ad09092398ab15574ce88cf2ac31ff
+  IMAGE_VERSION=master-8dcf63149d5bdaa83d1407a121098e8e8d1626dd
 fi
 if [[ "${IMAGE_NAME:-}" == "" ]]; then
   IMAGE_NAME=build-tools
diff --git a/controllers/istiorevision/istiorevision_controller.go b/controllers/istiorevision/istiorevision_controller.go
index 6d4dd4907..d98b865e4 100644
--- a/controllers/istiorevision/istiorevision_controller.go
+++ b/controllers/istiorevision/istiorevision_controller.go
@@ -59,7 +59,10 @@ import (
 	"istio.io/istio/pkg/ptr"
 )
 
-const istioCniName = "default"
+const (
+	istioCniName = "default"
+	ztunnelName  = "default"
+)
 
 // Reconciler reconciles an IstioRevision object
 type Reconciler struct {
@@ -269,6 +272,8 @@ func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error {
 
 	istioCniHandler := wrapEventHandler(logger, handler.EnqueueRequestsFromMapFunc(r.mapIstioCniToReconcileRequests))
 
+	ztunnelHandler := wrapEventHandler(logger, handler.EnqueueRequestsFromMapFunc(r.mapZTunnelToReconcileRequests))
+
 	// endpointSliceHandler triggers reconciliation if the EndpointSlice is owned directly by an IstioRevision,
 	// or if it's owned by an Endpoints object which in turn is owned by an IstioRevision.
 	endpointSliceHandler := wrapEventHandler(logger, handler.EnqueueRequestsFromMapFunc(r.mapEndpointSliceToReconcileRequests))
@@ -290,43 +295,52 @@ func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error {
 		Named("istiorevision").
 
 		// namespaced resources
-		Watches(&corev1.ConfigMap{}, ownedResourceHandler).
-		Watches(&appsv1.Deployment{}, ownedResourceHandler). // we don't ignore the status here because we use it to calculate the IstioRevision status
+		Watches(&corev1.ConfigMap{}, ownedResourceHandler, builder.WithPredicates(predicate2.IgnoreUpdateWhenAnnotation())).
+		// We don't ignore the status for Deployments because we use it to calculate the IstioRevision status
+		Watches(&appsv1.Deployment{}, ownedResourceHandler, builder.WithPredicates(predicate2.IgnoreUpdateWhenAnnotation())).
 		// +lint-watches:ignore: Endpoints (older versions of istiod chart create Endpoints for remote installs, but this controller watches EndpointSlices)
 		// +lint-watches:ignore: EndpointSlice (istiod chart creates Endpoints for remote installs, but this controller watches EndpointSlices)
-		Watches(&discoveryv1.EndpointSlice{}, endpointSliceHandler).
-		Watches(&corev1.Service{}, ownedResourceHandler, builder.WithPredicates(ignoreStatusChange())).
+		Watches(&discoveryv1.EndpointSlice{}, endpointSliceHandler, builder.WithPredicates(predicate2.IgnoreUpdateWhenAnnotation())).
+		Watches(&corev1.Service{}, ownedResourceHandler,
+			builder.WithPredicates(ignoreStatusChange(), predicate2.IgnoreUpdateWhenAnnotation())).
 
 		// +lint-watches:ignore: NetworkPolicy (FIXME: NetworkPolicy has not yet been added upstream, but is WIP)
-		Watches(&networkingv1.NetworkPolicy{}, ownedResourceHandler, builder.WithPredicates(ignoreStatusChange())).
+		Watches(&networkingv1.NetworkPolicy{}, ownedResourceHandler,
+			builder.WithPredicates(ignoreStatusChange(), predicate2.IgnoreUpdateWhenAnnotation())).
 
 		// We use predicate.IgnoreUpdate() so that we skip the reconciliation when a pull secret is added to the ServiceAccount.
 		// This is necessary so that we don't remove the newly-added secret.
 		// TODO: this is a temporary hack until we implement the correct solution on the Helm-render side
 		Watches(&corev1.ServiceAccount{}, ownedResourceHandler, builder.WithPredicates(predicate2.IgnoreUpdate())).
-		Watches(&rbacv1.Role{}, ownedResourceHandler).
-		Watches(&rbacv1.RoleBinding{}, ownedResourceHandler).
-		Watches(&policyv1.PodDisruptionBudget{}, ownedResourceHandler, builder.WithPredicates(ignoreStatusChange())).
-		Watches(&autoscalingv2.HorizontalPodAutoscaler{}, ownedResourceHandler, builder.WithPredicates(ignoreStatusChange())).
+		Watches(&rbacv1.Role{}, ownedResourceHandler, builder.WithPredicates(predicate2.IgnoreUpdateWhenAnnotation())).
+		Watches(&rbacv1.RoleBinding{}, ownedResourceHandler, builder.WithPredicates(predicate2.IgnoreUpdateWhenAnnotation())).
+		Watches(&policyv1.PodDisruptionBudget{}, ownedResourceHandler,
+			builder.WithPredicates(ignoreStatusChange(), predicate2.IgnoreUpdateWhenAnnotation())).
+		Watches(&autoscalingv2.HorizontalPodAutoscaler{}, ownedResourceHandler,
+			builder.WithPredicates(ignoreStatusChange(), predicate2.IgnoreUpdateWhenAnnotation())).
 
 		// +lint-watches:ignore: Namespace (not found in charts, but must be watched to reconcile IstioRevision when its namespace is created)
-		Watches(&corev1.Namespace{}, nsHandler, builder.WithPredicates(ignoreStatusChange())).
+		Watches(&corev1.Namespace{}, nsHandler, builder.WithPredicates(ignoreStatusChange()), builder.WithPredicates(predicate2.IgnoreUpdateWhenAnnotation())).
 
 		// +lint-watches:ignore: Pod (not found in charts, but must be watched to reconcile IstioRevision when a pod references it)
-		Watches(&corev1.Pod{}, podHandler, builder.WithPredicates(ignoreStatusChange())).
+		Watches(&corev1.Pod{}, podHandler, builder.WithPredicates(ignoreStatusChange(), predicate2.IgnoreUpdateWhenAnnotation())).
 
 		// +lint-watches:ignore: IstioRevisionTag (not found in charts, but must be watched to reconcile IstioRevision when a pod references it)
 		Watches(&v1.IstioRevisionTag{}, revisionTagHandler).
 
 		// cluster-scoped resources
-		Watches(&rbacv1.ClusterRole{}, ownedResourceHandler).
-		Watches(&rbacv1.ClusterRoleBinding{}, ownedResourceHandler).
-		Watches(&admissionv1.MutatingWebhookConfiguration{}, ownedResourceHandler).
-		Watches(&admissionv1.ValidatingWebhookConfiguration{}, ownedResourceHandler, builder.WithPredicates(validatingWebhookConfigPredicate())).
+		Watches(&rbacv1.ClusterRole{}, ownedResourceHandler, builder.WithPredicates(predicate2.IgnoreUpdateWhenAnnotation())).
+		Watches(&rbacv1.ClusterRoleBinding{}, ownedResourceHandler, builder.WithPredicates(predicate2.IgnoreUpdateWhenAnnotation())).
+		Watches(&admissionv1.MutatingWebhookConfiguration{}, ownedResourceHandler, builder.WithPredicates(predicate2.IgnoreUpdateWhenAnnotation())).
+		Watches(&admissionv1.ValidatingWebhookConfiguration{}, ownedResourceHandler,
+			builder.WithPredicates(validatingWebhookConfigPredicate(), predicate2.IgnoreUpdateWhenAnnotation())).
 
 		// +lint-watches:ignore: IstioCNI (not found in charts, but this controller needs to watch it to update the IstioRevision status)
 		Watches(&v1.IstioCNI{}, istioCniHandler).
 
+		// +lint-watches:ignore: ZTunnel (not found in charts, but this controller needs to watch it to update the IstioRevision status)
+		Watches(&v1.ZTunnel{}, ztunnelHandler).
+
 		// +lint-watches:ignore: ValidatingAdmissionPolicy (TODO: fix this when CI supports golang 1.22 and k8s 1.30)
 		// +lint-watches:ignore: ValidatingAdmissionPolicyBinding (TODO: fix this when CI supports golang 1.22 and k8s 1.30)
 		// +lint-watches:ignore: CustomResourceDefinition (prevents `make lint-watches` from bugging us about CRDs)
@@ -482,6 +496,36 @@ func (r *Reconciler) determineDependenciesHealthyCondition(ctx context.Context,
 		}
 	}
 
+	if revision.DependsOnZTunnel(rev, r.Config) {
+		ztunnel := v1.ZTunnel{}
+		if err := r.Client.Get(ctx, client.ObjectKey{Name: ztunnelName}, &ztunnel); err != nil {
+			if apierrors.IsNotFound(err) {
+				return v1.IstioRevisionCondition{
+					Type:    v1.IstioRevisionConditionDependenciesHealthy,
+					Status:  metav1.ConditionFalse,
+					Reason:  v1.IstioRevisionReasonZTunnelNotFound,
+					Message: "ZTunnel resource does not exist",
+				}, nil
+			}
+
+			return v1.IstioRevisionCondition{
+				Type:    v1.IstioRevisionConditionDependenciesHealthy,
+				Status:  metav1.ConditionUnknown,
+				Reason:  v1.IstioRevisionDependencyCheckFailed,
+				Message: fmt.Sprintf("failed to get ZTunnel status: %v", err),
+			}, fmt.Errorf("get failed: %w", err)
+		}
+
+		if ztunnel.Status.State != v1.ZTunnelReasonHealthy {
+			return v1.IstioRevisionCondition{
+				Type:    v1.IstioRevisionConditionDependenciesHealthy,
+				Status:  metav1.ConditionFalse,
+				Reason:  v1.IstioRevisionReasonZTunnelNotHealthy,
+				Message: "ZTunnel resource status indicates that the component is not healthy",
+			}, nil
+		}
+	}
+
 	return v1.IstioRevisionCondition{
 		Type:   v1.IstioRevisionConditionDependenciesHealthy,
 		Status: metav1.ConditionTrue,
@@ -672,6 +716,21 @@ func (r *Reconciler) mapIstioCniToReconcileRequests(ctx context.Context, _ clien
 	return reqs
 }
 
+// mapZTunnelToReconcileRequests returns reconcile requests for all IstioRevisions that depend on ZTunnel
+func (r *Reconciler) mapZTunnelToReconcileRequests(ctx context.Context, _ client.Object) []reconcile.Request {
+	list := v1.IstioRevisionList{}
+	if err := r.Client.List(ctx, &list); err != nil {
+		return nil
+	}
+	var reqs []reconcile.Request
+	for _, rev := range list.Items {
+		if revision.DependsOnZTunnel(&rev, r.Config) {
+			reqs = append(reqs, reconcile.Request{NamespacedName: types.NamespacedName{Name: rev.Name}})
+		}
+	}
+	return reqs
+}
+
 // ignoreStatusChange returns a predicate that ignores watch events where only the resource status changes; if
 // there are any other changes to the resource, the event is not ignored.
 // This ensures that the controller doesn't reconcile the entire IstioRevision every time the status of an owned
diff --git a/controllers/ztunnel/ztunnel_controller.go b/controllers/ztunnel/ztunnel_controller.go
index f2e3fbfa4..284ad4b07 100644
--- a/controllers/ztunnel/ztunnel_controller.go
+++ b/controllers/ztunnel/ztunnel_controller.go
@@ -62,7 +62,8 @@ type Reconciler struct {
 }
 
 const (
-	ztunnelChart = "ztunnel"
+	ztunnelChart   = "ztunnel"
+	defaultProfile = "ambient"
 )
 
 func NewReconciler(cfg config.ReconcilerConfig, client client.Client, scheme *runtime.Scheme, chartManager *helm.ChartManager) *Reconciler {
@@ -88,7 +89,7 @@ func NewReconciler(cfg config.ReconcilerConfig, client client.Client, scheme *ru
 //
 // For more details, check Reconcile and its Result here:
 // - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.14.1/pkg/reconcile
-func (r *Reconciler) Reconcile(ctx context.Context, ztunnel *v1alpha1.ZTunnel) (ctrl.Result, error) {
+func (r *Reconciler) Reconcile(ctx context.Context, ztunnel *v1.ZTunnel) (ctrl.Result, error) {
 	log := logf.FromContext(ctx)
 
 	reconcileErr := r.doReconcile(ctx, ztunnel)
@@ -99,11 +100,11 @@ func (r *Reconciler) Reconcile(ctx context.Context, ztunnel *v1alpha1.ZTunnel) (
 	return ctrl.Result{}, errors.Join(reconcileErr, statusErr)
 }
 
-func (r *Reconciler) Finalize(ctx context.Context, ztunnel *v1alpha1.ZTunnel) error {
+func (r *Reconciler) Finalize(ctx context.Context, ztunnel *v1.ZTunnel) error {
 	return r.uninstallHelmChart(ctx, ztunnel)
 }
 
-func (r *Reconciler) doReconcile(ctx context.Context, ztunnel *v1alpha1.ZTunnel) error {
+func (r *Reconciler) doReconcile(ctx context.Context, ztunnel *v1.ZTunnel) error {
 	log := logf.FromContext(ctx)
 	if err := r.validate(ctx, ztunnel); err != nil {
 		return err
@@ -113,7 +114,7 @@ func (r *Reconciler) doReconcile(ctx context.Context, ztunnel *v1alpha1.ZTunnel)
 	return r.installHelmChart(ctx, ztunnel)
 }
 
-func (r *Reconciler) validate(ctx context.Context, ztunnel *v1alpha1.ZTunnel) error {
+func (r *Reconciler) validate(ctx context.Context, ztunnel *v1.ZTunnel) error {
 	if ztunnel.Spec.Version == "" {
 		return reconciler.NewValidationError("spec.version not set")
 	}
@@ -126,10 +127,10 @@ func (r *Reconciler) validate(ctx context.Context, ztunnel *v1alpha1.ZTunnel) er
 	return nil
 }
 
-func (r *Reconciler) installHelmChart(ctx context.Context, ztunnel *v1alpha1.ZTunnel) error {
+func (r *Reconciler) installHelmChart(ctx context.Context, ztunnel *v1.ZTunnel) error {
 	ownerReference := metav1.OwnerReference{
-		APIVersion:         v1alpha1.GroupVersion.String(),
-		Kind:               v1alpha1.ZTunnelKind,
+		APIVersion:         v1.GroupVersion.String(),
+		Kind:               v1.ZTunnelKind,
 		Name:               ztunnel.Name,
 		UID:                ztunnel.UID,
 		Controller:         ptr.Of(true),
@@ -151,7 +152,7 @@ func (r *Reconciler) installHelmChart(ctx context.Context, ztunnel *v1alpha1.ZTu
 
 	// apply userValues on top of defaultValues from profiles
 	mergedHelmValues, err := istiovalues.ApplyProfilesAndPlatform(
-		r.Config.ResourceDirectory, version, r.Config.Platform, r.Config.DefaultProfile, ztunnel.Spec.Profile, helm.FromValues(userValues))
+		r.Config.ResourceDirectory, version, r.Config.Platform, r.Config.DefaultProfile, defaultProfile, helm.FromValues(userValues))
 	if err != nil {
 		return fmt.Errorf("failed to apply profile: %w", err)
 	}
@@ -202,7 +203,7 @@ func applyImageDigests(version string, values *v1.ZTunnelValues, config config.O
 	return values
 }
 
-func (r *Reconciler) uninstallHelmChart(ctx context.Context, ztunnel *v1alpha1.ZTunnel) error {
+func (r *Reconciler) uninstallHelmChart(ctx context.Context, ztunnel *v1.ZTunnel) error {
 	_, err := r.ChartManager.UninstallChart(ctx, ztunnelChart, ztunnel.Spec.Namespace)
 	if err != nil {
 		return fmt.Errorf("failed to uninstall Helm chart %q: %w", ztunnelChart, err)
@@ -219,7 +220,7 @@ func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error {
 
 	// ownedResourceHandler handles resources that are owned by the ZTunnel CR
 	ownedResourceHandler := wrapEventHandler(logger,
-		handler.EnqueueRequestForOwner(r.Scheme, r.RESTMapper(), &v1alpha1.ZTunnel{}, handler.OnlyControllerOwner()))
+		handler.EnqueueRequestForOwner(r.Scheme, r.RESTMapper(), &v1.ZTunnel{}, handler.OnlyControllerOwner()))
 
 	namespaceHandler := wrapEventHandler(logger, handler.EnqueueRequestsFromMapFunc(r.mapNamespaceToReconcileRequest))
 
@@ -235,7 +236,9 @@ func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error {
 		}).
 
 		// we use the Watches function instead of For(), so that we can wrap the handler so that events that cause the object to be enqueued are logged
-		Watches(&v1alpha1.ZTunnel{}, mainObjectHandler).Named("ztunnel").
+		Watches(&v1alpha1.ZTunnel{}, mainObjectHandler).
+		Watches(&v1.ZTunnel{}, mainObjectHandler).
+		Named("ztunnel").
 
 		// namespaced resources
 		Watches(&corev1.ConfigMap{}, ownedResourceHandler).
@@ -252,10 +255,10 @@ func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error {
 		Watches(&corev1.Namespace{}, namespaceHandler).
 		Watches(&rbacv1.ClusterRole{}, ownedResourceHandler).
 		Watches(&rbacv1.ClusterRoleBinding{}, ownedResourceHandler).
-		Complete(reconciler.NewStandardReconcilerWithFinalizer[*v1alpha1.ZTunnel](r.Client, r.Reconcile, r.Finalize, constants.FinalizerName))
+		Complete(reconciler.NewStandardReconcilerWithFinalizer[*v1.ZTunnel](r.Client, r.Reconcile, r.Finalize, constants.FinalizerName))
 }
 
-func (r *Reconciler) determineStatus(ctx context.Context, ztunnel *v1alpha1.ZTunnel, reconcileErr error) (v1alpha1.ZTunnelStatus, error) {
+func (r *Reconciler) determineStatus(ctx context.Context, ztunnel *v1.ZTunnel, reconcileErr error) (v1.ZTunnelStatus, error) {
 	var errs errlist.Builder
 	reconciledCondition := r.determineReconciledCondition(reconcileErr)
 	readyCondition, err := r.determineReadyCondition(ctx, ztunnel)
@@ -269,7 +272,7 @@ func (r *Reconciler) determineStatus(ctx context.Context, ztunnel *v1alpha1.ZTun
 	return status, errs.Error()
 }
 
-func (r *Reconciler) updateStatus(ctx context.Context, ztunnel *v1alpha1.ZTunnel, reconcileErr error) error {
+func (r *Reconciler) updateStatus(ctx context.Context, ztunnel *v1.ZTunnel, reconcileErr error) error {
 	var errs errlist.Builder
 
 	status, err := r.determineStatus(ctx, ztunnel, reconcileErr)
@@ -285,58 +288,58 @@ func (r *Reconciler) updateStatus(ctx context.Context, ztunnel *v1alpha1.ZTunnel
 	return errs.Error()
 }
 
-func deriveState(reconciledCondition, readyCondition v1alpha1.ZTunnelCondition) v1alpha1.ZTunnelConditionReason {
+func deriveState(reconciledCondition, readyCondition v1.ZTunnelCondition) v1.ZTunnelConditionReason {
 	if reconciledCondition.Status != metav1.ConditionTrue {
 		return reconciledCondition.Reason
 	} else if readyCondition.Status != metav1.ConditionTrue {
 		return readyCondition.Reason
 	}
-	return v1alpha1.ZTunnelReasonHealthy
+	return v1.ZTunnelReasonHealthy
 }
 
-func (r *Reconciler) determineReconciledCondition(err error) v1alpha1.ZTunnelCondition {
-	c := v1alpha1.ZTunnelCondition{Type: v1alpha1.ZTunnelConditionReconciled}
+func (r *Reconciler) determineReconciledCondition(err error) v1.ZTunnelCondition {
+	c := v1.ZTunnelCondition{Type: v1.ZTunnelConditionReconciled}
 
 	if err == nil {
 		c.Status = metav1.ConditionTrue
 	} else {
 		c.Status = metav1.ConditionFalse
-		c.Reason = v1alpha1.ZTunnelReasonReconcileError
+		c.Reason = v1.ZTunnelReasonReconcileError
 		c.Message = fmt.Sprintf("error reconciling resource: %v", err)
 	}
 	return c
 }
 
-func (r *Reconciler) determineReadyCondition(ctx context.Context, ztunnel *v1alpha1.ZTunnel) (v1alpha1.ZTunnelCondition, error) {
-	c := v1alpha1.ZTunnelCondition{
-		Type:   v1alpha1.ZTunnelConditionReady,
+func (r *Reconciler) determineReadyCondition(ctx context.Context, ztunnel *v1.ZTunnel) (v1.ZTunnelCondition, error) {
+	c := v1.ZTunnelCondition{
+		Type:   v1.ZTunnelConditionReady,
 		Status: metav1.ConditionFalse,
 	}
 
 	ds := appsv1.DaemonSet{}
 	if err := r.Client.Get(ctx, r.getDaemonSetKey(ztunnel), &ds); err == nil {
 		if ds.Status.CurrentNumberScheduled == 0 {
-			c.Reason = v1alpha1.ZTunnelDaemonSetNotReady
+			c.Reason = v1.ZTunnelDaemonSetNotReady
 			c.Message = "no ztunnel pods are currently scheduled"
 		} else if ds.Status.NumberReady < ds.Status.CurrentNumberScheduled {
-			c.Reason = v1alpha1.ZTunnelDaemonSetNotReady
+			c.Reason = v1.ZTunnelDaemonSetNotReady
 			c.Message = "not all ztunnel pods are ready"
 		} else {
 			c.Status = metav1.ConditionTrue
 		}
 	} else if apierrors.IsNotFound(err) {
-		c.Reason = v1alpha1.ZTunnelDaemonSetNotReady
+		c.Reason = v1.ZTunnelDaemonSetNotReady
 		c.Message = "ztunnel DaemonSet not found"
 	} else {
 		c.Status = metav1.ConditionUnknown
-		c.Reason = v1alpha1.ZTunnelReasonReadinessCheckFailed
+		c.Reason = v1.ZTunnelReasonReadinessCheckFailed
 		c.Message = fmt.Sprintf("failed to get readiness: %v", err)
 		return c, fmt.Errorf("get failed: %w", err)
 	}
 	return c, nil
 }
 
-func (r *Reconciler) getDaemonSetKey(ztunnel *v1alpha1.ZTunnel) client.ObjectKey {
+func (r *Reconciler) getDaemonSetKey(ztunnel *v1.ZTunnel) client.ObjectKey {
 	return client.ObjectKey{
 		Namespace: ztunnel.Spec.Namespace,
 		Name:      "ztunnel",
@@ -347,7 +350,7 @@ func (r *Reconciler) mapNamespaceToReconcileRequest(ctx context.Context, ns clie
 	log := logf.FromContext(ctx)
 
 	// Check if any ZTunnel references this namespace in .spec.namespace
-	ztunnelList := v1alpha1.ZTunnelList{}
+	ztunnelList := v1.ZTunnelList{}
 	if err := r.Client.List(ctx, &ztunnelList); err != nil {
 		log.Error(err, "failed to list ZTunnels")
 		return nil
@@ -363,5 +366,5 @@ func (r *Reconciler) mapNamespaceToReconcileRequest(ctx context.Context, ns clie
 }
 
 func wrapEventHandler(logger logr.Logger, handler handler.EventHandler) handler.EventHandler {
-	return enqueuelogger.WrapIfNecessary(v1alpha1.ZTunnelKind, logger, handler)
+	return enqueuelogger.WrapIfNecessary(v1.ZTunnelKind, logger, handler)
 }
diff --git a/controllers/ztunnel/ztunnel_controller_test.go b/controllers/ztunnel/ztunnel_controller_test.go
index a28fea8be..8a519e05a 100644
--- a/controllers/ztunnel/ztunnel_controller_test.go
+++ b/controllers/ztunnel/ztunnel_controller_test.go
@@ -22,7 +22,6 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	v1 "github.com/istio-ecosystem/sail-operator/api/v1"
-	"github.com/istio-ecosystem/sail-operator/api/v1alpha1"
 	"github.com/istio-ecosystem/sail-operator/pkg/config"
 	"github.com/istio-ecosystem/sail-operator/pkg/istioversion"
 	"github.com/istio-ecosystem/sail-operator/pkg/scheme"
@@ -52,17 +51,17 @@ func TestValidate(t *testing.T) {
 
 	testCases := []struct {
 		name      string
-		ztunnel   *v1alpha1.ZTunnel
+		ztunnel   *v1.ZTunnel
 		objects   []client.Object
 		expectErr string
 	}{
 		{
 			name: "success",
-			ztunnel: &v1alpha1.ZTunnel{
+			ztunnel: &v1.ZTunnel{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "default",
 				},
-				Spec: v1alpha1.ZTunnelSpec{
+				Spec: v1.ZTunnelSpec{
 					Version:   istioversion.Default,
 					Namespace: ztunnelNamespace,
 				},
@@ -72,11 +71,11 @@ func TestValidate(t *testing.T) {
 		},
 		{
 			name: "no version",
-			ztunnel: &v1alpha1.ZTunnel{
+			ztunnel: &v1.ZTunnel{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "default",
 				},
-				Spec: v1alpha1.ZTunnelSpec{
+				Spec: v1.ZTunnelSpec{
 					Namespace: ztunnelNamespace,
 				},
 			},
@@ -85,11 +84,11 @@ func TestValidate(t *testing.T) {
 		},
 		{
 			name: "no namespace",
-			ztunnel: &v1alpha1.ZTunnel{
+			ztunnel: &v1.ZTunnel{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "default",
 				},
-				Spec: v1alpha1.ZTunnelSpec{
+				Spec: v1.ZTunnelSpec{
 					Version: istioversion.Default,
 				},
 			},
@@ -98,11 +97,11 @@ func TestValidate(t *testing.T) {
 		},
 		{
 			name: "namespace not found",
-			ztunnel: &v1alpha1.ZTunnel{
+			ztunnel: &v1.ZTunnel{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "default",
 				},
-				Spec: v1alpha1.ZTunnelSpec{
+				Spec: v1.ZTunnelSpec{
 					Version:   istioversion.Default,
 					Namespace: ztunnelNamespace,
 				},
@@ -112,11 +111,11 @@ func TestValidate(t *testing.T) {
 		},
 		{
 			name: "namespace is being deleted",
-			ztunnel: &v1alpha1.ZTunnel{
+			ztunnel: &v1.ZTunnel{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "default",
 				},
-				Spec: v1alpha1.ZTunnelSpec{
+				Spec: v1.ZTunnelSpec{
 					Version:   istioversion.Default,
 					Namespace: ztunnelNamespace,
 				},
@@ -155,39 +154,39 @@ func TestValidate(t *testing.T) {
 func TestDeriveState(t *testing.T) {
 	testCases := []struct {
 		name                string
-		reconciledCondition v1alpha1.ZTunnelCondition
-		readyCondition      v1alpha1.ZTunnelCondition
-		expectedState       v1alpha1.ZTunnelConditionReason
+		reconciledCondition v1.ZTunnelCondition
+		readyCondition      v1.ZTunnelCondition
+		expectedState       v1.ZTunnelConditionReason
 	}{
 		{
 			name:                "healthy",
-			reconciledCondition: newCondition(v1alpha1.ZTunnelConditionReconciled, metav1.ConditionTrue, ""),
-			readyCondition:      newCondition(v1alpha1.ZTunnelConditionReady, metav1.ConditionTrue, ""),
-			expectedState:       v1alpha1.ZTunnelReasonHealthy,
+			reconciledCondition: newCondition(v1.ZTunnelConditionReconciled, metav1.ConditionTrue, ""),
+			readyCondition:      newCondition(v1.ZTunnelConditionReady, metav1.ConditionTrue, ""),
+			expectedState:       v1.ZTunnelReasonHealthy,
 		},
 		{
 			name:                "not reconciled",
-			reconciledCondition: newCondition(v1alpha1.ZTunnelConditionReconciled, metav1.ConditionFalse, v1alpha1.ZTunnelReasonReconcileError),
-			readyCondition:      newCondition(v1alpha1.ZTunnelConditionReady, metav1.ConditionTrue, ""),
-			expectedState:       v1alpha1.ZTunnelReasonReconcileError,
+			reconciledCondition: newCondition(v1.ZTunnelConditionReconciled, metav1.ConditionFalse, v1.ZTunnelReasonReconcileError),
+			readyCondition:      newCondition(v1.ZTunnelConditionReady, metav1.ConditionTrue, ""),
+			expectedState:       v1.ZTunnelReasonReconcileError,
 		},
 		{
 			name:                "not ready",
-			reconciledCondition: newCondition(v1alpha1.ZTunnelConditionReconciled, metav1.ConditionTrue, ""),
-			readyCondition:      newCondition(v1alpha1.ZTunnelConditionReady, metav1.ConditionFalse, v1alpha1.ZTunnelDaemonSetNotReady),
-			expectedState:       v1alpha1.ZTunnelDaemonSetNotReady,
+			reconciledCondition: newCondition(v1.ZTunnelConditionReconciled, metav1.ConditionTrue, ""),
+			readyCondition:      newCondition(v1.ZTunnelConditionReady, metav1.ConditionFalse, v1.ZTunnelDaemonSetNotReady),
+			expectedState:       v1.ZTunnelDaemonSetNotReady,
 		},
 		{
 			name:                "readiness unknown",
-			reconciledCondition: newCondition(v1alpha1.ZTunnelConditionReconciled, metav1.ConditionTrue, ""),
-			readyCondition:      newCondition(v1alpha1.ZTunnelConditionReady, metav1.ConditionUnknown, v1alpha1.ZTunnelReasonReadinessCheckFailed),
-			expectedState:       v1alpha1.ZTunnelReasonReadinessCheckFailed,
+			reconciledCondition: newCondition(v1.ZTunnelConditionReconciled, metav1.ConditionTrue, ""),
+			readyCondition:      newCondition(v1.ZTunnelConditionReady, metav1.ConditionUnknown, v1.ZTunnelReasonReadinessCheckFailed),
+			expectedState:       v1.ZTunnelReasonReadinessCheckFailed,
 		},
 		{
 			name:                "not reconciled nor ready",
-			reconciledCondition: newCondition(v1alpha1.ZTunnelConditionReconciled, metav1.ConditionFalse, v1alpha1.ZTunnelReasonReconcileError),
-			readyCondition:      newCondition(v1alpha1.ZTunnelConditionReady, metav1.ConditionFalse, v1alpha1.ZTunnelDaemonSetNotReady),
-			expectedState:       v1alpha1.ZTunnelReasonReconcileError, // reconcile reason takes precedence over ready reason
+			reconciledCondition: newCondition(v1.ZTunnelConditionReconciled, metav1.ConditionFalse, v1.ZTunnelReasonReconcileError),
+			readyCondition:      newCondition(v1.ZTunnelConditionReady, metav1.ConditionFalse, v1.ZTunnelDaemonSetNotReady),
+			expectedState:       v1.ZTunnelReasonReconcileError, // reconcile reason takes precedence over ready reason
 		},
 	}
 
@@ -200,8 +199,8 @@ func TestDeriveState(t *testing.T) {
 	}
 }
 
-func newCondition(condType v1alpha1.ZTunnelConditionType, status metav1.ConditionStatus, reason v1alpha1.ZTunnelConditionReason) v1alpha1.ZTunnelCondition {
-	return v1alpha1.ZTunnelCondition{
+func newCondition(condType v1.ZTunnelConditionType, status metav1.ConditionStatus, reason v1.ZTunnelConditionReason) v1.ZTunnelCondition {
+	return v1.ZTunnelCondition{
 		Type:   condType,
 		Status: status,
 		Reason: reason,
@@ -215,7 +214,7 @@ func TestDetermineReadyCondition(t *testing.T) {
 		name          string
 		clientObjects []client.Object
 		interceptors  interceptor.Funcs
-		expected      v1alpha1.ZTunnelCondition
+		expected      v1.ZTunnelCondition
 		expectErr     bool
 	}{
 		{
@@ -232,8 +231,8 @@ func TestDetermineReadyCondition(t *testing.T) {
 					},
 				},
 			},
-			expected: v1alpha1.ZTunnelCondition{
-				Type:   v1alpha1.ZTunnelConditionReady,
+			expected: v1.ZTunnelCondition{
+				Type:   v1.ZTunnelConditionReady,
 				Status: metav1.ConditionTrue,
 			},
 		},
@@ -251,10 +250,10 @@ func TestDetermineReadyCondition(t *testing.T) {
 					},
 				},
 			},
-			expected: v1alpha1.ZTunnelCondition{
-				Type:    v1alpha1.ZTunnelConditionReady,
+			expected: v1.ZTunnelCondition{
+				Type:    v1.ZTunnelConditionReady,
 				Status:  metav1.ConditionFalse,
-				Reason:  v1alpha1.ZTunnelDaemonSetNotReady,
+				Reason:  v1.ZTunnelDaemonSetNotReady,
 				Message: "not all ztunnel pods are ready",
 			},
 		},
@@ -272,20 +271,20 @@ func TestDetermineReadyCondition(t *testing.T) {
 					},
 				},
 			},
-			expected: v1alpha1.ZTunnelCondition{
-				Type:    v1alpha1.ZTunnelConditionReady,
+			expected: v1.ZTunnelCondition{
+				Type:    v1.ZTunnelConditionReady,
 				Status:  metav1.ConditionFalse,
-				Reason:  v1alpha1.ZTunnelDaemonSetNotReady,
+				Reason:  v1.ZTunnelDaemonSetNotReady,
 				Message: "no ztunnel pods are currently scheduled",
 			},
 		},
 		{
 			name:          "ZTunnel daemonSet not found",
 			clientObjects: []client.Object{},
-			expected: v1alpha1.ZTunnelCondition{
-				Type:    v1alpha1.ZTunnelConditionReady,
+			expected: v1.ZTunnelCondition{
+				Type:    v1.ZTunnelConditionReady,
 				Status:  metav1.ConditionFalse,
-				Reason:  v1alpha1.ZTunnelDaemonSetNotReady,
+				Reason:  v1.ZTunnelDaemonSetNotReady,
 				Message: "ztunnel DaemonSet not found",
 			},
 		},
@@ -297,10 +296,10 @@ func TestDetermineReadyCondition(t *testing.T) {
 					return fmt.Errorf("simulated error")
 				},
 			},
-			expected: v1alpha1.ZTunnelCondition{
-				Type:    v1alpha1.ZTunnelConditionReady,
+			expected: v1.ZTunnelCondition{
+				Type:    v1.ZTunnelConditionReady,
 				Status:  metav1.ConditionUnknown,
-				Reason:  v1alpha1.ZTunnelReasonReadinessCheckFailed,
+				Reason:  v1.ZTunnelReasonReadinessCheckFailed,
 				Message: "failed to get readiness: simulated error",
 			},
 			expectErr: true,
@@ -315,11 +314,11 @@ func TestDetermineReadyCondition(t *testing.T) {
 
 			r := NewReconciler(cfg, cl, scheme.Scheme, nil)
 
-			ztunnel := &v1alpha1.ZTunnel{
+			ztunnel := &v1.ZTunnel{
 				ObjectMeta: metav1.ObjectMeta{
 					Name: "ztunnel",
 				},
-				Spec: v1alpha1.ZTunnelSpec{
+				Spec: v1.ZTunnelSpec{
 					Namespace: ztunnelNamespace,
 				},
 			}
@@ -342,7 +341,7 @@ func TestApplyImageDigests(t *testing.T) {
 	testCases := []struct {
 		name         string
 		config       config.OperatorConfig
-		input        *v1alpha1.ZTunnel
+		input        *v1.ZTunnel
 		expectValues *v1.ZTunnelValues
 	}{
 		{
@@ -350,8 +349,8 @@ func TestApplyImageDigests(t *testing.T) {
 			config: config.OperatorConfig{
 				ImageDigests: map[string]config.IstioImageConfig{},
 			},
-			input: &v1alpha1.ZTunnel{
-				Spec: v1alpha1.ZTunnelSpec{
+			input: &v1.ZTunnel{
+				Spec: v1.ZTunnelSpec{
 					Version: "v1.24.0",
 					Values: &v1.ZTunnelValues{
 						ZTunnel: &v1.ZTunnelConfig{
@@ -375,8 +374,8 @@ func TestApplyImageDigests(t *testing.T) {
 					},
 				},
 			},
-			input: &v1alpha1.ZTunnel{
-				Spec: v1alpha1.ZTunnelSpec{
+			input: &v1.ZTunnel{
+				Spec: v1.ZTunnelSpec{
 					Version: "v1.24.0",
 					Values:  &v1.ZTunnelValues{},
 				},
@@ -396,8 +395,8 @@ func TestApplyImageDigests(t *testing.T) {
 					},
 				},
 			},
-			input: &v1alpha1.ZTunnel{
-				Spec: v1alpha1.ZTunnelSpec{
+			input: &v1.ZTunnel{
+				Spec: v1.ZTunnelSpec{
 					Version: "v1.24.0",
 					Values: &v1.ZTunnelValues{
 						ZTunnel: &v1.ZTunnelConfig{
@@ -421,8 +420,8 @@ func TestApplyImageDigests(t *testing.T) {
 					},
 				},
 			},
-			input: &v1alpha1.ZTunnel{
-				Spec: v1alpha1.ZTunnelSpec{
+			input: &v1.ZTunnel{
+				Spec: v1.ZTunnelSpec{
 					Version: "v1.24.0",
 					Values: &v1.ZTunnelValues{
 						ZTunnel: &v1.ZTunnelConfig{
@@ -448,8 +447,8 @@ func TestApplyImageDigests(t *testing.T) {
 					},
 				},
 			},
-			input: &v1alpha1.ZTunnel{
-				Spec: v1alpha1.ZTunnelSpec{
+			input: &v1.ZTunnel{
+				Spec: v1.ZTunnelSpec{
 					Version: "v1.24.0",
 					Values: &v1.ZTunnelValues{
 						Global: &v1.ZTunnelGlobalConfig{
@@ -473,8 +472,8 @@ func TestApplyImageDigests(t *testing.T) {
 					},
 				},
 			},
-			input: &v1alpha1.ZTunnel{
-				Spec: v1alpha1.ZTunnelSpec{
+			input: &v1.ZTunnel{
+				Spec: v1.ZTunnelSpec{
 					Version: "v1.24.0",
 					Values: &v1.ZTunnelValues{
 						Global: &v1.ZTunnelGlobalConfig{
@@ -498,8 +497,8 @@ func TestApplyImageDigests(t *testing.T) {
 					},
 				},
 			},
-			input: &v1alpha1.ZTunnel{
-				Spec: v1alpha1.ZTunnelSpec{
+			input: &v1.ZTunnel{
+				Spec: v1.ZTunnelSpec{
 					Version: "v1.24.1",
 					Values: &v1.ZTunnelValues{
 						ZTunnel: &v1.ZTunnelConfig{
@@ -552,7 +551,7 @@ func TestDetermineStatus(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			g := NewWithT(t)
 
-			ztunnel := &v1alpha1.ZTunnel{
+			ztunnel := &v1.ZTunnel{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:       "ztunnel",
 					Generation: 123,
@@ -569,13 +568,13 @@ func TestDetermineStatus(t *testing.T) {
 			g.Expect(err).ToNot(HaveOccurred())
 
 			g.Expect(status.State).To(Equal(deriveState(reconciledCondition, readyCondition)))
-			g.Expect(normalize(status.GetCondition(v1alpha1.ZTunnelConditionReconciled))).To(Equal(normalize(reconciledCondition)))
-			g.Expect(normalize(status.GetCondition(v1alpha1.ZTunnelConditionReady))).To(Equal(normalize(readyCondition)))
+			g.Expect(normalize(status.GetCondition(v1.ZTunnelConditionReconciled))).To(Equal(normalize(reconciledCondition)))
+			g.Expect(normalize(status.GetCondition(v1.ZTunnelConditionReady))).To(Equal(normalize(readyCondition)))
 		})
 	}
 }
 
-func normalize(condition v1alpha1.ZTunnelCondition) v1alpha1.ZTunnelCondition {
+func normalize(condition v1.ZTunnelCondition) v1.ZTunnelCondition {
 	condition.LastTransitionTime = metav1.Time{}
 	return condition
 }
diff --git a/docs/README.adoc b/docs/README.adoc
index 1f6d797df..fe9696487 100644
--- a/docs/README.adoc
+++ b/docs/README.adoc
@@ -77,6 +77,10 @@ link:../[Return to Project Root]
 ** link:common/istio-ambient-waypoint.adoc#layer-7-features-in-ambient-mode[Layer 7 Features in Ambient Mode]
 ** link:common/istio-ambient-waypoint.adoc#troubleshoot-issues[Troubleshoot issues]
 ** link:common/istio-ambient-waypoint.adoc#cleanup[Cleanup]
+* link:common/coexistence.adoc#coexistence-of-ambient-and-sidecar-mode[Coexistence of Ambient and sidecar mode]
+** link:common/coexistence.adoc#requirements-for-coexistence[Requirements]
+** link:common/coexistence.adoc#supported-use-cases-in-coexistence-mode[Supported use-cases]
+** link:common/coexistence.adoc#limitations-and-unsupported-use-cases[Limitations and gaps]
 * link:addons/addons.adoc#addons[Addons]
 ** link:addons/addons.adoc#deploy-prometheus-and-jaeger-addons[Deploy Prometheus and Jaeger addons]
 ** link:addons/addons.adoc#deploy-kiali-addon[Deploy Kiali addon]
@@ -174,7 +178,7 @@ As you can see in the YAML above, `IstioRevisionTag` really only has one field i
 [#istiocni-resource]
 === IstioCNI resource
 
-The lifecycle of Istio's CNI plugin is managed separately when using Sail Operator. To install it, you can create an `IstioCNI` resource. The `IstioCNI` resource is a cluster-wide resource as it will install a `DaemonSet` that will be operating on all nodes of your cluster.
+The lifecycle of Istio's CNI plugin is managed separately when using Sail Operator. To install it, you can create an `IstioCNI` resource. The `IstioCNI` resource is a cluster-wide resource as it will install a `DaemonSet` that will be operating on all nodes of your cluster. The `metadata.name` field must be set to `default`, as enforced by a CRD validation rule that guarantees only one `IstioCNI` custom resource exists cluster-wide.
 
 [source,yaml]
 ----
@@ -315,4 +319,8 @@ The Sail Operator uses InUse detection to determine whether an object is referen
 [#api-reference-documentation]
 == API Reference documentation
 
-The Sail Operator API reference documentation can be found link:api-reference/sailoperator.io.adoc#api-reference[here].
\ No newline at end of file
+The Sail Operator API reference documentation can be found link:api-reference/sailoperator.io.adoc#api-reference[here].
+
+== AI Agents Guide
+
+For developers using AI coding assistants (Claude, GitHub Copilot, Cursor, etc.), see the link:ai/ai-agents-guide.adoc[AI Agents Guide] for information on how to configure and use the Sail Operator's AI agent context files.
\ No newline at end of file
diff --git a/docs/addons/addons.adoc b/docs/addons/addons.adoc
index 3b0ccb46e..13d1e2051 100644
--- a/docs/addons/addons.adoc
+++ b/docs/addons/addons.adoc
@@ -1,9 +1,9 @@
 // Variables embedded for GitHub compatibility
-:istio_latest_version: 1.26.3
-:istio_latest_version_revision_format: 1-26-3
-:istio_latest_tag: v1.26-latest
-:istio_latest_minus_one_version: 1.26.2
-:istio_latest_minus_one_version_revision_format: 1-26-2
+:istio_latest_version: 1.28.0
+:istio_latest_version_revision_format: 1-28-0
+:istio_latest_tag: v1.28-latest
+:istio_latest_minus_one_version: 1.27.3
+:istio_latest_minus_one_version_revision_format: 1-27-3
 
 link:../README.adoc[Return to Project Root]
 
diff --git a/docs/addons/observability.adoc b/docs/addons/observability.adoc
index 2d88de0b4..94061d23a 100644
--- a/docs/addons/observability.adoc
+++ b/docs/addons/observability.adoc
@@ -1,9 +1,9 @@
 // Variables embedded for GitHub compatibility
-:istio_latest_version: 1.26.3
-:istio_latest_version_revision_format: 1-26-3
-:istio_latest_tag: v1.26-latest
-:istio_latest_minus_one_version: 1.26.2
-:istio_latest_minus_one_version_revision_format: 1-26-2
+:istio_latest_version: 1.28.0
+:istio_latest_version_revision_format: 1-28-0
+:istio_latest_tag: v1.28-latest
+:istio_latest_minus_one_version: 1.27.3
+:istio_latest_minus_one_version_revision_format: 1-27-3
 
 link:../README.adoc[Return to Project Root]
 
@@ -30,65 +30,66 @@ The easiest way to get started with production-grade metrics collection is to us
 
 . Create a ServiceMonitor for istiod.
 
-    [source,yaml]
-    ----
-    apiVersion: monitoring.coreos.com/v1
-    kind: ServiceMonitor
-    metadata:
-      name: istiod-monitor
-      namespace: istio-system 
-    spec:
-      targetLabels:
-      - app
-      selector:
-        matchLabels:
-          istio: pilot
-      endpoints:
-      - port: http-monitoring
-        interval: 30s
-    ----
+[source,yaml]
+----
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: istiod-monitor
+  namespace: istio-system 
+spec:
+  targetLabels:
+  - app
+  selector:
+    matchLabels:
+      istio: pilot
+  endpoints:
+  - port: http-monitoring
+    interval: 30s
+----
+
 . Create a PodMonitor to scrape metrics from the istio-proxy containers. Note that *this resource has to be created in all namespaces where you are running sidecars*.
 
-    [source,yaml]
-    ----
-    apiVersion: monitoring.coreos.com/v1
-    kind: PodMonitor
-    metadata:
-      name: istio-proxies-monitor
-      namespace: istio-system 
-    spec:
-      selector:
-        matchExpressions:
-        - key: istio-prometheus-ignore
-          operator: DoesNotExist
-      podMetricsEndpoints:
-      - path: /stats/prometheus
-        interval: 30s
-        relabelings:
-        - action: keep
-          sourceLabels: ["__meta_kubernetes_pod_container_name"]
-          regex: "istio-proxy"
-        - action: keep
-          sourceLabels: ["__meta_kubernetes_pod_annotationpresent_prometheus_io_scrape"]
-        - action: replace
-          regex: (\d+);(([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4})
-          replacement: "[$2]:$1"
-          sourceLabels: ["__meta_kubernetes_pod_annotation_prometheus_io_port","__meta_kubernetes_pod_ip"]
-          targetLabel: "__address__"
-        - action: replace
-          regex: (\d+);((([0-9]+?)(\.|$)){4})
-          replacement: "$2:$1"
-          sourceLabels: ["__meta_kubernetes_pod_annotation_prometheus_io_port","__meta_kubernetes_pod_ip"]
-          targetLabel: "__address__"
-        - action: labeldrop
-          regex: "__meta_kubernetes_pod_label_(.+)"
-        - sourceLabels: ["__meta_kubernetes_namespace"]
-          action: replace
-          targetLabel: namespace
-        - sourceLabels: ["__meta_kubernetes_pod_name"]
-          action: replace
-          targetLabel: pod_name
-    ----
+[source,yaml]
+----
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: istio-proxies-monitor
+  namespace: istio-system 
+spec:
+  selector:
+    matchExpressions:
+    - key: istio-prometheus-ignore
+      operator: DoesNotExist
+  podMetricsEndpoints:
+  - path: /stats/prometheus
+    interval: 30s
+    relabelings:
+    - action: keep
+      sourceLabels: ["__meta_kubernetes_pod_container_name"]
+      regex: "istio-proxy"
+    - action: keep
+      sourceLabels: ["__meta_kubernetes_pod_annotationpresent_prometheus_io_scrape"]
+    - action: replace
+      regex: (\d+);(([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4})
+      replacement: "[$2]:$1"
+      sourceLabels: ["__meta_kubernetes_pod_annotation_prometheus_io_port","__meta_kubernetes_pod_ip"]
+      targetLabel: "__address__"
+    - action: replace
+      regex: (\d+);((([0-9]+?)(\.|$)){4})
+      replacement: "$2:$1"
+      sourceLabels: ["__meta_kubernetes_pod_annotation_prometheus_io_port","__meta_kubernetes_pod_ip"]
+      targetLabel: "__address__"
+    - action: labeldrop
+      regex: "__meta_kubernetes_pod_label_(.+)"
+    - sourceLabels: ["__meta_kubernetes_namespace"]
+      action: replace
+      targetLabel: namespace
+    - sourceLabels: ["__meta_kubernetes_pod_name"]
+      action: replace
+      targetLabel: pod_name
+----
 
 Congratulations! You should now be able to see your control plane and data plane metrics in the OpenShift Console. Just go to Observe -> Metrics and try the query `istio_requests_total`.
 
@@ -97,6 +98,7 @@ Congratulations! You should now be able to see your control plane and data plane
 This section describes how to setup Istio with OpenShift Distributed Tracing to send distributed traces.
 
 *Prerequisites*
+
 * A Tempo stack is installed and configured
 * An instance of an OpenTelemetry collector is already configured in the istio-system namespace
 * An Istio instance is created with the `openshift` profile
@@ -105,37 +107,43 @@ This section describes how to setup Istio with OpenShift Distributed Tracing to
 *Steps*
 
 . Configure Istio to enable tracing and include the OpenTelemetry settings:
-    [source,yaml]
-    ----
-    meshConfig:
-      enableTracing: true
-      extensionProviders:
-      - name: otel-tracing
-        opentelemetry:
-          port: 4317
-          service: otel-collector.istio-system.svc.cluster.local 
-    ----
-The *service* field is the OpenTelemetry collector service in the `istio-system` namespace.
 
+[source,yaml]
+----
+meshConfig:
+  enableTracing: true
+  extensionProviders:
+  - name: otel-tracing
+    opentelemetry:
+      port: 4317
+      service: otel-collector.istio-system.svc.cluster.local 
+----
+
+  The *service* field is the OpenTelemetry collector service in the `istio-system` namespace.
+
+[start=2]
 . Create an Istio telemetry resource to active the OpenTelemetry tracer
-    [source,yaml]
-    ----
-    apiVersion: telemetry.istio.io/v1
-    kind: Telemetry
-    metadata:
-      name: otel-demo
-      namespace: istio-system
-    spec:
-      tracing:
-      - providers:
-          - name: otel-tracing
-            randomSamplingPercentage: 100
-    ----
 
+[source,yaml]
+----
+apiVersion: telemetry.istio.io/v1
+kind: Telemetry
+metadata:
+  name: otel-demo
+  namespace: istio-system
+spec:
+  tracing:
+  - providers:
+      - name: otel-tracing
+        randomSamplingPercentage: 100
+----
+
+[start=3]
 . Validate the integration: Generate some traffic
 
 We can link:addons.adoc#deploy-gateway-and-bookinfo[Deploy Bookinfo] and generate some traffic.
 
+[start=4]
 . Validate the integration: See the traces in the UI
 
 [source,bash,subs="attributes+"]
@@ -154,6 +162,7 @@ Integration with Kiali really depends on how you collect your metrics and traces
 If you followed <<scraping-metrics-using-the-openshift-monitoring-stack>>, you can set up Kiali to retrieve metrics from there.
 
 *Prerequisites*
+
 * User Workload monitoring is link:https://docs.openshift.com/container-platform/latest/observability/monitoring/enabling-monitoring-for-user-defined-projects.html[enabled] and <<scraping-metrics-using-the-openshift-monitoring-stack,configured>>
 * Kiali Operator is installed
 
@@ -161,86 +170,93 @@ If you followed <<scraping-metrics-using-the-openshift-monitoring-stack>>, you c
 
 . Create a ClusterRoleBinding for Kiali, so it can view metrics from user-workload monitoring
 
-    [source,yaml]
-    ----
-    apiVersion: rbac.authorization.k8s.io/v1
-    kind: ClusterRoleBinding
-    metadata:
-      name: kiali-monitoring-rbac
-    roleRef:
-      apiGroup: rbac.authorization.k8s.io
-      kind: ClusterRole
-      name: cluster-monitoring-view
-    subjects:
-    - kind: ServiceAccount
-      name: kiali-service-account
-      namespace: istio-system
-    ----
+[source,yaml]
+----
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kiali-monitoring-rbac
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-monitoring-view
+subjects:
+- kind: ServiceAccount
+  name: kiali-service-account
+  namespace: istio-system
+----
+
+[start=2]
 . Find out the revision name of your Istio instance. In our case it is `test`.
     
-    [source,console,subs="attributes+"]
-    ----
-    kubectl get istiorevisions.sailoperator.io
-    NAME   READY   STATUS    IN USE   VERSION   AGE
-    test   True    Healthy   True     v{istio_latest_version}  119m
-    ----
+[source,console,subs="attributes+"]
+----
+kubectl get istiorevisions.sailoperator.io
+NAME   READY   STATUS    IN USE   VERSION   AGE
+test   True    Healthy   True     v{istio_latest_version}  119m
+----
+
+[start=3]
 . Create a Kiali resource and point it to your Istio instance. Make sure to replace `test` with your revision name in the fields `config_map_name`, `istio_sidecar_injector_config_map_name`, `istiod_deployment_name` and `url_service_version`.
 
-    [source,yaml]
-    ----
-    apiVersion: kiali.io/v1alpha1
-    kind: Kiali
-    metadata:
-      name: kiali-user-workload-monitoring
-      namespace: istio-system
-    spec:
-      external_services:
-        istio:
-          config_map_name: istio-test
-          istio_sidecar_injector_config_map_name: istio-sidecar-injector-test
-          istiod_deployment_name: istiod-test
-          url_service_version: 'http://istiod-test.istio-system:15014/version'
-        prometheus:
-          auth:
-            type: bearer
-            use_kiali_token: true
-          thanos_proxy:
-            enabled: true
-          url: https://thanos-querier.openshift-monitoring.svc.cluster.local:9091
-    ----
+[source,yaml]
+----
+apiVersion: kiali.io/v1alpha1
+kind: Kiali
+metadata:
+  name: kiali-user-workload-monitoring
+  namespace: istio-system
+spec:
+  external_services:
+    istio:
+      config_map_name: istio-test
+      istio_sidecar_injector_config_map_name: istio-sidecar-injector-test
+      istiod_deployment_name: istiod-test
+      url_service_version: 'http://istiod-test.istio-system:15014/version'
+    prometheus:
+      auth:
+        type: bearer
+        use_kiali_token: true
+      thanos_proxy:
+        enabled: true
+      url: https://thanos-querier.openshift-monitoring.svc.cluster.local:9091
+----
 
 [[integrating-kiali-with-openshift-distributed-tracing]]
 ==== Integrating Kiali with OpenShift Distributed Tracing
 This section describes how to setup Kiali with OpenShift Distributed Tracing to read the distributed traces.
 
 *Prerequisites*
+
 * Istio tracing is <<configure-tracing-with-openshift-distributed-tracing,Configured with OpenShift distributed tracing>>
 
 *Steps*
 
 . Setup Kiali to access traces from the Tempo frontend: 
-    [source,yaml]
-    ----
-    external_services:
-      grafana:
-        enabled: true
-        url: "http://grafana-istio-system.apps-crc.testing/"
-      tracing:
-        enabled: true
-        provider: tempo
-        use_grpc: false
-        in_cluster_url: http://tempo-sample-query-frontend.tempo:3200
-        url: 'https://tempo-sample-query-frontend-tempo.apps-crc.testing'
-        tempo_config:
-          org_id: "1"
-          datasource_uid: "a8d2ef1c-d31c-4de5-a90b-e7bc5252cd00"
-    ----
-
-Where: 
+
+[source,yaml]
+----
+external_services:
+  grafana:
+    enabled: true
+    url: "http://grafana-istio-system.apps-crc.testing/"
+  tracing:
+    enabled: true
+    provider: tempo
+    use_grpc: false
+    in_cluster_url: http://tempo-sample-query-frontend.tempo:3200
+    url: 'https://tempo-sample-query-frontend-tempo.apps-crc.testing'
+    tempo_config:
+      org_id: "1"
+      datasource_uid: "a8d2ef1c-d31c-4de5-a90b-e7bc5252cd00"
+----
+
+Where:
+
 * `external_services.grafana` section: Is just needed to see the "View in Tracing" link from the Traces tab
 * `external_services.tracing.tempo_config`: Is just needed to see the "View in Tracing" link from the Traces tab and redirect to the proper Tempo datasource
 
 Now, we should be able to see traces from Kiali. For this, you can: 
 
 . Select a Workload/Service/App
-. Click in the "Traces" tab
\ No newline at end of file
+. Click in the "Traces" tab
diff --git a/docs/ai/ai-agents-guide.adoc b/docs/ai/ai-agents-guide.adoc
new file mode 100644
index 000000000..7b20ebc7d
--- /dev/null
+++ b/docs/ai/ai-agents-guide.adoc
@@ -0,0 +1,176 @@
+= AI Agents Guide for Sail Operator
+:toc:
+:toc-placement!:
+
+This guide explains how to use the Sail Operator's AI agent configuration files with popular AI coding assistants and tools.
+
+toc::[]
+
+== Overview
+
+The Sail Operator includes comprehensive AI agent configuration files located in `.github/ai_agents/` to help AI coding assistants understand the project structure, patterns, and best practices. These files provide context for better code suggestions, debugging help, and development guidance.
+
+== File Structure
+
+----
+.github/ai_agents/
+├── AGENTS.md                           # Main entry point with project overview
+├── domain_knowledge_prompt.md          # Template for creating new domain knowledge
+└── knowledge/
+    ├── domain-knowledge-api-types.md           # Custom Resource Definitions
+    ├── domain-knowledge-controllers.md         # Controller patterns
+    ├── domain-knowledge-helm-integration.md    # Helm chart integration
+    ├── domain-knowledge-testing-framework.md   # Testing methodologies
+    └── domain-knowledge-version-management.md  # Version compatibility
+----
+
+== Using with Different AI Tools
+
+=== Claude (Anthropic)
+
+==== Claude Code (Official CLI)
+Claude Code automatically detects and uses the AGENTS.md file:
+
+1. **Automatic Detection**: Claude Code will automatically find and use `.github/ai_agents/AGENTS.md`
+2. **Domain Knowledge**: References to domain knowledge files are automatically followed
+3. **Context Awareness**: The AI understands Sail Operator patterns and conventions
+
+==== Claude Web/API
+For Claude web interface or API usage:
+
+1. **Upload Main File**: Share the contents of `.github/ai_agents/AGENTS.md`
+2. **Reference Domain Knowledge**: When working on specific areas, also share relevant domain knowledge files:
+   ```
+   For API work: share domain-knowledge-api-types.md
+   For controller development: share domain-knowledge-controllers.md
+   For testing: share domain-knowledge-testing-framework.md
+   ```
+3. **Project Context**: Start conversations with: "I'm working on the Sail Operator project. Please refer to the AGENTS.md file I've shared for context."
+
+=== GitHub Copilot
+
+==== GitHub Copilot (VS Code/IDEs)
+GitHub Copilot automatically uses files in the `.github/` directory:
+
+1. **Automatic Context**: Copilot reads `.github/ai_agents/AGENTS.md` automatically
+2. **Enhanced Suggestions**: Code suggestions will be informed by Sail Operator patterns
+3. **Domain Knowledge**: Place cursor in relevant files and Copilot will use appropriate domain knowledge
+
+==== GitHub Copilot Chat
+For chat interactions:
+
+1. **Reference Files**: Use `@workspace` to reference the entire project context
+2. **Specific Knowledge**: Ask "Based on the Sail Operator AGENTS.md, how should I..."
+3. **Domain-Specific Questions**: Reference specific domain knowledge files: "According to the controllers domain knowledge..."
+
+=== Cursor
+
+==== Adding Context Files
+Cursor allows uploading files directly:
+
+1. **Add AGENTS.md**:
+   - Open Cursor settings
+   - Go to "Context Files"
+   - Add `.github/ai_agents/AGENTS.md`
+
+2. **Add Domain Knowledge**:
+   - Add relevant domain knowledge files from `.github/ai_agents/knowledge/`
+   - Recommended: Add all domain knowledge files for comprehensive coverage
+
+3. **Reference in Chat**:
+   ```
+   "I'm working on Sail Operator. Use the AGENTS.md and domain knowledge files for context."
+   ```
+
+==== Using @-mentions
+Reference the files directly in chat:
+
+----
+@AGENTS.md How should I implement a new controller?
+@domain-knowledge-controllers.md What's the reconciliation pattern?
+----
+
+== Best Practices
+
+=== For Developers
+
+1. **Start with AGENTS.md**: Always begin by sharing or referencing the main AGENTS.md file
+2. **Layer Context**: Add domain-specific knowledge files as needed for your task
+3. **Reference Platform**: Mention if you're on macOS/Podman for platform-specific guidance
+4. **Specify Goals**: Be clear about what you're trying to accomplish
+
+Example prompt:
+----
+I'm working on the Sail Operator project (context in AGENTS.md). I need to add a new field to the Istio CRD and update the controller. I'm developing on macOS with Podman. What's the proper approach following our patterns?
+----
+
+=== For AI Tools Configuration
+
+1. **Automatic Tools**: GitHub Copilot and Claude Code work automatically
+2. **Manual Tools**: Upload/reference AGENTS.md and relevant domain knowledge files
+3. **Regular Updates**: Keep AI tools updated with latest versions of these files
+4. **Specific Context**: Use domain knowledge files for focused work
+
+=== Platform-Specific Notes
+
+==== macOS Development
+When working on macOS, mention:
+- Using Podman instead of Docker
+- ARM64 vs AMD64 architecture considerations
+- Reference to `docs/macos/develop-on-macos.adoc`
+
+==== Testing Context
+For testing-related work:
+- Share `domain-knowledge-testing-framework.md`
+- Mention test type (unit/integration/e2e)
+- Specify target platform (KIND/OpenShift)
+
+==== Version Management
+For version-related work:
+- Share `domain-knowledge-version-management.md`
+- Specify Istio version compatibility concerns
+- Mention upgrade scenarios if relevant
+
+== Troubleshooting AI Interactions
+
+=== Common Issues
+
+1. **AI doesn't understand Sail Operator patterns**
+   - Solution: Ensure AGENTS.md is properly shared/referenced
+   - Verify the AI tool has access to the `.github/ai_agents/` directory
+
+2. **Suggestions don't follow project conventions**
+   - Solution: Reference specific domain knowledge files
+   - Explicitly mention: "Follow the patterns described in the AGENTS.md"
+
+3. **Platform-specific issues not addressed**
+   - Solution: Mention your platform (macOS/Podman) explicitly
+   - Reference `docs/macos/develop-on-macos.adoc` for macOS users
+
+4. **Test suggestions don't match framework**
+   - Solution: Share `domain-knowledge-testing-framework.md`
+   - Specify test type and framework (Ginkgo/Gomega)
+
+=== Getting Better Results
+
+1. **Be Specific**: "Following Sail Operator controller patterns in AGENTS.md..."
+2. **Reference Context**: "According to the domain knowledge for..."
+3. **Mention Platform**: "I'm on macOS with Podman..."
+4. **Specify Goals**: "I need to implement a controller that..."
+
+== Contributing to AI Agent Configuration
+
+If you find gaps in the AI agent configuration or want to improve it:
+
+1. **Follow the Template**: Use `.github/ai_agents/domain_knowledge_prompt.md`
+2. **Update Existing Files**: Keep domain knowledge files current
+3. **Add New Domains**: Create new domain knowledge files for new areas
+4. **Test with AI Tools**: Verify your changes work with different AI assistants
+
+For detailed guidelines, see link:.github/ai_agents/domain_knowledge_prompt.md[Domain Knowledge Creation Guide].
+
+== Conclusion
+
+The Sail Operator's AI agent configuration provides comprehensive context for AI coding assistants. By properly configuring and using these files, you'll get better code suggestions, more accurate debugging help, and guidance that follows project patterns and best practices.
+
+For platform-specific development guidance, especially macOS with Podman, see link:../macos/develop-on-macos.adoc[macOS Development Guide].
\ No newline at end of file
diff --git a/docs/api-reference/sailoperator.io.md b/docs/api-reference/sailoperator.io.md
index 7d23ef244..2b3bed6a0 100644
--- a/docs/api-reference/sailoperator.io.md
+++ b/docs/api-reference/sailoperator.io.md
@@ -10,14 +10,16 @@
 package v1 contains API Schema definitions for the sailoperator.io v1 API group
 
 ### Resource Types
-- [Istio](#istio)
-- [IstioCNI](#istiocni)
-- [IstioCNIList](#istiocnilist)
-- [IstioList](#istiolist)
-- [IstioRevision](#istiorevision)
-- [IstioRevisionList](#istiorevisionlist)
-- [IstioRevisionTag](#istiorevisiontag)
-- [IstioRevisionTagList](#istiorevisiontaglist)
+- [Istio](#istio-v1)
+- [IstioCNI](#istiocni-v1)
+- [IstioCNIList](#istiocnilist-v1)
+- [IstioList](#istiolist-v1)
+- [IstioRevision](#istiorevision-v1)
+- [IstioRevisionList](#istiorevisionlist-v1)
+- [IstioRevisionTag](#istiorevisiontag-v1)
+- [IstioRevisionTagList](#istiorevisiontaglist-v1)
+- [ZTunnel](#ztunnel-v1)
+- [ZTunnelList](#ztunnellist-v1)
 
 
 
@@ -448,6 +450,7 @@ _Appears in:_
 | `trustBundleName` _string_ | Select a custom name for istiod's CA Root Cert ConfigMap. |  |  |
 | `nativeNftables` _boolean_ | Specifies whether native nftables rules should be used instead of iptables rules for traffic redirection. |  |  |
 | `networkPolicy` _[NetworkPolicyConfig](#networkpolicyconfig)_ | Settings related to Kubernetes NetworkPolicy. |  |  |
+| `resourceScope` _[ResourceScope](#resourcescope)_ | Specifies resource scope for discovery selectors. This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator. |  | Enum: [undefined all cluster namespace]   |
 
 
 #### GlobalLoggingConfig
@@ -516,7 +519,7 @@ _Appears in:_
 
 
 
-#### Istio
+#### Istio (v1)
 
 
 
@@ -540,11 +543,11 @@ _Appears in:_
 | `kind` _string_ | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  |  |
 | `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  |  |
 | `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
-| `spec` _[IstioSpec](#istiospec)_ |  | \{ namespace:istio-system updateStrategy:map[type:InPlace] version:v1.27.1 \} |  |
+| `spec` _[IstioSpec](#istiospec)_ |  | \{ namespace:istio-system updateStrategy:map[type:InPlace] version:v1.28.0 \} |  |
 | `status` _[IstioStatus](#istiostatus)_ |  |  |  |
 
 
-#### IstioCNI
+#### IstioCNI (v1)
 
 
 
@@ -562,7 +565,7 @@ _Appears in:_
 | `kind` _string_ | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  |  |
 | `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  |  |
 | `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
-| `spec` _[IstioCNISpec](#istiocnispec)_ |  | \{ namespace:istio-cni version:v1.27.1 \} |  |
+| `spec` _[IstioCNISpec](#istiocnispec)_ |  | \{ namespace:istio-cni version:v1.28.0 \} |  |
 | `status` _[IstioCNIStatus](#istiocnistatus)_ |  |  |  |
 
 
@@ -625,7 +628,7 @@ _Appears in:_
 | `Ready` | IstioCNIConditionReady signifies whether the istio-cni-node DaemonSet is ready.  |
 
 
-#### IstioCNIList
+#### IstioCNIList (v1)
 
 
 
@@ -658,7 +661,7 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `version` _string_ | Defines the version of Istio to install. Must be one of: v1.27-latest, v1.27.1, v1.27.0, v1.26-latest, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25-latest, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, master, v1.28-alpha.724e2360. | v1.27.1 | Enum: [v1.27-latest v1.27.1 v1.27.0 v1.26-latest v1.26.4 v1.26.3 v1.26.2 v1.26.0 v1.25-latest v1.25.5 v1.25.4 v1.25.3 v1.25.2 v1.25.1 v1.24-latest v1.24.6 v1.24.5 v1.24.4 v1.24.3 v1.24.2 v1.24.1 v1.24.0 v1.23-latest v1.23.6 v1.23.5 v1.23.4 v1.23.3 v1.23.2 v1.22-latest v1.22.8 v1.22.7 v1.22.6 v1.22.5 v1.21.6 master v1.28-alpha.724e2360]   |
+| `version` _string_ | Defines the version of Istio to install. Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, master, v1.29-alpha.b2f713a9. | v1.28.0 | Enum: [v1.28-latest v1.28.0 v1.27-latest v1.27.3 v1.27.2 v1.27.1 v1.27.0 v1.26-latest v1.26.6 v1.26.5 v1.26.4 v1.26.3 v1.26.2 v1.26.1 v1.26.0 v1.25-latest v1.25.5 v1.25.4 v1.25.3 v1.25.2 v1.25.1 v1.24-latest v1.24.6 v1.24.5 v1.24.4 v1.24.3 v1.24.2 v1.24.1 v1.24.0 v1.23-latest v1.23.6 v1.23.5 v1.23.4 v1.23.3 v1.23.2 v1.22-latest v1.22.8 v1.22.7 v1.22.6 v1.22.5 v1.21.6 master v1.29-alpha.b2f713a9]   |
 | `profile` _string_ | The built-in installation configuration profile to use. The 'default' profile is always applied. On OpenShift, the 'openshift' profile is also applied on top of 'default'. Must be one of: ambient, default, demo, empty, openshift, openshift-ambient, preview, remote, stable. |  | Enum: [ambient default demo empty external openshift openshift-ambient preview remote stable]   |
 | `namespace` _string_ | Namespace to which the Istio CNI component should be installed. Note that this field is immutable. | istio-cni |  |
 | `values` _[CNIValues](#cnivalues)_ | Defines the values to be passed to the Helm charts when installing Istio CNI. |  |  |
@@ -748,7 +751,7 @@ _Appears in:_
 | `DependenciesHealthy` | IstioConditionDependenciesHealthy signifies whether the dependencies required by this Istio are healthy. For example, an Istio with spec.values.pilot.cni.enabled=true requires the IstioCNI resource to be deployed and ready for the Istio revision to be considered healthy. The DependenciesHealthy condition is used to indicate that the IstioCNI resource is healthy.  |
 
 
-#### IstioList
+#### IstioList (v1)
 
 
 
@@ -768,7 +771,7 @@ IstioList contains a list of Istio
 | `items` _[Istio](#istio) array_ |  |  |  |
 
 
-#### IstioRevision
+#### IstioRevision (v1)
 
 
 
@@ -838,6 +841,8 @@ _Appears in:_
 | `UsageCheckFailed` | IstioRevisionReasonUsageCheckFailed indicates that the operator could not check whether any workloads use the revision.  |
 | `IstioCNINotFound` | IstioRevisionReasonIstioCNINotFound indicates that the IstioCNI resource is not found.  |
 | `IstioCNINotHealthy` | IstioRevisionReasonIstioCNINotHealthy indicates that the IstioCNI resource is not healthy.  |
+| `ZTunnelNotFound` | IstioRevisionReasonZTunnelNotFound indicates that the ZTunnel resource is not found.  |
+| `ZTunnelNotHealthy` | IstioRevisionReasonZTunnelNotHealthy indicates that the ZTunnel resource is not healthy.  |
 | `DependencyCheckFailed` | IstioRevisionDependencyCheckFailed indicates that the status of the dependencies could not be ascertained.  |
 | `Healthy` | IstioRevisionReasonHealthy indicates that the control plane is fully reconciled and that all components are ready.  |
 
@@ -862,7 +867,7 @@ _Appears in:_
 | `DependenciesHealthy` | IstioRevisionConditionDependenciesHealthy signifies whether the dependencies required by this IstioRevision are healthy. For example, an IstioRevision with spec.values.pilot.cni.enabled=true requires the IstioCNI resource to be deployed and ready for the Istio revision to be considered healthy. The DependenciesHealthy condition is used to indicate that the IstioCNI resource is healthy.  |
 
 
-#### IstioRevisionList
+#### IstioRevisionList (v1)
 
 
 
@@ -895,7 +900,7 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `version` _string_ | Defines the version of Istio to install. Must be one of: v1.27.1, v1.27.0, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, v1.28-alpha.724e2360. |  | Enum: [v1.27.1 v1.27.0 v1.26.4 v1.26.3 v1.26.2 v1.26.0 v1.25.5 v1.25.4 v1.25.3 v1.25.2 v1.25.1 v1.24.6 v1.24.5 v1.24.4 v1.24.3 v1.24.2 v1.24.1 v1.24.0 v1.23.6 v1.23.5 v1.23.4 v1.23.3 v1.23.2 v1.22.8 v1.22.7 v1.22.6 v1.22.5 v1.21.6 v1.28-alpha.724e2360]   |
+| `version` _string_ | Defines the version of Istio to install. Must be one of: v1.28.0, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, v1.29-alpha.b2f713a9. |  | Enum: [v1.28.0 v1.27.3 v1.27.2 v1.27.1 v1.27.0 v1.26.6 v1.26.5 v1.26.4 v1.26.3 v1.26.2 v1.26.1 v1.26.0 v1.25.5 v1.25.4 v1.25.3 v1.25.2 v1.25.1 v1.24.6 v1.24.5 v1.24.4 v1.24.3 v1.24.2 v1.24.1 v1.24.0 v1.23.6 v1.23.5 v1.23.4 v1.23.3 v1.23.2 v1.22.8 v1.22.7 v1.22.6 v1.22.5 v1.21.6 v1.29-alpha.b2f713a9]   |
 | `namespace` _string_ | Namespace to which the Istio components should be installed. |  |  |
 | `values` _[Values](#values)_ | Defines the values to be passed to the Helm charts when installing Istio. |  |  |
 
@@ -918,7 +923,7 @@ _Appears in:_
 | `state` _[IstioRevisionConditionReason](#istiorevisionconditionreason)_ | Reports the current state of the object. |  |  |
 
 
-#### IstioRevisionTag
+#### IstioRevisionTag (v1)
 
 
 
@@ -1002,7 +1007,7 @@ _Appears in:_
 | `InUse` | IstioRevisionConditionInUse signifies whether any workload is configured to use the revision.  |
 
 
-#### IstioRevisionTagList
+#### IstioRevisionTagList (v1)
 
 
 
@@ -1088,7 +1093,7 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `version` _string_ | Defines the version of Istio to install. Must be one of: v1.27-latest, v1.27.1, v1.27.0, v1.26-latest, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25-latest, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, master, v1.28-alpha.724e2360. | v1.27.1 | Enum: [v1.27-latest v1.27.1 v1.27.0 v1.26-latest v1.26.4 v1.26.3 v1.26.2 v1.26.0 v1.25-latest v1.25.5 v1.25.4 v1.25.3 v1.25.2 v1.25.1 v1.24-latest v1.24.6 v1.24.5 v1.24.4 v1.24.3 v1.24.2 v1.24.1 v1.24.0 v1.23-latest v1.23.6 v1.23.5 v1.23.4 v1.23.3 v1.23.2 v1.22-latest v1.22.8 v1.22.7 v1.22.6 v1.22.5 v1.21.6 master v1.28-alpha.724e2360]   |
+| `version` _string_ | Defines the version of Istio to install. Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, master, v1.29-alpha.b2f713a9. | v1.28.0 | Enum: [v1.28-latest v1.28.0 v1.27-latest v1.27.3 v1.27.2 v1.27.1 v1.27.0 v1.26-latest v1.26.6 v1.26.5 v1.26.4 v1.26.3 v1.26.2 v1.26.1 v1.26.0 v1.25-latest v1.25.5 v1.25.4 v1.25.3 v1.25.2 v1.25.1 v1.24-latest v1.24.6 v1.24.5 v1.24.4 v1.24.3 v1.24.2 v1.24.1 v1.24.0 v1.23-latest v1.23.6 v1.23.5 v1.23.4 v1.23.3 v1.23.2 v1.22-latest v1.22.8 v1.22.7 v1.22.6 v1.22.5 v1.21.6 master v1.29-alpha.b2f713a9]   |
 | `updateStrategy` _[IstioUpdateStrategy](#istioupdatestrategy)_ | Defines the update strategy to use when the version in the Istio CR is updated. | \{ type:InPlace \} |  |
 | `profile` _string_ | The built-in installation configuration profile to use. The 'default' profile is always applied. On OpenShift, the 'openshift' profile is also applied on top of 'default'. Must be one of: ambient, default, demo, empty, openshift, openshift-ambient, preview, remote, stable. |  | Enum: [ambient default demo empty external openshift openshift-ambient preview remote stable]   |
 | `namespace` _string_ | Namespace to which the Istio components should be installed. Note that this field is immutable. | istio-system |  |
@@ -1615,23 +1620,6 @@ _Appears in:_
 
 
 
-#### MeshConfigExtensionProviderHttpHeader
-
-
-
-
-
-
-
-_Appears in:_
-- [MeshConfigExtensionProviderGrpcService](#meshconfigextensionprovidergrpcservice)
-- [MeshConfigExtensionProviderHttpService](#meshconfigextensionproviderhttpservice)
-
-| Field | Description | Default | Validation |
-| --- | --- | --- | --- |
-| `name` _string_ | REQUIRED. The HTTP header name. |  | Required: \{\}   |
-| `value` _string_ | The HTTP header value. |  |  |
-| `envName` _string_ | The HTTP header value from the environment variable.  Warning: - The environment variable must be set in the istiod pod spec. - This is not a end-to-end secure. |  |  |
 
 
 
@@ -1861,6 +1849,8 @@ _Appears in:_
 | `enable64bitTraceId` _boolean_ | Optional. A 128 bit trace id will be used in Istio. If true, will result in a 64 bit trace id being used. |  |  |
 | `path` _string_ | Optional. Specifies the endpoint of Zipkin API. The default value is "/api/v2/spans". |  |  |
 | `traceContextOption` _[MeshConfigExtensionProviderZipkinTracingProviderTraceContextOption](#meshconfigextensionproviderzipkintracingprovidertracecontextoption)_ | Optional. Determines which trace context format to use for trace header extraction and propagation. This controls both downstream request header extraction and upstream request header injection. The default value is USE_B3 to maintain backward compatibility. |  | Enum: [USE_B3 USE_B3_WITH_W3C_PROPAGATION]   |
+| `timeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#duration-v1-meta)_ | Optional. The timeout for the HTTP request to the Zipkin collector. If not specified, the default timeout from Envoy's configuration will be used (which is 5 seconds currently). |  |  |
+| `headers` _[MeshConfigExtensionProviderHttpHeader](#meshconfigextensionproviderhttpheader) array_ | Optional. Additional HTTP headers to include in the request to the Zipkin collector. These headers will be added to the HTTP request when sending spans to the collector. |  |  |
 
 
 #### MeshConfigExtensionProviderZipkinTracingProviderTraceContextOption
@@ -2415,6 +2405,7 @@ _Appears in:_
 | `trustedZtunnelNamespace` _string_ | If set, `istiod` will allow connections from trusted node proxy ztunnels in the provided namespace. |  |  |
 | `istiodRemote` _[IstiodRemoteConfig](#istiodremoteconfig)_ | Configuration for the istio-discovery chart when istiod is running in a remote cluster (e.g. "remote control plane"). |  |  |
 | `envVarFrom` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#envvar-v1-core) array_ | Configuration for the istio-discovery chart |  |  |
+| `crlConfigMapName` _string_ | Select a custom name for istiod's plugged-in CA CRL ConfigMap. |  |  |
 
 
 
@@ -2797,6 +2788,7 @@ Configuration for the resource quotas for the CNI DaemonSet.
 
 _Appears in:_
 - [CNIConfig](#cniconfig)
+- [ZTunnelConfig](#ztunnelconfig)
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
@@ -2804,6 +2796,26 @@ _Appears in:_
 | `pods` _integer_ | The hard limit on the number of pods in the namespace where the CNI DaemonSet is deployed. |  |  |
 
 
+#### ResourceScope
+
+_Underlying type:_ _string_
+
+
+
+_Validation:_
+- Enum: [undefined all cluster namespace]
+
+_Appears in:_
+- [GlobalConfig](#globalconfig)
+
+| Field | Description |
+| --- | --- |
+| `undefined` |  |
+| `all` |  |
+| `cluster` |  |
+| `namespace` |  |
+
+
 
 
 #### RevisionSummary
@@ -3307,6 +3319,87 @@ _Appears in:_
 
 
 
+#### ZTunnel (v1)
+
+
+
+ZTunnel represents a deployment of the Istio ztunnel component.
+
+
+
+_Appears in:_
+- [ZTunnelList](#ztunnellist)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `apiVersion` _string_ | `sailoperator.io/v1` | | |
+| `kind` _string_ | `ZTunnel` | | |
+| `kind` _string_ | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  |  |
+| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  |  |
+| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
+| `spec` _[ZTunnelSpec](#ztunnelspec)_ |  | \{ namespace:ztunnel version:v1.28.0 \} |  |
+| `status` _[ZTunnelStatus](#ztunnelstatus)_ |  |  |  |
+
+
+#### ZTunnelCondition
+
+
+
+ZTunnelCondition represents a specific observation of the ZTunnel object's state.
+
+
+
+_Appears in:_
+- [ZTunnelStatus](#ztunnelstatus)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `type` _[ZTunnelConditionType](#ztunnelconditiontype)_ | The type of this condition. |  |  |
+| `status` _[ConditionStatus](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#conditionstatus-v1-meta)_ | The status of this condition. Can be True, False or Unknown. |  |  |
+| `reason` _[ZTunnelConditionReason](#ztunnelconditionreason)_ | Unique, single-word, CamelCase reason for the condition's last transition. |  |  |
+| `message` _string_ | Human-readable message indicating details about the last transition. |  |  |
+| `lastTransitionTime` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#time-v1-meta)_ | Last time the condition transitioned from one status to another. |  |  |
+
+
+#### ZTunnelConditionReason
+
+_Underlying type:_ _string_
+
+ZTunnelConditionReason represents a short message indicating how the condition came
+to be in its present state.
+
+
+
+_Appears in:_
+- [ZTunnelCondition](#ztunnelcondition)
+- [ZTunnelStatus](#ztunnelstatus)
+
+| Field | Description |
+| --- | --- |
+| `ReconcileError` | ZTunnelReasonReconcileError indicates that the reconciliation of the resource has failed, but will be retried.  |
+| `DaemonSetNotReady` | ZTunnelDaemonSetNotReady indicates that the ztunnel DaemonSet is not ready.  |
+| `ReadinessCheckFailed` | ZTunnelReasonReadinessCheckFailed indicates that the DaemonSet readiness status could not be ascertained.  |
+| `Healthy` | ZTunnelReasonHealthy indicates that the control plane is fully reconciled and that all components are ready.  |
+
+
+#### ZTunnelConditionType
+
+_Underlying type:_ _string_
+
+ZTunnelConditionType represents the type of the condition.  Condition stages are:
+Installed, Reconciled, Ready
+
+
+
+_Appears in:_
+- [ZTunnelCondition](#ztunnelcondition)
+
+| Field | Description |
+| --- | --- |
+| `Reconciled` | ZTunnelConditionReconciled signifies whether the controller has successfully reconciled the resources defined through the CR.  |
+| `Ready` | ZTunnelConditionReady signifies whether the ztunnel DaemonSet is ready.  |
+
+
 #### ZTunnelConfig
 
 
@@ -3324,14 +3417,19 @@ _Appears in:_
 | `tag` _string_ | The container image tag to pull. Image will be `Hub/Image:Tag-Variant`. |  |  |
 | `variant` _string_ | The container image variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version. |  |  |
 | `image` _string_ | Image name to pull from. Image will be `Hub/Image:Tag-Variant`. If Image contains a "/", it will replace the entire `image` in the pod. |  |  |
+| `network` _string_ | defines the network this cluster belong to. This name corresponds to the networks in the map of mesh networks. |  |  |
+| `affinity` _[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#affinity-v1-core)_ | K8s affinity to set on the ztunnel Pods. Can be used to exclude ztunnel from being scheduled on specified nodes. |  |  |
 | `resourceName` _string_ | resourceName, if set, will override the naming of resources. If not set, will default to the release name. It is recommended to not set this; this is primarily for backwards compatibility. |  |  |
 | `Annotations` _object (keys:string, values:string)_ | Annotations to apply to all top level resources |  |  |
 | `Labels` _object (keys:string, values:string)_ | Labels to apply to all top level resources |  |  |
 | `volumeMounts` _[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#volumemount-v1-core) array_ | Additional volumeMounts to the ztunnel container |  |  |
 | `volumes` _[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#volume-v1-core) array_ | Additional volumes to add to the ztunnel Pod. |  |  |
+| `tolerations` _[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#toleration-v1-core) array_ | Tolerations for the ztunnel pod |  |  |
 | `podAnnotations` _object (keys:string, values:string)_ | Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments). |  |  |
 | `podLabels` _object (keys:string, values:string)_ | Additional labels to apply on the pod level. |  |  |
 | `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#resourcerequirements-v1-core)_ | The k8s resource requests and limits for the ztunnel Pods. |  |  |
+| `resourceQuotas` _[ResourceQuotas](#resourcequotas)_ | The resource quotas configuration for ztunnel |  |  |
+| `nodeSelector` _object (keys:string, values:string)_ | K8s node selector settings.  See https://kubernetes.io/docs/user-guide/node-selection/ |  |  |
 | `imagePullSecrets` _string array_ | List of secret names to add to the service account as image pull secrets to use for pulling any images in pods that reference this ServiceAccount. Must be set for any cluster configured with private docker registry. |  |  |
 | `env` _object (keys:string, values:string)_ | A `key: value` mapping of environment variables to add to the pod |  |  |
 | `imagePullPolicy` _[PullPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#pullpolicy-v1-core)_ | Specifies the image pull policy for the Istio images. one of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated.  More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |  | Enum: [Always Never IfNotPresent]   |
@@ -3343,6 +3441,8 @@ _Appears in:_
 | `istioNamespace` _string_ | Specifies the default namespace for the Istio control plane components. |  |  |
 | `logLevel` _string_ | Configuration log level of ztunnel binary, default is info. Valid values are: trace, debug, info, warn, error. | info | Enum: [trace debug info warn error]   |
 | `logAsJson` _boolean_ | Specifies whether istio components should output logs in json format by adding --log_as_json argument to each container. |  |  |
+| `seLinuxOptions` _[SELinuxOptions](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#selinuxoptions-v1-core)_ | Set seLinux options for the ztunnel pod |  |  |
+| `updateStrategy` _[DaemonSetUpdateStrategy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#daemonsetupdatestrategy-v1-apps)_ | Defines the update strategy to use when the version in the Ztunnel CR is updated. |  |  |
 
 
 #### ZTunnelGlobalConfig
@@ -3369,6 +3469,62 @@ _Appears in:_
 | `platform` _string_ | Platform in which Istio is deployed. Possible values are: "openshift" and "gcp" An empty value means it is a vanilla Kubernetes distribution, therefore no special treatment will be considered. |  |  |
 
 
+#### ZTunnelList (v1)
+
+
+
+ZTunnelList contains a list of ZTunnel
+
+
+
+
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `apiVersion` _string_ | `sailoperator.io/v1` | | |
+| `kind` _string_ | `ZTunnelList` | | |
+| `kind` _string_ | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  |  |
+| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  |  |
+| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
+| `items` _[ZTunnel](#ztunnel) array_ |  |  |  |
+
+
+#### ZTunnelSpec
+
+
+
+ZTunnelSpec defines the desired state of ZTunnel
+
+
+
+_Appears in:_
+- [ZTunnel](#ztunnel)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `version` _string_ | Defines the version of Istio to install. Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, v1.25-latest, v1.24-latest, master, v1.29-alpha.b2f713a9. | v1.28.0 | Enum: [v1.28-latest v1.28.0 v1.27-latest v1.27.3 v1.27.2 v1.27.1 v1.27.0 v1.26-latest v1.26.6 v1.26.5 v1.26.4 v1.26.3 v1.26.2 v1.26.1 v1.26.0 v1.25-latest v1.24-latest master v1.29-alpha.b2f713a9]   |
+| `namespace` _string_ | Namespace to which the Istio ztunnel component should be installed. | ztunnel |  |
+| `values` _[ZTunnelValues](#ztunnelvalues)_ | Defines the values to be passed to the Helm charts when installing Istio ztunnel. |  |  |
+
+
+#### ZTunnelStatus
+
+
+
+ZTunnelStatus defines the observed state of ZTunnel
+
+
+
+_Appears in:_
+- [ZTunnel](#ztunnel)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `observedGeneration` _integer_ | ObservedGeneration is the most recent generation observed for this ZTunnel object. It corresponds to the object's generation, which is updated on mutation by the API Server. The information in the status pertains to this particular generation of the object. |  |  |
+| `conditions` _[ZTunnelCondition](#ztunnelcondition) array_ | Represents the latest available observations of the object's current state. |  |  |
+| `state` _[ZTunnelConditionReason](#ztunnelconditionreason)_ | Reports the current state of the object. |  |  |
+
+
 #### ZTunnelValues
 
 
@@ -3379,6 +3535,7 @@ _Appears in:_
 
 _Appears in:_
 - [ZTunnelSpec](#ztunnelspec)
+- [ZTunnelSpec](#ztunnelspec)
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
@@ -3392,12 +3549,12 @@ _Appears in:_
 Package v1alpha1 contains API Schema definitions for the sailoperator.io v1alpha1 API group
 
 ### Resource Types
-- [ZTunnel](#ztunnel)
-- [ZTunnelList](#ztunnellist)
+- [ZTunnel](#ztunnel-v1alpha1)
+- [ZTunnelList](#ztunnellist-v1alpha1)
 
 
 
-#### ZTunnel
+#### ZTunnel (v1alpha1)
 
 
 
@@ -3415,7 +3572,7 @@ _Appears in:_
 | `kind` _string_ | Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  |  |
 | `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  |  |
 | `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
-| `spec` _[ZTunnelSpec](#ztunnelspec)_ |  | \{ namespace:ztunnel profile:ambient version:v1.27.1 \} |  |
+| `spec` _[ZTunnelSpec](#ztunnelspec)_ |  | \{ namespace:ztunnel profile:ambient version:v1.28.0 \} |  |
 | `status` _[ZTunnelStatus](#ztunnelstatus)_ |  |  |  |
 
 
@@ -3478,7 +3635,7 @@ _Appears in:_
 | `Ready` | ZTunnelConditionReady signifies whether the ztunnel DaemonSet is ready.  |
 
 
-#### ZTunnelList
+#### ZTunnelList (v1alpha1)
 
 
 
@@ -3511,7 +3668,7 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `version` _string_ | Defines the version of Istio to install. Must be one of: v1.27-latest, v1.27.1, v1.27.0, v1.26-latest, v1.26.4, v1.26.3, v1.26.2, v1.26.0, v1.25-latest, v1.25.5, v1.25.4, v1.25.3, v1.25.2, v1.25.1, v1.24-latest, v1.24.6, v1.24.5, v1.24.4, v1.24.3, v1.24.2, v1.24.1, v1.24.0, master, v1.28-alpha.724e2360. | v1.27.1 | Enum: [v1.27-latest v1.27.1 v1.27.0 v1.26-latest v1.26.4 v1.26.3 v1.26.2 v1.26.0 v1.25-latest v1.25.5 v1.25.4 v1.25.3 v1.25.2 v1.25.1 v1.24-latest v1.24.6 v1.24.5 v1.24.4 v1.24.3 v1.24.2 v1.24.1 v1.24.0 master v1.28-alpha.724e2360]   |
+| `version` _string_ | Defines the version of Istio to install. Must be one of: v1.28-latest, v1.28.0, v1.27-latest, v1.27.3, v1.27.2, v1.27.1, v1.27.0, v1.26-latest, v1.26.6, v1.26.5, v1.26.4, v1.26.3, v1.26.2, v1.26.1, v1.26.0, v1.25-latest, v1.24-latest, master, v1.29-alpha.b2f713a9. | v1.28.0 | Enum: [v1.28-latest v1.28.0 v1.27-latest v1.27.3 v1.27.2 v1.27.1 v1.27.0 v1.26-latest v1.26.6 v1.26.5 v1.26.4 v1.26.3 v1.26.2 v1.26.1 v1.26.0 v1.25-latest v1.24-latest master v1.29-alpha.b2f713a9]   |
 | `profile` _string_ | The built-in installation configuration profile to use. The 'default' profile is 'ambient' and it is always applied. Must be one of: ambient, default, demo, empty, external, preview, remote, stable. | ambient | Enum: [ambient default demo empty external openshift-ambient openshift preview remote stable]   |
 | `namespace` _string_ | Namespace to which the Istio ztunnel component should be installed. | ztunnel |  |
 | `values` _[ZTunnelValues](#ztunnelvalues)_ | Defines the values to be passed to the Helm charts when installing Istio ztunnel. |  |  |
diff --git a/docs/common/coexistence.adoc b/docs/common/coexistence.adoc
new file mode 100644
index 000000000..1d67d0ad1
--- /dev/null
+++ b/docs/common/coexistence.adoc
@@ -0,0 +1,86 @@
+link:../README.adoc[Return to Project Root]
+
+== Table of Contents
+
+* <<coexistence-of-ambient-and-sidecar-mode>>
+** <<requirements-for-coexistence>>
+** <<supported-use-cases-in-coexistence-mode>>
+** <<limitations-and-unsupported-use-cases>>
+*** <<layer-7-policy-enforcement>>
+** <<best-practices>>
+
+[[coexistence-of-ambient-and-sidecar-mode]]
+== Coexistence of ambient and sidecar mode in the same mesh
+
+Sail Operator supports running sidecar pods and ambient pods together within the same mesh.
+While basic connectivity and Layer 4 (L4) features work seamlessly between sidecar and ambient workloads, there is a
+significant limitation for Layer 7 (L7) capabilities in the hybrid model.
+
+NOTE: The information in this document applies to Istio version 1.27.x. The coexistence of the two data planes is still evolving. For the latest status and updates, see the following upstream links: https://github.com/istio/istio/issues/57213[Support sidecar and ambient coexistence] and https://istio.io/latest/docs/ambient/usage/add-workloads/[Istio Ambient Mode - Add workloads to the mesh].
+
+[[requirements-for-coexistence]]
+=== Requirements for Coexistence
+
+- You have deployed Istio with `ambient` profile or have migrated your existing Sail Operator deployment with `ambient` profile.
+- All sidecars in the hybrid mesh must be HBONE-aware. This requires you to restart any existing pods after upgrading the control
+  plane. The restart reinjects the pods with an updated sidecar configuration that enables HBONE (ISTIO_META_ENABLE_HBONE),
+  allowing them to communicate with the ambient mesh.
+
+[[supported-use-cases-in-coexistence-mode]]
+=== Supported Use Cases in Coexistence Mode
+
+The following table describes the functionality that is expected to work when running sidecar and ambient modes together:
+
+[cols="1,2,5"]
+|===
+| Category | Functionality | Description
+
+| *Basic connectivity*
+| East-west communication
+| Pods operating in sidecar mode can communicate with those in ambient mode, and vice versa.
+
+| *L4 Security*
+| mTLS
+| When a sidecar proxy detects that the destination is an HBONE endpoint, it automatically uses the HBONE protocol. Similarly, when a pod runs in ambient mode, its source ztunnel uses HBONE to communicate with the destination's sidecar proxy.
+
+| *L4 Authentication/Authorization*
+| Layer 4 policies
+| Layer 4 (L4) authentication and authorization policies remain supported in coexistence mode. A `PeerAuthentication` policy with mTLS mode set to `STRICT` allows traffic from pods running in either sidecar or ambient mode. AuthorizationPolicy with L4 rules (based on principals, source IPs, ports) work consistently across both architectures, with policies being enforced by both ztunnel (ambient) and Envoy sidecars.
+
+| *Gateways*
+| Ingress and Egress Gateways
+| Pods operating in ambient mode interoperate with Istio egress gateways. Ingress gateways deployed in non-ambient namespaces can expose services hosted in both ambient and sidecar modes.
+
+| *L4 Observability*
+| Basic telemetry
+| Only basic L4 TCP metrics are supported.
+|===
+
+NOTE: By default, traffic from ingress gateways to ambient services does not traverse waypoints unless the `istio.io/ingress-use-waypoint: "true"` label is applied.
+
+[[limitations-and-unsupported-use-cases]]
+=== Limitations and Unsupported Use Cases
+
+The major limitations are around L7 features (like L7 based traffic routing, L7 auth policies and L7 telemetry) when traffic has to traverse between the two dataplane modes.
+
+[[layer-7-policy-enforcement]]
+==== Layer 7 Policy Enforcement
+
+Currently, sidecar proxies have limited support for communicating with waypoint proxies. As a result, when a sidecar pod sends traffic
+to an ambient pod with a waypoint, the traffic usually bypasses the waypoint, which prevents Layer 7 (L7) policy enforcement.
+However, ambient pods can communicate with sidecar pods through waypoints, allowing L7 policy enforcement in that direction.
+
+When a sidecar pod communicates with an ambient pod that has a waypoint:
+
+- L7 authorization policies do not apply
+- Only Layer 4 (L4) authorization policies are enforced
+- Routing decisions are made by the client-side sidecar, not the waypoint proxy
+
+[[best-practices]]
+=== Best Practices
+
+When running sidecar and ambient modes together, follow these recommendations:
+
+- *Use separate namespaces*: Whenever possible, use separate namespaces for ambient and sidecar pods to avoid configuration issues.
+- *Avoid mixed labeling*: Avoid https://istio.io/latest/docs/reference/config/labels/[labeling] pods/namespaces with both sidecar and ambient injection labels (although sidecar takes precedence if both are present).
+
diff --git a/docs/common/create-and-configure-gateways.adoc b/docs/common/create-and-configure-gateways.adoc
index 597993863..b79c6d1a7 100644
--- a/docs/common/create-and-configure-gateways.adoc
+++ b/docs/common/create-and-configure-gateways.adoc
@@ -1,9 +1,9 @@
 // Variables embedded for GitHub compatibility
-:istio_latest_version: 1.26.3
-:istio_latest_version_revision_format: 1-26-3
-:istio_latest_tag: v1.26-latest
-:istio_latest_minus_one_version: 1.26.2
-:istio_latest_minus_one_version_revision_format: 1-26-2
+:istio_latest_version: 1.28.0
+:istio_latest_version_revision_format: 1-28-0
+:istio_latest_tag: v1.28-latest
+:istio_latest_minus_one_version: 1.27.3
+:istio_latest_minus_one_version_revision_format: 1-27-3
 
 link:../README.adoc[Return to Project Root]
 
diff --git a/docs/common/istio-ambient-mode.adoc b/docs/common/istio-ambient-mode.adoc
index 21982a159..2647c1b09 100644
--- a/docs/common/istio-ambient-mode.adoc
+++ b/docs/common/istio-ambient-mode.adoc
@@ -1,10 +1,10 @@
 // Variables embedded for GitHub compatibility
-:istio_latest_version: 1.26.3
-:istio_latest_version_revision_format: 1-26-3
-:istio_latest_tag: v1.26-latest
-:istio_release_name: release-1.26
-:istio_latest_minus_one_version: 1.26.2
-:istio_latest_minus_one_version_revision_format: 1-26-2
+:istio_latest_version: 1.28.0
+:istio_latest_version_revision_format: 1-28-0
+:istio_latest_tag: v1.28-latest
+:istio_release_name: release-1.28
+:istio_latest_minus_one_version: 1.27.3
+:istio_latest_minus_one_version_revision_format: 1-27-3
 
 link:../README.adoc[Return to Project Root]
 
@@ -45,16 +45,17 @@ To install Istio Ambient mode using Sail Operator on OpenShift, use version `v1.
 [[ztunnel-resource]]
 === ZTunnel resource
 
-The `ZTunnel` resource manages the L4 node proxy and is a cluster-wide resource. It deploys a DaemonSet that runs on all nodes in the cluster. You can specify the version using the `spec.version` field, as shown in the example below. Similar to the `Istio` resource, it also includes a `values` field that allows you to configure options available in the ztunnel helm chart.
+NOTE: The ZTunnel API was promoted from `v1alpha1` to `v1`. If you have existing `v1alpha1.ZTunnel` resources, they will continue to work but you should migrate to `v1`. The `profile` field has been removed as part of the graduation, so if you previously set this field you'll need to remove it in order to use `v1`.
+
+The `ZTunnel` resource manages the L4 node proxy and is a cluster-wide resource. It deploys a DaemonSet that runs on all nodes in the cluster. You can specify the version using the `spec.version` field, as shown in the example below. Similar to the `Istio` resource, it also includes a `values` field that allows you to configure options available in the ztunnel helm chart. The `metadata.name` field must be set to `default`, as enforced by a CRD validation rule that guarantees only one `ZTunnel` instance exists cluster-wide.
 
 [source,yaml]
 ----
-apiVersion: sailoperator.io/v1alpha1
+apiVersion: sailoperator.io/v1
 kind: ZTunnel
 metadata:
   name: default
 spec:
-  profile: ambient
   namespace: ztunnel
   values:
     ztunnel:
@@ -176,12 +177,11 @@ kubectl label namespace ztunnel istio-discovery=enabled
 [source,bash,subs="attributes+"]
 ----
 cat <<EOF | kubectl apply -f-
-apiVersion: sailoperator.io/v1alpha1
+apiVersion: sailoperator.io/v1
 kind: ZTunnel
 metadata:
   name: default
 spec:
-  profile: ambient
   version: v{istio_latest_version}
   namespace: ztunnel
 EOF
@@ -426,4 +426,4 @@ kubectl delete -n bookinfo -f https://raw.githubusercontent.com/istio/istio/{ist
 [source,bash,subs="attributes+"]
 ----
 kubectl delete -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/standard-install.yaml
-----
\ No newline at end of file
+----
diff --git a/docs/common/istio-ambient-waypoint.adoc b/docs/common/istio-ambient-waypoint.adoc
index 9cc472458..f1f77fb1e 100644
--- a/docs/common/istio-ambient-waypoint.adoc
+++ b/docs/common/istio-ambient-waypoint.adoc
@@ -1,10 +1,10 @@
 // Variables embedded for GitHub compatibility
-:istio_latest_version: 1.26.3
-:istio_latest_version_revision_format: 1-26-3
-:istio_latest_tag: v1.26-latest
-:istio_release_name: release-1.26
-:istio_latest_minus_one_version: 1.26.2
-:istio_latest_minus_one_version_revision_format: 1-26-2
+:istio_latest_version: 1.28.0
+:istio_latest_version_revision_format: 1-28-0
+:istio_latest_tag: v1.28-latest
+:istio_release_name: release-1.28
+:istio_latest_minus_one_version: 1.27.3
+:istio_latest_minus_one_version_revision_format: 1-27-3
 
 link:../README.adoc[Return to Project Root]
 
diff --git a/docs/deployment-models/consolidating-cp.adoc b/docs/deployment-models/consolidating-cp.adoc
index bf7927f98..54301be99 100644
--- a/docs/deployment-models/consolidating-cp.adoc
+++ b/docs/deployment-models/consolidating-cp.adoc
@@ -1,10 +1,10 @@
 // Variables embedded for GitHub compatibility
-:istio_latest_version: 1.26.3
-:istio_latest_version_revision_format: 1-26-3
-:istio_latest_tag: v1.26-latest
-:istio_release_name: release-1.26
-:istio_latest_minus_one_version: 1.26.2
-:istio_latest_minus_one_version_revision_format: 1-26-2
+:istio_latest_version: 1.28.0
+:istio_latest_version_revision_format: 1-28-0
+:istio_latest_tag: v1.28-latest
+:istio_release_name: release-1.28
+:istio_latest_minus_one_version: 1.27.3
+:istio_latest_minus_one_version_revision_format: 1-27-3
 
 link:../../README.adoc[Return to Project Root]
 
diff --git a/docs/deployment-models/multicluster.adoc b/docs/deployment-models/multicluster.adoc
index 40b9e4fef..f3f9775fe 100644
--- a/docs/deployment-models/multicluster.adoc
+++ b/docs/deployment-models/multicluster.adoc
@@ -1,10 +1,10 @@
 // Variables embedded for GitHub compatibility
-:istio_latest_version: 1.26.3
-:istio_latest_version_revision_format: 1-26-3
-:istio_latest_tag: v1.26-latest
-:istio_release_name: release-1.26
-:istio_latest_minus_one_version: 1.26.2
-:istio_latest_minus_one_version_revision_format: 1-26-2
+:istio_latest_version: 1.28.0
+:istio_latest_version_revision_format: 1-28-0
+:istio_latest_tag: v1.28-latest
+:istio_release_name: release-1.28
+:istio_latest_minus_one_version: 1.27.3
+:istio_latest_minus_one_version_revision_format: 1-27-3
 
 link:../README.adoc[Return to Project Root]
 
diff --git a/docs/deployment-models/multiple-mesh.adoc b/docs/deployment-models/multiple-mesh.adoc
index 8fedffed7..a0b9c5dbc 100644
--- a/docs/deployment-models/multiple-mesh.adoc
+++ b/docs/deployment-models/multiple-mesh.adoc
@@ -1,10 +1,10 @@
 // Variables embedded for GitHub compatibility
-:istio_latest_version: 1.26.3
-:istio_latest_version_revision_format: 1-26-3
-:istio_latest_tag: v1.26-latest
-:istio_release_name: release-1.26
-:istio_latest_minus_one_version: 1.26.2
-:istio_latest_minus_one_version_revision_format: 1-26-2
+:istio_latest_version: 1.28.0
+:istio_latest_version_revision_format: 1-28-0
+:istio_latest_tag: v1.28-latest
+:istio_release_name: release-1.28
+:istio_latest_minus_one_version: 1.27.3
+:istio_latest_minus_one_version_revision_format: 1-27-3
 
 link:../../README.adoc[Return to Project Root]
 
diff --git a/docs/dual-stack/dual-stack.adoc b/docs/dual-stack/dual-stack.adoc
index d0ee6c620..d95d97f4e 100644
--- a/docs/dual-stack/dual-stack.adoc
+++ b/docs/dual-stack/dual-stack.adoc
@@ -1,10 +1,10 @@
 // Variables embedded for GitHub compatibility
-:istio_latest_version: 1.26.3
-:istio_latest_version_revision_format: 1-26-3
-:istio_latest_tag: v1.26-latest
-:istio_release_name: release-1.26
-:istio_latest_minus_one_version: 1.26.2
-:istio_latest_minus_one_version_revision_format: 1-26-2
+:istio_latest_version: 1.28.0
+:istio_latest_version_revision_format: 1-28-0
+:istio_latest_tag: v1.28-latest
+:istio_release_name: release-1.28
+:istio_latest_minus_one_version: 1.27.3
+:istio_latest_minus_one_version_revision_format: 1-27-3
 
 link:../../README.adoc[Return to Project Root]
 
diff --git a/docs/general/getting-started.adoc b/docs/general/getting-started.adoc
index 274df48e3..f41a0d2d3 100644
--- a/docs/general/getting-started.adoc
+++ b/docs/general/getting-started.adoc
@@ -1,10 +1,10 @@
 // Variables embedded for GitHub compatibility
-:istio_latest_version: 1.26.3
-:istio_latest_version_revision_format: 1-26-3
-:istio_latest_tag: v1.26-latest
-:istio_release_name: release-1.26
-:istio_latest_minus_one_version: 1.26.2
-:istio_latest_minus_one_version_revision_format: 1-26-2
+:istio_latest_version: 1.28.0
+:istio_latest_version_revision_format: 1-28-0
+:istio_latest_tag: v1.28-latest
+:istio_release_name: release-1.28
+:istio_latest_minus_one_version: 1.27.3
+:istio_latest_minus_one_version_revision_format: 1-27-3
 
 link:../README.adoc[Return to Project Root]
 
diff --git a/docs/general/istiod-ha.adoc b/docs/general/istiod-ha.adoc
index e323e0ce7..3317ccdf0 100644
--- a/docs/general/istiod-ha.adoc
+++ b/docs/general/istiod-ha.adoc
@@ -1,10 +1,10 @@
 // Variables embedded for GitHub compatibility
-:istio_latest_version: 1.26.3
-:istio_latest_version_revision_format: 1-26-3
-:istio_latest_tag: v1.26-latest
-:istio_release_name: release-1.26
-:istio_latest_minus_one_version: 1.26.2
-:istio_latest_minus_one_version_revision_format: 1-26-2
+:istio_latest_version: 1.28.0
+:istio_latest_version_revision_format: 1-28-0
+:istio_latest_tag: v1.28-latest
+:istio_release_name: release-1.28
+:istio_latest_minus_one_version: 1.27.3
+:istio_latest_minus_one_version_revision_format: 1-27-3
 
 link:../../README.adoc[Return to Project Root]
 
diff --git a/docs/general/plugin-ca.adoc b/docs/general/plugin-ca.adoc
index e27ad4215..0795c37aa 100644
--- a/docs/general/plugin-ca.adoc
+++ b/docs/general/plugin-ca.adoc
@@ -1,10 +1,10 @@
 // Variables embedded for GitHub compatibility
-:istio_latest_version: 1.26.3
-:istio_latest_version_revision_format: 1-26-3
-:istio_latest_tag: v1.26-latest
-:istio_release_name: release-1.26
-:istio_latest_minus_one_version: 1.26.2
-:istio_latest_minus_one_version_revision_format: 1-26-2
+:istio_latest_version: 1.28.0
+:istio_latest_version_revision_format: 1-28-0
+:istio_latest_tag: v1.28-latest
+:istio_release_name: release-1.28
+:istio_latest_minus_one_version: 1.27.3
+:istio_latest_minus_one_version_revision_format: 1-27-3
 
 link:../../README.adoc[Return to Project Root]
 
diff --git a/docs/guidelines/guidelines.adoc b/docs/guidelines/guidelines.adoc
index 9af16a9e6..0399dcf5a 100644
--- a/docs/guidelines/guidelines.adoc
+++ b/docs/guidelines/guidelines.adoc
@@ -1,10 +1,10 @@
 // Variables embedded for GitHub compatibility
-:istio_latest_version: 1.26.3
-:istio_latest_version_revision_format: 1-26-3
-:istio_latest_tag: v1.26-latest
-:istio_release_name: release-1.26
-:istio_latest_minus_one_version: 1.26.2
-:istio_latest_minus_one_version_revision_format: 1-26-2
+:istio_latest_version: 1.28.0
+:istio_latest_version_revision_format: 1-28-0
+:istio_latest_tag: v1.28-latest
+:istio_release_name: release-1.28
+:istio_latest_minus_one_version: 1.27.3
+:istio_latest_minus_one_version_revision_format: 1-27-3
 
 link:../../README.adoc[Return to Project Root]
 
@@ -97,12 +97,12 @@ Use code blocks for commands or groups of commands that have the same context. *
 All AsciiDoc files should include variable definitions at the top for GitHub compatibility:
 ```
 // Variables embedded for GitHub compatibility
-:istio_latest_version: 1.26.3
-:istio_latest_version_revision_format: 1-26-3
-:istio_latest_tag: v1.26-latest
-:istio_release_name: release-1.26
-:istio_latest_minus_one_version: 1.26.2
-:istio_latest_minus_one_version_revision_format: 1-26-2
+:istio_latest_version: 1.28.0
+:istio_latest_version_revision_format: 1-28-0
+:istio_latest_tag: v1.28-latest
+:istio_release_name: release-1.28
+:istio_latest_minus_one_version: 1.27.3
+:istio_latest_minus_one_version_revision_format: 1-27-3
 ```
 
 Note: that the values of the variables will be automatically updated on each release to keep them in sync with the actual versions.
diff --git a/docs/helm-optimization.md b/docs/helm-optimization.md
new file mode 100644
index 000000000..9fb96f9d1
--- /dev/null
+++ b/docs/helm-optimization.md
@@ -0,0 +1,206 @@
+# Helm Chart Installation Optimization
+
+## Overview
+
+The Sail Operator has been enhanced with an optimized Helm chart installation process that significantly reduces unnecessary Helm revision increments. This optimization uses a "template-first" approach that generates manifests and compares them against the actual live Kubernetes resources before deciding whether to perform an actual Helm operation.
+
+## Problem Statement
+
+Previously, every reconciliation cycle would trigger a `helm upgrade` or `helm install` operation, which would increment the Helm revision count even when there were no actual changes to deploy. This led to:
+
+- Unnecessary revision history bloat
+- Potential performance degradation over time
+- Difficulty in tracking meaningful changes
+- Increased storage usage for Helm release metadata
+
+## Solution: Template-First Diff Detection with Live Resource Comparison
+
+The new `UpgradeOrInstallChartWithDiff` method implements the following workflow:
+
+```
+1. Generate manifests using Helm template engine (like `helm template`)
+2. Query live Kubernetes resources corresponding to the generated manifests
+3. Compare generated manifests with actual cluster state
+4. Only perform actual Helm install/upgrade if differences are detected
+5. Skip Helm operation if manifests match live resources
+```
+
+## Key Benefits
+
+### 1. Reduced Revision Bloat
+- Helm revisions are only incremented when there are actual changes
+- Revision history remains clean and meaningful
+- Easier to track when real changes occurred
+
+### 2. Performance Optimization
+- Avoids unnecessary Kubernetes API calls during Helm operations
+- Reduces cluster load during frequent reconciliation cycles
+- Faster reconciliation when no changes are needed
+
+### 3. True State Comparison
+- Compares against actual live cluster resources, not stored Helm state
+- Handles cases where resources were modified outside of Helm
+- Provides accurate detection of drift from desired state
+
+### 4. Intelligent Diff Detection
+- Ignores volatile fields (resourceVersion, generation, uid, etc.)
+- Filters out runtime-specific annotations and status fields
+- Focuses on actual desired state changes
+
+## Technical Implementation
+
+### Live Resource Fetching
+The system uses a Kubernetes dynamic client to fetch actual resources from the cluster:
+
+```go
+// Fetch live resources using dynamic client
+dynamicClient, err := dynamic.NewForConfig(cfg)
+gvr := gvk.GroupVersion().WithResource(kindToResource(gvk.Kind))
+liveResource, err := dynamicClient.Resource(gvr).Namespace(namespace).Get(ctx, name, metav1.GetOptions{})
+```
+
+### Manifest Generation
+```go
+// Uses Helm's template engine with dry-run to generate manifests
+installAction := action.NewInstall(cfg)
+installAction.DryRun = true
+installAction.ClientOnly = true
+installAction.PostRenderer = NewHelmPostRenderer(ownerReference, "", isUpgrade)
+```
+
+### Resource Discovery
+The system automatically:
+- Extracts Group/Version/Kind information from generated manifests
+- Maps Kubernetes Kinds to their corresponding resource names
+- Handles both namespaced and cluster-scoped resources
+- Gracefully handles non-existing resources (treats as new)
+
+### Manifest Normalization
+The system normalizes manifests by:
+- Parsing YAML into structured objects
+- Removing volatile fields that don't represent real changes
+- Re-serializing to ensure consistent formatting
+- Computing SHA256 hashes for efficient comparison
+
+### Volatile Fields Removed
+- `metadata.resourceVersion`
+- `metadata.generation`  
+- `metadata.uid`
+- `metadata.selfLink`
+- `metadata.creationTimestamp`
+- `metadata.managedFields`
+- `status` (entire section)
+- Annotations like `deployment.kubernetes.io/revision`
+
+## Usage
+
+### Controller Integration
+Replace existing `UpgradeOrInstallChart` calls with the new diff-aware method:
+
+```go
+// Before
+_, err := r.ChartManager.UpgradeOrInstallChart(ctx, chartDir, values, namespace, releaseName, &ownerReference)
+
+// After  
+_, err := r.ChartManager.UpgradeOrInstallChartWithDiff(ctx, chartDir, values, namespace, releaseName, &ownerReference)
+```
+
+### Behavior
+- **First Installation**: Behaves identically to the original method
+- **Subsequent Updates**: Only performs Helm operation if live resources differ
+- **Error Handling**: Falls back to original method if live resource comparison fails
+- **Missing Resources**: New resources (not in cluster) are detected as changes
+
+## Logging and Observability
+
+The system provides detailed logging to help understand when optimizations are applied:
+
+```
+INFO No dynamic client available, falling back to regular Helm operation
+INFO No changes detected in live cluster resources, skipping Helm operation chartName=istiod release=default-istiod
+INFO Changes detected between generated manifests and live cluster resources, proceeding with Helm upgrade chartName=istiod release=default-istiod
+INFO Failed to fetch live resources, falling back to regular Helm operation
+```
+
+## Testing
+
+Comprehensive test coverage includes:
+- Live resource fetching with fake dynamic client
+- Manifest comparison scenarios  
+- Resource Kind to API resource mapping
+- Cluster vs namespaced resource detection
+- Volatile field filtering
+- Hash consistency verification
+
+Run tests with:
+```bash
+go test ./pkg/helm -v -run "TestFetchLiveResources|TestManifestsHaveChanged"
+```
+
+## Migration Guide
+
+### For Operators
+The change is backward compatible. Existing installations continue to work, but will benefit from the optimization on subsequent reconciliation cycles.
+
+### For Developers
+When modifying controllers:
+1. Replace `UpgradeOrInstallChart` calls with `UpgradeOrInstallChartWithDiff`
+2. Test thoroughly in development environments
+3. Monitor logs to verify optimization is working as expected
+
+## Limitations and Considerations
+
+### When Optimization is Bypassed
+- First-time chart installations (no existing release to compare against)
+- When dynamic client creation fails (falls back to original behavior)
+- When live resource fetching fails (network issues, permissions, etc.)
+- When manifest comparison fails (falls back to original behavior)
+
+### Resource Overhead
+- Small additional CPU overhead for live resource fetching and comparison
+- Negligible memory overhead for normalization process
+- Additional Kubernetes API calls to fetch live resources
+- Overall performance improvement due to reduced Helm operations
+
+### Permissions Required
+The operator needs appropriate RBAC permissions to:
+- Read resources across all namespaces where charts are deployed
+- Access cluster-scoped resources (ClusterRoles, etc.)
+- Query custom resources deployed by charts
+
+## Security Considerations
+
+### RBAC Requirements
+Ensure the operator service account has sufficient permissions:
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: sail-operator-resource-reader
+rules:
+- apiGroups: ["*"]
+  resources: ["*"]
+  verbs: ["get", "list"]
+```
+
+### Error Handling
+- Failed resource queries don't block deployments
+- System gracefully falls back to original Helm behavior
+- No sensitive data is exposed in error logs
+
+## Future Enhancements
+
+### Planned Improvements
+- Discovery client integration for dynamic resource type detection
+- Caching of live resources to reduce API calls
+- Metrics and monitoring for optimization effectiveness
+- Advanced filtering rules for complex chart patterns
+- Support for custom resource definitions with proper schema validation
+
+### Configuration Options
+Future versions may include:
+- Configurable diff sensitivity levels
+- Option to disable optimization for specific charts
+- Custom volatile field filters per chart type
+- Resource-specific comparison strategies 
\ No newline at end of file
diff --git a/docs/migrate-from-sidecar-to-ambient/images/general-view-ambient.png b/docs/migrate-from-sidecar-to-ambient/images/general-view-ambient.png
new file mode 100644
index 000000000..f20a11026
Binary files /dev/null and b/docs/migrate-from-sidecar-to-ambient/images/general-view-ambient.png differ
diff --git a/docs/migrate-from-sidecar-to-ambient/images/istio-config-ambient.png b/docs/migrate-from-sidecar-to-ambient/images/istio-config-ambient.png
new file mode 100644
index 000000000..10a42c77f
Binary files /dev/null and b/docs/migrate-from-sidecar-to-ambient/images/istio-config-ambient.png differ
diff --git a/docs/migrate-from-sidecar-to-ambient/images/kiali-bookinfo-traffic-ambient.png b/docs/migrate-from-sidecar-to-ambient/images/kiali-bookinfo-traffic-ambient.png
new file mode 100644
index 000000000..22ca3b195
Binary files /dev/null and b/docs/migrate-from-sidecar-to-ambient/images/kiali-bookinfo-traffic-ambient.png differ
diff --git a/docs/migrate-from-sidecar-to-ambient/images/kiali-bookinfo-traffic.png b/docs/migrate-from-sidecar-to-ambient/images/kiali-bookinfo-traffic.png
new file mode 100644
index 000000000..73fd9c0fd
Binary files /dev/null and b/docs/migrate-from-sidecar-to-ambient/images/kiali-bookinfo-traffic.png differ
diff --git a/docs/migrate-from-sidecar-to-ambient/images/kiali-dashboard.png b/docs/migrate-from-sidecar-to-ambient/images/kiali-dashboard.png
new file mode 100644
index 000000000..755c8690e
Binary files /dev/null and b/docs/migrate-from-sidecar-to-ambient/images/kiali-dashboard.png differ
diff --git a/docs/migrate-from-sidecar-to-ambient/images/kiali-security.png b/docs/migrate-from-sidecar-to-ambient/images/kiali-security.png
new file mode 100644
index 000000000..cd028de51
Binary files /dev/null and b/docs/migrate-from-sidecar-to-ambient/images/kiali-security.png differ
diff --git a/docs/migrate-from-sidecar-to-ambient/images/kiali-traffic-map.png b/docs/migrate-from-sidecar-to-ambient/images/kiali-traffic-map.png
new file mode 100644
index 000000000..aa6dec115
Binary files /dev/null and b/docs/migrate-from-sidecar-to-ambient/images/kiali-traffic-map.png differ
diff --git a/docs/migrate-from-sidecar-to-ambient/images/mtls-ambient.png b/docs/migrate-from-sidecar-to-ambient/images/mtls-ambient.png
new file mode 100644
index 000000000..278f15d2b
Binary files /dev/null and b/docs/migrate-from-sidecar-to-ambient/images/mtls-ambient.png differ
diff --git a/docs/migrate-from-sidecar-to-ambient/migration.adoc b/docs/migrate-from-sidecar-to-ambient/migration.adoc
new file mode 100644
index 000000000..f6cede2a8
--- /dev/null
+++ b/docs/migrate-from-sidecar-to-ambient/migration.adoc
@@ -0,0 +1,1603 @@
+= Migrating from Sidecar to Ambient Mode
+
+This guide provides a comprehensive, step-by-step process for migrating an existing Sail Operator deployment from sidecar mode to ambient mode. The migration approach is designed to achieve a near zero-downtime transition while maintaining all security policies and service mesh functionality.
+
+== Table of Contents
+
+* <<overview-of-sidecar-to-ambient-migration, 1. Overview of Sidecar to Ambient Migration>>
+** <<migration-strategy, 1.1 Migration Strategy>>
+** <<key-architectural-changes, 1.2 Key Architectural Changes>>
+* <<prerequisites, 2. Prerequisites>>
+** <<technical-requirements, 2.1 Technical Requirements>>
+*** <<waypoint-decision-framework, 2.1.1 Waypoint Decision Framework>>
+** <<compatibility-validation, 2.2 Compatibility Validation>>
+** <<pre-migration-checklist, 2.3 Pre-Migration Checklist>>
+** <<backup-existing-configuration, 2.4 Backup Existing Configuration>>
+* <<migration-steps, 3. Migration Steps>>
+** <<step-1-prerequisites-validation, Step 1: Prerequisites Validation>>
+** <<step-2-cluster-setup-enable-ambient-support, Step 2: Cluster Setup - Enable Ambient Support>>
+*** <<step-21-update-istio-configuration, Step 2.1 Update Istio Configuration>>
+*** <<step-22-deploy-istio-cni-for-ambient, Step 2.2 Deploy Istio CNI for Ambient>>
+*** <<step-23-deploy-ztunnel-proxies, Step 2.3 Deploy ZTunnel Proxies>>
+** <<step-3-update-sidecars-for-hbone-support, Step 3: Update Sidecars for HBONE Support>>
+*** <<step-31-enable-hbone-protocol-support, Step 3.1 Enable HBONE Protocol Support>>
+*** <<step-32-validate-hbone-capability, Step 3.2 Validate HBONE Capability>>
+*** <<step-33-connectivity-validation, Step 3.3 Connectivity Validation>>
+** <<step-4-deploy-waypoint-proxies, Step 4: Deploy Waypoint Proxies>>
+*** <<step-41-identify-services-requiring-l7-features, Step 4.1 Identify Services Requiring L7 Features>>
+*** <<step-42-create-waypoint-configurations, Step 4.2 Create Waypoint Configurations>>
+** <<step-5-migrate-traffic-policies, Step 5: Migrate Traffic Policies>>
+*** <<step-51-convert-virtualservices-to-httproutes, Step 5.1 Convert VirtualServices to HTTPRoutes>>
+**** <<step-511-create-version-specific-services-required-for-httproute, Step 5.1.1 Create Version-Specific Services (Required for HTTPRoute)>>
+**** <<step-512-convert-virtualservice-to-httproute, Step 5.1.2 Convert VirtualService to HTTPRoute>>
+*** <<step-52-create-waypoint-targeted-authorization-policies, Step 5.2 Create Waypoint-Targeted Authorization Policies>>
+*** <<step-53-add-ztunnel-bypass-protection-critical-security-step, Step 5.3 Add Ztunnel Bypass Protection (Critical Security Step)>>
+** <<step-6-enable-ambient-mode-for-applications, Step 6: Enable Ambient Mode for Applications>>
+*** <<step-61-gradual-namespace-migration, Step 6.1 Gradual Namespace Migration>>
+** <<step-7-enable-waypoint-processing, Step 7: Enable Waypoint Processing>>
+*** <<step-71-activate-waypoints-for-l7-processing, Step 7.1 Activate Waypoints for L7 Processing>>
+** <<step-8-policy-simplification, Step 8: Policy Simplification>>
+*** <<step-81-remove-redundant-sidecar-policies, Step 8.1 Remove Redundant Sidecar Policies>>
+** <<step-9-remove-sidecar-injection, Step 9: Remove Sidecar Injection>>
+*** <<step-91-disable-sidecar-injection, Step 9.1 Disable Sidecar Injection>>
+*** <<step-92-validate-sidecar-removal, Step 9.2 Validate Sidecar Removal>>
+*** <<step-93-validate-l7-policy-enforcement, Step 9.3 Validate L7 Policy Enforcement>>
+* <<validation-and-testing, 4. Validation and Testing>>
+** <<migration-verification, 4.1 Migration Verification>>
+* <<troubleshooting, 5. Troubleshooting>>
+** <<common-issues, 5.1 Common Issues>>
+** <<rollback-procedures, 5.2 Rollback Procedures>>
+* <<post-migration-optimization, 6. Post-Migration Optimization>>
+** <<observability-considerations, 6.1 Observability Considerations>>
+** <<configure-kiali-for-ambient-mode, 6.2 Configure Kiali for Ambient Mode>>
+* <<additional-resources, 7. Additional Resources>>
+
+---
+
+[[overview-of-sidecar-to-ambient-migration]]
+== 1. Overview of Sidecar to Ambient Migration
+
+[[migration-strategy]]
+=== 1.1 Migration Strategy
+
+The migration from sidecar to ambient mode follows a structured, phased approach to ensure a smooth transition with minimal disruption. Key principles include:
+
+1. **Gradual Transition**: Both sidecar and ambient proxies operate simultaneously during migration
+2. **Service-by-Service**: Migration can occur incrementally, one service or namespace at a time
+3. **Policy Preservation**: All existing security and traffic policies are maintained throughout the process
+4. **Rollback Support**: Each step can be reversed if issues arise
+
+[[key-architectural-changes]]
+=== 1.2 Key Architectural Changes
+
+[cols="1,2,2"]
+|===
+|Component |Sidecar Mode |Ambient Mode
+
+|**L4 Processing**
+|Envoy sidecar per pod
+|ZTunnel node proxy (shared)
+
+|**L7 Processing**
+|Envoy sidecar per pod
+|Waypoint proxy per namespace or service or workload.
+
+|**mTLS Enforcement**
+|Sidecar proxy
+|ZTunnel proxy
+
+|**Policy Enforcement**
+|Sidecar proxy
+|ZTunnel (L4) + Waypoint (L7)
+|===
+
+---
+
+[[prerequisites]]
+== 2. Prerequisites
+
+This migration guide uses example commands that can be adapted to any application. For reference purposes, we use placeholder values like `<NAMESPACE>`, `<SERVICE_NAME>`, and `<GATEWAY_NAME>` that you should replace with your actual application details.
+
+**Related Documentation:**
+
+- If you want to follow along with a sample application, you can deploy the bookinfo application by following the steps described in link:../addons/addons.adoc#deploy-gateway-and-bookinfo[Deploying Gateway and Bookinfo]
+- For detailed waypoint proxy configuration, see link:../common/istio-ambient-waypoint.adoc[Waypoint Proxy Documentation]
+- For general application deployment guidance, refer to link:../common/install-bookinfo-app.adoc[Installing the Bookinfo Application]
+
+You can use any application that is currently running with sidecar injection enabled.
+
+[[technical-requirements]]
+=== 2.1 Technical Requirements
+
+Before starting migration, ensure your environment meets these requirements:
+
+For Kubernetes:
+
+- **Kubernetes 1.21+**: Minimum version for ambient mode support
+- **Sail Operator v1.27+**: Must be running Sail Operator version 1.27 or later
+- **Istio v1.27+**: Control plane must be v1.24 or later for ambient support
+- **Cluster Admin Access**: Required for namespace labeling and resource creation
+
+For Openshift:
+
+- **Openshift versions supported**: We support Openshift 4.14 and later but for versions older than 4.19 you will need to manually install Gateway API CRDs.
+- **Sail Operator v1.27+**: Must be running Sail Operator version 1.27 or later.
+- **Istio v1.27+**: Control plane must be v1.27 or later for ambient support on Openshift.
+- **Cluster Admin Access**: Required for namespace labeling and resource creation
+
+**Note**: for Openshift clusters, it's need the use of the local gateway mode for ambient deployments. Please refer to the Openshift documentation for more details: https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/installing/ossm-istio-ambient-mode#ossm-installing-istio-ambient-mode_ossm-istio-ambient-mode.
+
+**See also**: For general Istio installation guidance in this repository, refer to the installation documentation in the `docs/` directory.
+
+[[waypoint-decision-framework]]
+=== 2.1.1 Waypoint Decision Framework
+
+A critical architectural decision involves whether to deploy waypoint proxies. This choice affects both functionality and performance:
+
+**Option 1: Ztunnel-Only (No Waypoints)**
+
+- **Maximum performance**: Minimal processing overhead
+- **Automatic mTLS**: Transparent encryption between services
+- **L4 policies**: Basic authorization and authentication
+- **No L7 features**: Traffic routing, fault injection, L7 authorization
+
+**Option 2: Ztunnel + Waypoint Proxies**
+
+- **Full feature set**: All Istio traffic management and security features
+- **L7 policies**: HTTP-level authorization, routing, telemetry
+- **Gateway API support**: Modern traffic management APIs
+- **Performance cost**: Similar to sidecar mode for L7 processing
+
+**When Waypoints Are Used vs Not Used:**
+
+**Automatic Waypoint Activation occurs when:**
+
+1. **Namespace labeling**: Adding `istio.io/use-waypoint=<waypoint-name>` label to a namespace
+2. **Service labeling**: Adding the label to specific services for granular control
+3. **Pod labeling**: Adding the label to individual pods (requires `istio.io/waypoint-for: workload`)
+
+**Traffic Flow Decision Tree:**
+
+- **Without waypoint labels**: Traffic flows directly through ztunnel (L4-only processing)
+- **With waypoint labels**: Traffic is intercepted and routed through waypoint proxies for L7 processing
+- **Mixed environments**: Some services use waypoints while others remain ztunnel-only
+
+**Decision Criteria:**
+
+- **Use waypoints if**: You need VirtualServices, HTTPRoutes, L7 AuthorizationPolicies, fault injection, or HTTP-level observability
+- **Skip waypoints if**: You only need mTLS, L4 AuthorizationPolicies, and basic connectivity
+- **Hybrid approach**: Deploy waypoints only for services requiring L7 features
+
+**Important**: Waypoint activation is explicit, deploying a waypoint Gateway resource alone does not affect traffic flow. You must label namespaces, services, or pods to direct traffic through waypoints.
+
+For detailed waypoint configuration guidance, see link:../common/istio-ambient-waypoint.adoc[Waypoint Proxy Documentation].
+
+[[compatibility-validation]]
+=== 2.2 Compatibility between Sidecar and Ambient Modes
+
+**Supported Features:**
+
+- All L4 traffic policies (AuthorizationPolicy, PeerAuthentication)
+- L7 traffic management (VirtualService, DestinationRule converted to HTTPRoute)
+- Security policies (RequestAuthentication, AuthorizationPolicy)
+- Telemetry and observability features
+
+**Unsupported Features** (migration blockers):
+
+- Multi-cluster mesh configurations
+- Virtual Machine (VM) workload integration
+- SPIRE integration for identity federation
+
+For additional compatibility considerations refer to: link:../common/coexistence.adoc[Sidecar-Ambient Coexistence Guidelines]
+
+[[pre-migration-checklist]]
+=== 2.3 Pre-Migration Checklist
+
+**Environment Validation:**
+[source,console]
+----
+# Verify Sail Operator is deployed
+kubectl get pods -n sail-operator
+----
+
+[source,console]
+----
+# Check Istio control plane version
+kubectl get istio -n istio-system
+NAME      NAMESPACE      PROFILE   REVISIONS   READY   IN USE   ACTIVE REVISION   STATUS    VERSION   AGE
+default   istio-system             1           1       1        default           Healthy   v1.27.0   20m
+----
+
+[NOTE]
+====
+* If you have any of the unsupported features like VirtualServices or DestinationRules, during Step 5 you will need to migrate those to be compatible with ambient mode.
+* Ambient supports PeerAuthentication, but disabled mode is not supported. More information: https://istio.io/latest/docs/reference/config/security/peer_authentication/
+* Migrate ingress gateways to use Gateway API resources before migration. More information: https://istio.io/latest/docs/reference/config/networking/gateway/
+====
+
+**Application Namespace Validation:**
+
+[source,console]
+----
+# Check your application namespaces for sidecar injection
+kubectl get namespaces -l istio.io/rev=default #or any other istio revision name. Also, check if you are using instead istio-injection=enabled label.
+NAME       STATUS   AGE
+bookinfo   Active   6m56
+----
+
+[source,console]
+----
+# Check current workloads with sidecar injection
+kubectl get pods -n bookinfo
+NAME                                      READY   STATUS    RESTARTS   AGE
+bookinfo-gateway-istio-75d96b45d9-m65mq   1/1     Running   0          4m31s
+details-v1-646f945867-2gg99               2/2     Running   0          6m6s
+productpage-v1-7dbcd8849-4pmjt            2/2     Running   0          6m6s
+ratings-v1-9bd8c8595-266zs                2/2     Running   0          6m6s
+reviews-v1-5fd7b88d9-7vqxf                2/2     Running   0          6m5s
+reviews-v2-54ff7fcf79-22k8r               2/2     Running   0          6m5s
+reviews-v3-6445668877-gdr22               2/2     Running   0          6m5s
+----
+
+[source,console]
+----
+# Check current gateway API being used
+kubectl get gateway -n bookinfo
+NAME               CLASS   ADDRESS       PROGRAMMED   AGE
+bookinfo-gateway   istio   10.0.147.96   True         5m41s
+----
+
+Note: You can check that your application is getting requests through the mesh by using Kiali. You should see traffic flowing between the services for every request to your application.
+
+image:./images/kiali-bookinfo-traffic.png[Kiali Bookinfo Traffic]
+
+For testing purposes during migration, you can generate traffic to your application's main service using commands similar to:
+
+[source,console]
+----
+# Generate traffic to productpage service
+export INGRESS_HOST=$(kubectl get gtw bookinfo-gateway -n bookinfo -o jsonpath='{.status.addresses[0].value}')
+export INGRESS_PORT=$(kubectl get gtw bookinfo-gateway -n bookinfo -o jsonpath='{.spec.listeners[?(@.name=="http")].port}')
+export GATEWAY_URL=$INGRESS_HOST:$INGRESS_PORT
+while true; do
+  STATUS=$(curl -s -w "%{http_code}" -o /dev/null --connect-timeout 5 "http://$GATEWAY_URL/productpage")
+  TIMESTAMP=$(date +'%Y-%m-%d %H:%M:%S')
+  if [ "$STATUS" -eq 200 ]; then
+    echo "[$TIMESTAMP] Request OK"
+  else
+    echo "[$TIMESTAMP] Request KO - Status code: $STATUS"
+  fi
+  sleep 1
+done
+----
+
+[[backup-existing-configuration]]
+=== 2.4 Backup Existing Configuration
+
+Before starting migration, back up all existing Istio resources and namespace labels:
+[source,console]
+----
+# Backup all Istio resources
+kubectl get istio,istiocni,virtualservice,destinationrule,authorizationpolicy,requestauthentication,httproute,gateway,peerauthentication -A -o yaml > istio-backup.yaml
+
+# Backup namespace labels
+kubectl get namespaces -o yaml > namespace-backup.yaml
+----
+
+**Note**: This backup is critical for rollback if issues arise during migration. Please add any resources specific to your environment that may not be covered here.
+
+[[migration-steps]]
+== 3. Migration Steps
+
+This migration follows a structured step-by-step approach, with each step including detailed instructions, commands, and validation checks.
+
+**Critical Sequencing Rules:**
+
+- All waypoints must be enabled BEFORE removing any sidecars
+- Policies must be migrated and validated BEFORE removing sidecar policies
+- ZTunnel must be fully operational before enabling ambient mode
+
+[[step-1-prerequisites-validation]]
+=== Step 1: Prerequisites Validation
+
+Before starting migration, validate your cluster meets all requirements and check the current configuration for compatibility.
+
+**Enhanced Policy Compatibility Check:**
+[source,console]
+----
+# Check for Layer 7-only authorization policies that will require waypoints
+kubectl get authorizationpolicy -A -o yaml | grep -E "(methods|paths|headers)" | grep -v "name:"
+
+# Identify VirtualServices with subset-based routing requiring service migration
+kubectl get virtualservice -A -o yaml | grep -B5 -A10 "subset:" | grep -E "(name:|subset:)"
+
+# Check for unsupported features that need manual conversion
+kubectl get virtualservice -A -o yaml | grep -E "(fault|delay|mirror)" | grep -v "name:"
+----
+
+**Migration Readiness Assessment:**
+[source,console]
+----
+# List all resources that need conversion
+echo "=== VirtualServices requiring HTTPRoute conversion ==="
+kubectl get virtualservice -A --no-headers | wc -l
+
+echo "=== DestinationRules with subsets requiring service creation ==="
+kubectl get destinationrule -A -o yaml | grep -c "subset:"
+
+echo "=== Authorization policies requiring waypoint deployment ==="
+kubectl get authorizationpolicy -A -o yaml | grep -c -E "(methods|paths|headers)"
+----
+
+Note: In the step 5 of this guide you will need to migrate unsupported features. This includes:
+
+- Converting VirtualServices and DestinationRules to HTTPRoute and Gateway resources
+- Creating granular services to replace subset-based routing
+- Identifying which policies require waypoint deployment for Layer 7 processing
+
+**Migration Blockers (must resolve before proceeding):**
+
+- Multi-cluster mesh configurations
+- VM workload integration
+- SPIRE integration
+- Istio version < 1.24
+
+[[step-2-cluster-setup-enable-ambient-support]]
+=== Step 2: Cluster Setup - Enable Ambient Support
+
+[[step-21-update-istio-configuration]]
+==== Step 2.1 Update Istio Configuration
+
+Update your existing Istio resource:
+
+[source,yaml]
+----
+apiVersion: sailoperator.io/v1
+kind: Istio
+metadata:
+  name: default
+  namespace: istio-system
+spec:
+  version: v1.27.0
+  namespace: istio-system
+  updateStrategy:
+    type: InPlace # Set your preferred update strategy
+  profile: ambient
+  values:
+    pilot:
+      trustedZtunnelNamespace: ztunnel
+    # Preserve existing customizations
+    # Add any existing values configuration here
+----
+
+Apply the updated configuration:
+[source,console]
+----
+kubectl apply -f istio-ambient.yaml
+kubectl wait --for=condition=Ready istios/default --timeout=5m
+----
+
+[[step-22-deploy-istio-cni-for-ambient]]
+==== Step 2.2 Deploy Istio CNI for Ambient
+
+Create or update the IstioCNI resource:
+
+[source,yaml]
+----
+apiVersion: sailoperator.io/v1
+kind: IstioCNI
+metadata:
+  name: default
+spec:
+  namespace: istio-cni
+  profile: ambient
+  # Preserve existing customizations
+----
+
+Apply the CNI configuration:
+[source,console]
+----
+# Create Istio CNI namespace if it doesn't exist
+kubectl create namespace istio-cni
+# Apply Istio CNI configuration
+kubectl apply -f istio-cni-ambient.yaml
+kubectl wait --for=condition=Ready istiocnis/default --timeout=3m
+----
+
+[[step-23-deploy-ztunnel-proxies]]
+==== Step 2.3 Deploy ZTunnel Proxies
+
+Create the ZTunnel namespace and resource:
+
+[source,console]
+----
+kubectl create namespace ztunnel
+# If you are using discoverySelectors, label the namespace accordingly
+kubectl label namespace ztunnel istio-discovery=enabled
+----
+
+[source,yaml]
+----
+apiVersion: sailoperator.io/v1
+kind: ZTunnel
+metadata:
+  name: default
+spec:
+  namespace: ztunnel
+----
+
+[source,console]
+----
+kubectl apply -f ztunnel.yaml
+kubectl wait --for=condition=Ready ztunnel/default --timeout=3m
+----
+
+**Validation:**
+[source,console]
+----
+# Verify ZTunnel pods are running on all nodes
+kubectl get pods -n ztunnel -o wide
+kubectl get daemonset -n ztunnel
+----
+
+[source,console]
+----
+# Confirm cluster setup validation passes
+kubectl get ztunnel -n ztunnel
+NAME      NAMESPACE   PROFILE   READY   STATUS    VERSION   AGE
+default   ztunnel               True    Healthy   v1.27.0   12m
+----
+
+**If rollback needed**: See <<rollback-procedures,Section 5.2 Rollback Procedures>> for Step 2 cluster setup rollback instructions (Low Risk).
+
+[[step-3-update-sidecars-for-hbone-support]]
+=== Step 3: Update Sidecars for HBONE Support
+
+[[step-31-enable-hbone-protocol-support]]
+==== Step 3.1 Enable HBONE Protocol Support
+
+Existing sidecars need to support the HBONE protocol. Restart deployments in all sidecar-injected namespaces:
+
+[source,console]
+----
+# Restart workloads in each application namespace
+kubectl rollout restart deployment -n bookinfo
+
+# Verify pods have restarted
+kubectl get pods -n bookinfo
+----
+Note: during the restart, sidecars will be updated to support HBONE while still functioning as traditional sidecars. Having HBONE support enabled is a prerequisite for ambient mode.
+
+[[step-32-validate-hbone-capability]]
+==== Step 3.2 Validate HBONE Capability
+
+Check that sidecars now support HBONE protocol:
+
+[source,console]
+----
+# Check for HBONE is enabled in sidecar
+$ kubectl get pod $(kubectl get pods -n bookinfo -l app=ratings -o jsonpath='{.items[0].metadata.name}') -n bookinfo -o yaml | yq '.spec.containers[] | select(.name=="istio-proxy") | .env[] | select(.name=="PROXY_CONFIG")'
+name: PROXY_CONFIG
+value: |
+  {"proxyMetadata":{"ISTIO_META_ENABLE_HBONE":"true"},"image":{"imageType":"distroless"}}
+----
+
+As shown above, the `ISTIO_META_ENABLE_HBONE` environment variable is set to `true`, indicating HBONE support is enabled.
+
+[[step-33-connectivity-validation]]
+==== Step 3.3 Connectivity Validation
+Send requests to ensure connectivity remains intact:
+[source,console]
+----
+# Test service connectivity through sidecars
+$ kubectl exec $(kubectl get pods -n bookinfo -l app=ratings -o jsonpath='{.items[0].metadata.name}') -n bookinfo -- curl http://reviews.bookinfo:9080/reviews/1
+{
+  "id": "1",
+  "podname": "reviews-v1-75797bd984-7b5g6",
+  "clustername": "null",
+  "reviews": [
+    {
+      "reviewer": "Reviewer1",
+      "text": "An extremely entertaining play by Shakespeare. The play lacks thematic depth when compared to other plays by the author."
+    },
+    {
+      "reviewer": "Reviewer2",
+      "text": "Absolutely fun and entertaining. The play lacks thematic depth when compared to other plays by Shakespeare."
+    }
+  ]
+}
+----
+
+Note: At this point, sidecars are fully functional with HBONE support, but traffic is still flowing through the sidecars as before.
+
+**Critical**: Do NOT remove sidecars yet. They must remain until waypoints are fully deployed and active in Step 7.
+
+Test connectivity from outside the mesh:
+[source,console]
+----
+# Test ingress connectivity
+$ curl -s http://$GATEWAY_URL/productpage | grep title
+<title>Simple Bookstore App</title>
+----
+
+Traffic should continue flowing as before. This confirms that sidecars are still handling traffic.
+
+**If rollback needed**: See <<rollback-procedures,Section 5.2 Rollback Procedures>> for Step 3 HBONE support rollback instructions (Low Risk).
+
+[[step-4-deploy-waypoint-proxies]]
+=== Step 4: Deploy Waypoint Proxies
+
+[[step-41-identify-services-requiring-l7-features]]
+==== Step 4.1 Identify Services Requiring L7 Features
+
+Analyze your current configuration to identify services that need waypoint proxies:
+
+[source,console]
+----
+# Check for existing L7 policies that will need waypoints
+kubectl get virtualservice,httproute -A
+kubectl get authorizationpolicy -A -o yaml | grep -A 10 -B 5 "rules.*methods\|operation"
+----
+
+[[step-42-create-waypoint-configurations]]
+==== Step 4.2 Create Waypoint Configurations
+
+Create waypoints for namespaces requiring L7 processing:
+
+**Example Waypoint for bookinfo namespace:**
+[source,yaml]
+----
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: waypoint
+  namespace: bookinfo
+  labels:
+    istio.io/waypoint-for: service
+spec:
+  gatewayClassName: istio-waypoint
+  listeners:
+  - name: mesh
+    port: 15008
+    protocol: HBONE
+----
+
+Apply the waypoint configurations:
+[source,console]
+----
+kubectl apply -f waypoint-bookinfo.yaml
+----
+
+**Important**: Deploying a waypoint does not automatically make workloads use it. You must explicitly configure namespaces, services, or pods to use the waypoint.
+
+Verify that waypoints are deployed correctly:
+[source,console]
+----
+kubectl get gateway waypoint -n bookinfo
+kubectl get deployment -n bookinfo -l gateway.networking.k8s.io/gateway-name=waypoint
+kubectl get pods -n bookinfo -l gateway.networking.k8s.io/gateway-name=waypoint
+# Verify waypoint is not yet active
+kubectl get namespace bookinfo -o jsonpath='{.metadata.labels.istio\.io/use-waypoint}'
+----
+
+**If rollback needed**: See <<rollback-procedures,Section 5.2 Rollback Procedures>> for Step 4 waypoint deployment rollback instructions (Low Risk).
+
+[[step-5-migrate-traffic-policies]]
+=== Step 5: Migrate Traffic Policies
+
+[[step-51-convert-virtualservices-to-httproutes]]
+==== Step 5.1 Convert VirtualServices to HTTPRoutes
+
+**Understanding Resource Conversion:**
+
+Ambient mode uses the Kubernetes Gateway API instead of Istio's VirtualService and DestinationRule resources for traffic management. This migration requires converting your existing Istio traffic policies to Gateway API equivalents:
+
+- **VirtualService** to **HTTPRoute**: Traffic routing, header matching, fault injection
+- **DestinationRule subsets** to **Version-specific Services**: Since Gateway API doesn't support subset-based routing
+
+For comprehensive conversion guidance, refer to:
+
+- https://istio.io/latest/docs/reference/config/networking/virtual-service/[Istio VirtualService]
+- https://gateway-api.sigs.k8s.io/guides/http-routing/[Gateway API HTTPRoute Documentation]
+
+[[step-511-create-version-specific-services-required-for-httproute]]
+===== Step 5.1.1 Create Version-Specific Services (Required for HTTPRoute)
+
+Gateway API HTTPRoute doesn't support DestinationRule subsets. You must create individual services for each application version to enable version-specific routing:
+
+[source,yaml]
+----
+apiVersion: v1
+kind: Service
+metadata:
+  name: reviews-v1
+  namespace: bookinfo
+spec:
+  selector:
+    app: reviews
+    version: v1
+  ports:
+  - name: http
+    port: 9080
+    targetPort: 9080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: reviews-v2
+  namespace: bookinfo
+spec:
+  selector:
+    app: reviews
+    version: v2
+  ports:
+  - name: http
+    port: 9080
+    targetPort: 9080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: reviews-v3
+  namespace: bookinfo
+spec:
+  selector:
+    app: reviews
+    version: v3
+  ports:
+  - name: http
+    port: 9080
+    targetPort: 9080
+----
+
+Apply the version-specific services:
+[source,console]
+----
+kubectl apply -f reviews-version-services.yaml
+----
+
+[[step-512-convert-virtualservice-to-httproute]]
+===== Step 5.1.2 Convert VirtualService to HTTPRoute
+
+**Key Conversion Concepts:**
+
+When converting VirtualService to HTTPRoute, understand these mapping principles:
+
+- **spec.hosts** to **spec.parentRefs**: HTTPRoute attaches to Services instead of declaring hosts
+- **spec.http.match** to **spec.rules.matches**: Similar header/path matching syntax
+- **spec.http.route.destination.subset** to **spec.rules.backendRefs.name**: Direct service references instead of subsets
+- **spec.http.fault**, **spec.http.timeout** → Use HTTPRoute filters or Istio policy resources
+
+**Example Conversion:**
+
+**Before (VirtualService):**
+[source,yaml]
+----
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: reviews
+  namespace: bookinfo
+spec:
+  hosts:
+  - reviews
+  http:
+  - match:
+    - headers:
+        end-user:
+          exact: jason
+    route:
+    - destination:
+        host: reviews
+        subset: v2
+  - route:
+    - destination:
+        host: reviews
+        subset: v1
+----
+
+**After (HTTPRoute):**
+[source,yaml]
+----
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: reviews
+  namespace: bookinfo
+spec:
+  parentRefs:
+  - name: bookinfo-gateway # Attach to existing gateway
+  rules:
+  - matches:
+    - headers:
+      - name: end-user
+        value: jason
+    backendRefs:
+    - name: reviews-v2
+      port: 9080
+  - backendRefs:
+    - name: reviews-v1
+      port: 9080
+----
+
+**Apply the HTTPRoute:**
+
+[source,console]
+----
+kubectl apply -f reviews-httproute.yaml
+----
+
+**Key Differences Explained:**
+
+1. **Service Attachment**: HTTPRoute attaches to the original `reviews` service via `parentRefs`, intercepting traffic to that service.
+2. **Version Routing**: Instead of DestinationRule subsets, HTTPRoute uses version-specific services (`reviews-v1`, `reviews-v2`).
+3. **Header Matching**: Similar syntax to VirtualService but uses Gateway API format.
+4. **Backward Compatibility**: Original service remains functional; HTTPRoute adds routing logic on top.
+
+For complex routing scenarios (fault injection, retries, timeouts), you may need additional Gateway API filters or maintain some Istio policies alongside HTTPRoute.
+
+[[step-52-create-waypoint-targeted-authorization-policies]]
+==== Step 5.2 Create Waypoint-Targeted Authorization Policies
+
+Create waypoint-targeted authorization policies while maintaining existing sidecar policies during transition. These policies should match your actual service account structure:
+
+**Example bookinfo Authorization Policies:**
+
+[source,yaml]
+----
+# ProductPage service authorization - allows traffic from gateway
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: productpage-waypoint
+  namespace: bookinfo
+spec:
+  targetRefs:
+  - kind: Service
+    group: ""
+    name: productpage
+  action: ALLOW
+  rules:
+  - from:
+    - source:
+        principals:
+        - cluster.local/ns/bookinfo/sa/bookinfo-gateway-istio
+    to:
+    - operation:
+        methods: ["GET", "POST"]
+---
+# Reviews service authorization - allows traffic from productpage
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: reviews-waypoint
+  namespace: bookinfo
+spec:
+  targetRefs:
+  - kind: Service
+    group: ""
+    name: reviews
+  action: ALLOW
+  rules:
+  - from:
+    - source:
+        principals:
+        - cluster.local/ns/bookinfo/sa/bookinfo-productpage
+        - cluster.local/ns/bookinfo/sa/bookinfo-reviews
+    to:
+    - operation:
+        methods: ["GET"]
+---
+# Ratings service authorization - allows traffic from reviews
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: ratings-waypoint
+  namespace: bookinfo
+spec:
+  targetRefs:
+  - kind: Service
+    group: ""
+    name: ratings
+  action: ALLOW
+  rules:
+  - from:
+    - source:
+        principals:
+        - cluster.local/ns/bookinfo/sa/bookinfo-reviews
+    to:
+    - operation:
+        methods: ["GET"]
+---
+# Details service authorization - allows traffic from productpage
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: details-waypoint
+  namespace: bookinfo
+spec:
+  targetRefs:
+  - kind: Service
+    group: ""
+    name: details
+  action: ALLOW
+  rules:
+  - from:
+    - source:
+        principals:
+        - cluster.local/ns/bookinfo/sa/bookinfo-productpage
+    to:
+    - operation:
+        methods: ["GET"]
+----
+
+**Note**: The service account names should match your actual deployment. Adjust the principal names if your service accounts use different naming conventions. To verify the service accounts you can run:
+
+[source,console]
+----
+# Check actual service accounts used by your application pods
+kubectl get pods -n bookinfo -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.serviceAccountName}{"\n"}{end}'
+----
+
+**Apply the authorization policies:**
+[source,console]
+----
+kubectl apply -f bookinfo-waypoint-authz-policies.yaml
+----
+
+[[step-53-add-ztunnel-bypass-protection-critical-security-step]]
+==== Step 5.3 Add Ztunnel Bypass Protection (Critical Security Step)
+
+**Security Warning**: In ambient mode, waypoint-targeted policies can be bypassed if traffic flows directly through ztunnel, because the ztunnel itself cannot enforce Layer 7 (L7) policies. Add protection policies to prevent this:
+
+[source,yaml]
+----
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: productpage-ztunnel-protection
+  namespace: bookinfo
+spec:
+  targetRefs:
+  - kind: Service
+    group: ""
+    name: productpage
+  action: DENY
+  rules:
+  - when:
+    - key: source.workload_name
+      notValues: ["waypoint"]
+---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: reviews-ztunnel-protection
+  namespace: bookinfo
+spec:
+  targetRefs:
+  - kind: Service
+    group: ""
+    name: reviews
+  action: DENY
+  rules:
+  - when:
+    - key: source.workload_name
+      notValues: ["waypoint"]
+----
+
+Apply the protection policies:
+[source,console]
+----
+kubectl apply -f ztunnel-protection-policies.yaml
+----
+
+[source,console]
+----
+# Verify policies are created
+$ kubectl get authorizationpolicy -n <NAMESPACE>
+NAME                             ACTION   AGE
+productpage-waypoint             ALLOW    18s
+productpage-ztunnel-protection   DENY     7s
+reviews-waypoint                 ALLOW    17s
+reviews-ztunnel-protection       DENY     6s
+----
+
+**Critical**: Keep existing sidecar policies active until Policy Simplification step.
+
+Test that services are still accessible (policies not yet enforced):
+[source,console]
+----
+NAMESPACE="bookinfo" # Replace with your namespace
+TEST_POD=$(kubectl get pods -n $NAMESPACE -l app=reviews -o jsonpath='{.items[0].metadata.name}')
+HTTP_STATUS=$(kubectl exec $TEST_POD -n $NAMESPACE -- curl -s -w "%{http_code}" -o /dev/null http://reviews.$NAMESPACE:9080/reviews/1)
+if [[ "$HTTP_STATUS" == "200" ]]; then
+  echo "PASS: Service connectivity still working"
+else
+  echo "FAIL: Service connectivity failed: HTTP $HTTP_STATUS"
+  exit 1
+fi
+----
+
+**If rollback needed**: See <<rollback-procedures,Section 5.2 Rollback Procedures>> for Step 5 policy migration rollback instructions (Medium Risk).
+
+[[step-6-enable-ambient-mode-for-applications]]
+=== Step 6: Enable Ambient Mode for Applications
+
+[[step-61-gradual-namespace-migration]]
+==== Step 6.1 Gradual Namespace Migration
+
+We recommend enabling ambient mode for one namespace at a time, starting with the least critical. Replace `bookinfo` with your actual namespace name:
+
+[source,console]
+----
+kubectl label namespace bookinfo istio.io/dataplane-mode=ambient
+----
+
+[source,console]
+----
+# Verify ztunnel configuration for each namespace
+$ istioctl ztunnel-config workloads --namespace ztunnel | grep bookinfo
+bookinfo                                         bookinfo-gateway-istio-6b9cf4b8c8-xxsq2                     10.128.2.58   user-rhos-d-4-9b684-worker-0-4fhm6 None     TCP
+bookinfo                                         details-v1-bb955f94b-4sppn                                  10.128.2.59   user-rhos-d-4-9b684-worker-0-4fhm6 None     HBONE
+bookinfo                                         productpage-v1-c4cb9cb4b-ghzwc                              10.128.2.60   user-rhos-d-4-9b684-worker-0-4fhm6 None     HBONE
+bookinfo                                         ratings-v1-bc5f6b4fd-qvr6m                                  10.128.2.61   user-rhos-d-4-9b684-worker-0-4fhm6 None     HBONE
+bookinfo                                         reviews-v1-9db68f4d-v4cnb                                   10.128.2.62   user-rhos-d-4-9b684-worker-0-4fhm6 None     HBONE
+bookinfo                                         reviews-v2-646d654b58-gmht2                                 10.128.2.63   user-rhos-d-4-9b684-worker-0-4fhm6 None     HBONE
+bookinfo                                         reviews-v3-86bb4fb6fb-b946t                                 10.128.2.64   user-rhos-d-4-9b684-worker-0-4fhm6 None     HBONE
+bookinfo                                         waypoint-58cdc7f494-98h79                                   10.128.2.65   user-rhos-d-4-9b684-worker-0-4fhm6 None     TCP
+----
+
+**Validation after each namespace:**
+[source,console]
+----
+# Test connectivity after enabling each namespace, e.g., bookinfo
+kubectl exec -n bookinfo $(kubectl get pods -n bookinfo -l app=ratings -o jsonpath='{.items[0].metadata.name}') -- curl http://reviews.bookinfo:9080/
+----
+
+**Important**: at this point sidecars are still present and handling traffic. Do NOT remove sidecars yet.
+
+**If rollback needed**: See <<rollback-procedures,Section 5.2 Rollback Procedures>> for Step 6 ambient mode activation rollback instructions (High Risk).
+
+[[step-7-enable-waypoint-processing]]
+=== Step 7: Enable Waypoint Processing
+
+[[step-71-activate-waypoints-for-l7-processing]]
+==== Step 7.1 Activate Waypoints for L7 Processing
+
+**Critical Sequencing**: Only activate waypoints AFTER all required namespaces are in ambient mode.
+
+**Understanding Waypoint Activation:**
+
+Up to this point, waypoint proxies have been deployed but are not processing any traffic. They remain dormant until you explicitly configure workloads to use them. This activation happens through labeling:
+
+**Namespace-level Activation (recommended):**
+[source,console]
+----
+# Enable waypoint for all services in the namespace
+kubectl label namespace bookinfo istio.io/use-waypoint=waypoint
+----
+
+**Service-level Activation (granular control):**
+[source,console]
+----
+# Enable waypoint for specific services only
+kubectl label service <SERVICE_NAME> istio.io/use-waypoint=<WAYPOINT_NAME> -n <NAMESPACE>
+----
+
+**Verify waypoint activation:**
+[source,console]
+----
+# Check waypoint pod is running
+kubectl get pods -n bookinfo -l gateway.networking.k8s.io/gateway-name=waypoint
+
+# Verify namespace/service labels
+kubectl get namespace <NAMESPACE> --show-labels
+kubectl get service <SERVICE_NAME> -n <NAMESPACE> --show-labels
+----
+
+**Critical Identity Security Consideration**:
+
+Waypoints do not spoof client identity. When ztunnel processes traffic from waypoints, it sees the waypoint's identity, not the original client's identity. This has important implications:
+
+1. **Authorization policies targeting client identities must be applied at the waypoint level**, not at the ztunnel level
+2. **Ztunnel-level policies will see all traffic as coming from the waypoint**
+3. **Client identity validation should be configured in waypoint-targeted policies**
+
+Ensure your authorization policies account for this identity behavior when validating security enforcement.
+
+**Important**: Enable ALL required waypoints before removing ANY sidecars to maintain policy enforcement.
+
+**If rollback needed**: See <<rollback-procedures,Section 5.2 Rollback Procedures>> for Step 7 waypoint activation rollback instructions (High Risk).
+
+[[step-8-policy-simplification]]
+=== Step 8: Policy Simplification
+
+[[step-81-remove-redundant-sidecar-policies]]
+==== Step 8.1 Remove Redundant Sidecar Policies
+
+Once traffic flows through waypoints, remove duplicate sidecar-specific policies:
+
+[source,console]
+----
+# List all authorization policies to identify duplicates
+kubectl get authorizationpolicy -A
+# List virtual services to identify those replaced by HTTPRoutes
+kubectl get virtualservice -A
+----
+
+Delete the redundant sidecar policies by running the following commands:
+[source,console]
+----
+# Example: Remove sidecar-specific authorization policies
+kubectl delete authorizationpolicy <authorizationpolicy-name> -n <NAMESPACE>
+
+# Example: Remove sidecar-specific virtual services
+kubectl delete virtualservice <virtualservice-name> -n <NAMESPACE>
+----
+
+**If rollback needed**: See <<rollback-procedures,Section 5.2 Rollback Procedures>> for Step 8 policy cleanup rollback instructions (Medium Risk).
+
+[[step-9-remove-sidecar-injection]]
+=== Step 9: Remove Sidecar Injection
+
+[[step-91-disable-sidecar-injection]]
+==== Step 9.1 Disable Sidecar Injection
+
+**Final step**: Remove sidecar injection now that ambient mode is fully operational:
+
+[source,console]
+----
+# Remove sidecar injection while preserving ambient mode labels
+kubectl label namespace bookinfo istio.io/rev- istio.io/dataplane-mode=ambient
+
+# Restart deployments to remove sidecars
+kubectl rollout restart deployment -n bookinfo
+----
+
+[[step-92-validate-sidecar-removal]]
+==== Step 9.2 Validate Sidecar Removal
+
+Verify sidecars are removed and ambient mode is working:
+
+[source,console]
+----
+# Verify pods no longer have sidecars containers in the application pods
+kubectl get pods -n bookinfo
+----
+
+Checking on Kiali should show traffic flowing through ambient mode. You should see traffic flowing through ztunnel and waypoints instead of sidecars.
+
+[[step-93-validate-l7-policy-enforcement]]
+==== Step 9.3 Validate L7 Policy Enforcement
+
+Test that L7 policies are now enforced through waypoints (L7 policies should work as before after waypoint activation):
+
+[source,console]
+----
+# Test authorization policies work through waypoint
+kubectl exec -n bookinfo $(kubectl get pods -n bookinfo -l app=ratings -o jsonpath='{.items[0].metadata.name}') -- curl -v http://reviews.bookinfo:9080/reviews/1
+{"id": "1","podname": "reviews-v3-dd9d6fc89-6glvk","clustername": "null","reviews": [{  "reviewer": "Reviewer1",  "text": "An extremely entertaining play by Shakespeare. The slapstick humor is refreshing!", "rating": {"stars": 5, "color": "red"}},{  "reviewer": "Reviewer2",  "text": "Absolutely fun and entertaining. The play lacks thematic depth when compared to other plays by Shakespeare.", "rating": {"stars": 4, "color": "red"}}]}
+----
+
+[source,console]
+----
+# Test traffic routing through waypoint with header (if HTTPRoute configured)
+$ kubectl exec -n bookinfo $(kubectl get pods -n bookinfo -l app=ratings -o jsonpath='{.items[0].metadata.name}') -- curl -H "end-user: jason" http://reviews.bookinfo:9080/reviews/1
+{"id": "1","podname": "reviews-v2-67ff7bcdc5-kklgl","clustername":"null","reviews": [{  "reviewer": "Reviewer1",  "text": "An extremely entertaining play by Shakespeare. The slapstick humor is refreshing!","rating": {"stars": 5, "color": "black"}},{  "reviewer": "Reviewer2",  "text": "Absolutely fun and entertaining. The play lacks thematic depthwhen compared to other plays by Shakespeare.","rating": {"stars": 4, "color": "black"}}]}
+----
+
+Note: L7 policies should function as before, now enforced through waypoints instead of sidecars. Take into account that according to the configuration example that we applied before, requests with the `end-user: jason` header should route to `reviews-v2` and requests without that header should route to `reviews-v1` or `reviews-v3`.
+
+
+Test external connectivity (if gateway configured):
+[source,console]
+----
+# Test external connectivity through gateway
+export INGRESS_HOST=$(kubectl get gtw bookinfo-gateway -n bookinfo -o jsonpath='{.status.addresses[0].value}')
+export INGRESS_PORT=$(kubectl get gtw bookinfo-gateway -n bookinfo -o jsonpath='{.spec.listeners[?(@.name=="http")].port}')
+export GATEWAY_URL=$INGRESS_HOST:$INGRESS_PORT
+if [[ -n "$GATEWAY_URL" ]]; then
+  EXTERNAL_STATUS=$(curl -s -w "%{http_code}" -o /dev/null --connect-timeout 5 "http://$GATEWAY_URL/productpage")
+  if [[ "$EXTERNAL_STATUS" == "200" ]]; then
+    echo "PASS: External connectivity working"
+  else
+    echo "FAIL: External connectivity failed: HTTP $EXTERNAL_STATUS"
+    exit 1
+  fi
+else
+  echo "INFO: No gateway URL configured - skipping external connectivity test"
+fi
+----
+
+**If rollback needed**: See <<rollback-procedures,Section 5.2 Rollback Procedures>> for Step 9 sidecar removal rollback instructions (Very High Risk). Two emergency rollback options are available.
+
+
+**The migration is completed!** Applications now run in ambient mode with:
+
+- No sidecar containers
+- mTLS via ztunnel
+- L7 policies via waypoints
+
+
+[[validation-and-testing]]
+== 4. Validation and Testing
+
+[[migration-verification]]
+=== 4.1 Migration Verification
+
+**mTLS Verification:**
+
+[source,console]
+----
+# Check ztunnel protocols for the bookinfo namespace
+istioctl ztunnel-config workloads -n ztunnel |grep bookinfo
+bookinfo                                         bookinfo-gateway-istio-86496d9445-fgczp                     10.128.2.66   user-rhos-d-4-9b684-worker-0-4fhm6 None     TCP
+bookinfo                                         details-v1-584b5c5f6c-dhkjx                                 10.128.2.67   user-rhos-d-4-9b684-worker-0-4fhm6 None     HBONE
+bookinfo                                         productpage-v1-7b5749b8bf-96mmg                             10.128.2.68   user-rhos-d-4-9b684-worker-0-4fhm6 None     HBONE
+bookinfo                                         ratings-v1-cd589f595-wrjds                                  10.128.2.69   user-rhos-d-4-9b684-worker-0-4fhm6 None     HBONE
+bookinfo                                         reviews-v1-695599f9d5-58626                                 10.128.2.70   user-rhos-d-4-9b684-worker-0-4fhm6 None     HBONE
+bookinfo                                         reviews-v2-6bc5c6b6cf-4nqpq                                 10.128.2.71   user-rhos-d-4-9b684-worker-0-4fhm6 None     HBONE
+bookinfo                                         reviews-v3-5866bd5557-g86wx                                 10.128.2.72   user-rhos-d-4-9b684-worker-0-4fhm6 None     HBONE
+bookinfo                                         waypoint-748b7f45c6-vxlnd                                   10.128.2.73   user-rhos-d-4-9b684-worker-0-4fhm6 None     TCP
+----
+
+**Validate using Kiali:**
+After migration, use Kiali to visualize the service mesh. You should see traffic flowing through ztunnel and waypoints instead of sidecars. You will see the ztunnel as a node in the graph, and the waypoints as nodes for each namespace.
+
+[[troubleshooting]]
+== 5. Troubleshooting
+
+[[common-issues]]
+=== 5.1 Common Issues
+
+For comprehensive troubleshooting guidance, refer to:
+
+- https://istio.io/latest/docs/ambient/usage/troubleshoot-waypoint/[Istio Ambient Troubleshooting Documentation]
+- https://istio.io/latest/docs/ops/diagnostic-tools/[Istio Diagnostic Tools]
+
+==== Step-Specific Error Scenarios
+
+**Errors - Cluster Setup Issues:**
+
+*Issue: ZTunnel pods failing to start*
+[source,console]
+----
+# Check ZTunnel DaemonSet status
+kubectl get daemonset -n ztunnel
+kubectl describe daemonset -n ztunnel
+
+# Common causes and solutions:
+# 1. Node selector issues
+kubectl get nodes --show-labels
+# 2. Resource constraints
+kubectl describe nodes | grep -A 5 "Allocated resources"
+# 3. Security context issues
+kubectl logs -n ztunnel -l app=ztunnel --tail=50
+----
+
+**Errors - HBONE Support Issues:**
+
+*Issue: Pods fail to restart after enabling HBONE*
+[source,console]
+----
+# Check deployment rollout status
+kubectl rollout status deployment -n <NAMESPACE>
+
+# Check for image pull errors or resource limits
+kubectl describe pods -n <NAMESPACE> | grep -A 10 "Events:"
+----
+
+*Issue: HBONE environment variable not set*
+[source,console]
+----
+# Check proxy configuration
+kubectl get pods -n <NAMESPACE> -o yaml | grep -A 5 -B 5 "PROXY_CONFIG"
+
+# Force pod recreation if HBONE not enabled
+kubectl delete pods -n <NAMESPACE> -l app=<SERVICE_NAME>
+kubectl rollout status deployment/<SERVICE_NAME>-v1 -n <NAMESPACE>
+----
+
+**Errors - Ambient Mode Activation Issues:**
+
+*Issue: Services not communicating after enabling ambient mode*
+[source,console]
+----
+# Check ztunnel logs for specific service issues
+kubectl logs -n ztunnel $(kubectl get pod -n ztunnel -l app=ztunnel -o jsonpath='{.items[0].metadata.name}') | grep <SERVICE_NAME>
+
+# Verify namespace labels are correct
+kubectl get namespace <NAMESPACE> --show-labels
+
+# Check istio-cni logs for traffic redirection issues
+kubectl logs -n istio-cni $(kubectl get pod -n istio-cni -l app.kubernetes.io/name=istio-cni -o jsonpath='{.items[0].metadata.name}') | grep <NAMESPACE>
+
+# Verify workloads are detected by ztunnel
+istioctl ztunnel-config workloads --namespace ztunnel | grep <NAMESPACE>
+----
+
+*Issue: Traffic still going through sidecars instead of ztunnel*
+[source,console]
+----
+# Verify ambient mode is actually enabled
+kubectl get namespace <NAMESPACE> -o jsonpath='{.metadata.labels.istio\.io/dataplane-mode}'
+
+# Check if CNI is redirecting traffic properly
+kubectl exec -n <NAMESPACE> $(kubectl get pods -n <NAMESPACE> -l app=<SERVICE_NAME> -o jsonpath='{.items[0].metadata.name}') -- netstat -rn
+# Look for ztunnel redirect rules
+
+# Force pod restart to pick up ambient mode
+kubectl rollout restart deployment -n <NAMESPACE>
+----
+
+**Errors - Waypoint Activation Issues:**
+
+*Issue: Policies not enforcing correctly*
+[source,console]
+----
+# Verify policy target configuration
+kubectl get authorizationpolicy -n <NAMESPACE> -o yaml
+
+# Check waypoint proxy status
+kubectl get gateway -n <NAMESPACE>
+kubectl get pods -n <NAMESPACE> -l gateway.networking.k8s.io/gateway-name=<WAYPOINT_NAME>
+
+# Verify waypoint is receiving traffic
+WAYPOINT_POD=$(kubectl get pods -n <NAMESPACE> -l gateway.networking.k8s.io/gateway-name=<WAYPOINT_NAME> -o jsonpath='{.items[0].metadata.name}')
+kubectl logs $WAYPOINT_POD -n <NAMESPACE> | grep -E "HTTP|GET|POST"
+
+# Check if use-waypoint label is correctly set
+kubectl get namespace <NAMESPACE> -o jsonpath='{.metadata.labels.istio\.io/use-waypoint}'
+----
+
+Compare the existing sidecar policies with the new waypoint-targeted policies to ensure they match. All the rules should be the same to ensure consistent enforcement.
+
+*Issue: L7 policies not working through waypoints*
+[source,console]
+----
+# Verify waypoint configuration
+kubectl get gateway <WAYPOINT_NAME> -n <NAMESPACE> -o yaml
+# Check gatewayClassName is "istio-waypoint"
+
+# Check authorization policy targeting
+kubectl get authorizationpolicy -n <NAMESPACE> -o yaml | grep -A 10 "targetRefs"
+# Ensure policies target the correct services
+
+# Test policy enforcement manually
+TEST_POD=$(kubectl get pods -n <NAMESPACE> -l app=<SERVICE_NAME> -o jsonpath='{.items[0].metadata.name}')
+kubectl exec $TEST_POD -n <NAMESPACE> -- curl -v -H "authorization: invalid" http://<SERVICE_NAME>.<NAMESPACE>:9080/
+# Should be denied if authorization policies are working
+----
+
+**General Connectivity Issues:**
+
+*Issue: High latency after migration*
+[source,console]
+----
+# Check waypoint proxy performance
+$ istioctl proxy-config listeners $(kubectl get pod -n <NAMESPACE> -l gateway.networking.k8s.io/gateway-name=<WAYPOINT_NAME> -o jsonpath='{.items[0].metadata.name}') -n <NAMESPACE>
+ADDRESSES PORT  MATCH DESTINATION
+          0     ALL   Cluster: inbound-vip|9080|http|<SERVICE1>.<NAMESPACE>.svc.cluster.local
+          0     ALL   Cluster: inbound-vip|9080|http|<SERVICE1>-v3.<NAMESPACE>.svc.cluster.local
+          0     ALL   Cluster: inbound-vip|9080|http|<SERVICE1>-v2.<NAMESPACE>.svc.cluster.local
+          0     ALL   Cluster: inbound-vip|9080|http|<SERVICE1>-v1.<NAMESPACE>.svc.cluster.local
+          0     ALL   Cluster: inbound-vip|9080|http|<SERVICE2>.<NAMESPACE>.svc.cluster.local
+          0     ALL   Cluster: inbound-vip|9080|http|<SERVICE2>-v1.<NAMESPACE>.svc.cluster.local
+          0     ALL   Cluster: inbound-vip|80|http|<GATEWAY_SERVICE>.<NAMESPACE>.svc.cluster.local
+          0     ALL   Cluster: inbound-vip|15021|tcp|<GATEWAY_SERVICE>.<NAMESPACE>.svc.cluster.local
+          0     ALL   Cluster: encap
+          0     ALL   Cluster: encap
+          0     ALL   Cluster: connect_originate
+0.0.0.0   15008 ALL   Inline Route:
+0.0.0.0   15021 ALL   Inline Route: /healthz/ready*
+0.0.0.0   15090 ALL   Inline Route: /stats/prometheus*
+----
+
+[source,console]
+----
+# Verify waypoint scaling
+kubectl get deployment -n <NAMESPACE> -l gateway.networking.k8s.io/gateway-name=<WAYPOINT_NAME>
+
+# Scale waypoints if needed
+kubectl scale deployment $(kubectl get deployment -n <NAMESPACE> -l gateway.networking.k8s.io/gateway-name=<WAYPOINT_NAME> -o jsonpath='{.items[0].metadata.name}') -n <NAMESPACE> --replicas=2
+----
+
+[[rollback-procedures]]
+=== 5.2 Rollback Procedures and Risk Matrix
+
+This section provides consolidated rollback procedures for each migration step, organized by risk level and recovery complexity.
+
+==== Rollback Decision Matrix
+
+[cols="1,1,2,3"]
+|===
+|Migration Step |Risk Level |Scenario |Rollback Actions
+
+|**Step 1-2 (Prerequisites & Cluster Setup)**
+|Low
+|Istio/CNI/ZTunnel configuration issues
+|Revert Istio profile, delete ZTunnel
+
+|**Step 3 (HBONE Support)**
+|Low
+|Pod restart failures
+|Rollback deployment revisions
+
+|**Step 4 (Waypoint Deployment)**
+|Low
+|Waypoint pods not starting
+|Delete waypoint resources
+
+|**Step 5 (Policy Migration)**
+|Medium
+|Policy conflicts causing traffic issues
+|Remove new policies, restore backups
+
+|**Step 6 (Ambient Mode Enable)**
+|High
+|Traffic flow disruption
+|Disable ambient mode labels
+
+|**Step 7 (Waypoint Activation)**
+|High
+|L7 policy enforcement failures
+|Disable waypoint usage
+
+|**Step 8 (Policy Cleanup)**
+|Medium
+|Accidental policy deletion
+|Restore from backup
+
+|**Step 9 (Sidecar Removal)**
+|Very High
+|Complete service failure
+|Emergency sidecar restoration
+|===
+
+==== Step-by-Step Rollback Procedures
+
+**Low Risk Rollbacks (Steps 1-4):**
+
+[source,console]
+----
+# Step 2 Rollback: Cluster Setup Issues
+# Replace the profile name if a custom profile was used
+kubectl patch istio default -n istio-system --type merge -p '{"spec":{"profile":"default"}}'
+kubectl patch istiocni default --type merge -p '{"spec":{"profile":"default"}}'
+kubectl delete ztunnel default -n ztunnel
+kubectl delete namespace ztunnel
+
+# Step 3 Rollback: HBONE Support Issues
+kubectl rollout undo deployment -n <NAMESPACE>
+
+# Step 4 Rollback: Waypoint Deployment Issues
+kubectl delete gateway <WAYPOINT_NAME> -n <NAMESPACE>
+# Waypoint deployments automatically cleaned up
+----
+
+**Medium Risk Rollbacks (Steps 5, 8):**
+
+[source,console]
+----
+# Step 5 Rollback: Policy Migration Issues
+kubectl delete authorizationpolicy -n <NAMESPACE> -l migration=waypoint
+kubectl delete authorizationpolicy -n <NAMESPACE> -l migration=protection
+kubectl delete httproute <HTTPROUTE_NAME> -n <NAMESPACE>
+# Original VirtualServices and sidecar policies remain active
+
+# Step 8 Rollback: Policy Cleanup Issues. Rollback to original policies using backup
+kubectl apply -f istio-backup.yaml
+# Review and manually remove duplicates after restoration
+----
+
+**High Risk Rollbacks (Steps 6-7):**
+
+[source,console]
+----
+# Step 6 Rollback: Ambient Mode Issues
+kubectl label namespace <NAMESPACE> istio.io/dataplane-mode-
+kubectl rollout restart deployment -n <NAMESPACE>
+# Sidecars restored, traffic back through sidecars
+
+# Step 7 Rollback: Waypoint Activation Issues
+kubectl label namespace <NAMESPACE> istio.io/use-waypoint-
+# L4 policies continue through ztunnel, L7 policies disabled
+----
+
+**Very High Risk Rollback (Step 9):**
+
+**Option 1 - Sidecar Restoration (Recommended):**
+
+[source,console]
+----
+#!/bin/bash
+# Rollback script - test before use in production
+
+echo "=== ROLLBACK: Restoring Sidecars ==="
+NAMESPACE=${1:-<YOUR_NAMESPACE>}
+
+# Step 1: Immediately re-enable sidecar injection
+kubectl label namespace $NAMESPACE istio.io/rev=default --overwrite
+echo "Sidecar injection re-enabled for $NAMESPACE"
+
+# Step 2: Restart deployments to get sidecars back
+kubectl rollout restart deployment -n $NAMESPACE
+echo "Deployments restarting..."
+
+# Step 3: Wait for rollout (with timeout)
+kubectl rollout status deployment -n $NAMESPACE --timeout=300s
+
+# Step 4: Validate service restoration
+TEST_POD=$(kubectl get pods -n $NAMESPACE -o jsonpath='{.items[0].metadata.name}' 2>/dev/null)
+if [[ -n "$TEST_POD" ]]; then
+    HTTP_STATUS=$(kubectl exec $TEST_POD -n $NAMESPACE -- curl -s -w "%{http_code}" -o /dev/null --connect-timeout 5 http://<SERVICE_NAME>.$NAMESPACE:9080/<SERVICE_PATH> 2>/dev/null || echo "000")
+    if [[ "$HTTP_STATUS" == "200" ]]; then
+        echo "SUCCESS: Emergency rollback completed - services restored"
+        echo "Both sidecars and ambient infrastructure are now active"
+    else
+        echo "WARNING: Service connectivity issues persist - manual intervention required"
+    fi
+else
+    echo "ERROR: No pods found - check deployment status"
+fi
+
+echo "Next step: Restore original policies: kubectl apply -f istio-backup.yaml"
+----
+
+==== Rollback Validation Checklist
+
+After any rollback, verify system health:
+
+[source,console]
+----
+# 1. Verify pod status
+kubectl get pods -n <NAMESPACE>
+
+# 2. Test service connectivity
+kubectl exec -n <NAMESPACE> $(kubectl get pods -n <NAMESPACE> -l app=<SERVICE_NAME> -o jsonpath='{.items[0].metadata.name}') -- curl http://<SERVICE_NAME>.<NAMESPACE>:9080/<SERVICE_PATH>
+
+# 3. Check sidecar presence (should be 2/2 for sidecars)
+kubectl get pods -n <NAMESPACE> --no-headers | grep "2/2.*Running" | wc -l
+
+# 4. Verify policy enforcement
+kubectl get authorizationpolicy -n <NAMESPACE>
+
+# 5. Test external connectivity (if applicable)
+curl -s http://$GATEWAY_URL/<YOUR_APPLICATION_PATH>
+----
+
+==== When to Use Each Rollback Option
+
+**Use Step-Specific Rollbacks when:**
+
+- Single step validation fails
+- Issues are isolated to specific components
+- Other migration steps are working correctly
+
+**Use Sidecar Restoration when:**
+
+- Service connectivity is disrupted
+- L7 policies are not enforcing correctly
+- Need immediate service restoration
+
+**Prevention Best Practices:**
+
+- Always create backups before starting migration
+- Test rollback procedures in non-production environments
+- Monitor service health continuously during migration
+- Keep original policies active until validation complete
+- Use gradual, namespace-by-namespace migration approach
+
+[[post-migration-optimization]]
+== 6. Post-Migration Optimization
+
+[[observability-considerations]]
+=== 6.1 Observability Considerations
+
+**Metrics Changes:**
+
+Understanding how metrics change in ambient mode is crucial for monitoring and troubleshooting:
+
+- **Without waypoints**: Only Layer 4 (TCP) metrics are available, as Layer 7 processing is not performed
+- **With waypoints**: Metrics show `reporter="waypoint"` instead of the traditional `reporter="source"` and `reporter="destination"` labels
+- **Traffic flow metrics**: Waypoints appear as intermediaries in connection paths
+
+**Tracing Impact:**
+
+- **Sidecar mode**: Generates two spans per request (client-side and server-side spans)
+- **Ambient mode**: Single span per waypoint (if waypoints are deployed), or no Layer 7 tracing without waypoints
+- **Span depth**: Less detailed trace information compared to sidecar mode
+
+**Dashboard Updates Required:**
+
+Existing observability dashboards need updates to account for:
+- Changed reporter label values
+- Different span patterns in distributed traces
+- Modified metric collection points
+
+**Configuration for Telemetry Policies:**
+
+Update Telemetry API policies to use `targetRefs` instead of workload selectors when targeting waypoints:
+
+[source,yaml]
+----
+apiVersion: telemetry.istio.io/v1
+kind: Telemetry
+metadata:
+  name: waypoint-metrics
+  namespace: <NAMESPACE>
+spec:
+  targetRefs:
+  - kind: Gateway
+    group: gateway.networking.k8s.io
+    name: waypoint
+  metrics:
+  - providers:
+    - name: prometheus
+----
+
+[[configure-kiali-for-ambient-mode]]
+=== 6.2 Configure Kiali for Ambient Mode
+
+**Configure Kiali for ambient mode:**
+
+When you move to ambient you will need to create a `PodMonitor` resource to allow Kiali to scrape the waypoint metrics.
+
+**See also**: For additional Kiali configuration options, refer to the observability documentation in the `docs/addons/` directory.
+
+[source,yaml]
+----
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: ztunnel-monitor
+  namespace: ztunnel
+spec:
+  selector:
+    matchExpressions:
+      - key: istio-prometheus-ignore
+        operator: DoesNotExist
+  podMetricsEndpoints:
+    - path: /stats/prometheus
+      interval: 30s
+      relabelings:
+        - action: keep
+          sourceLabels: ["__meta_kubernetes_pod_container_name"]
+          regex: "istio-proxy"
+        - action: keep
+          sourceLabels: ["__meta_kubernetes_pod_annotationpresent_prometheus_io_scrape"]
+        - action: replace
+          regex: (\d+);(([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4})
+          replacement: '[$2]:$1'
+          sourceLabels: ["__meta_kubernetes_pod_annotation_prometheus_io_port", "__meta_kubernetes_pod_ip"]
+          targetLabel: "__address__"
+        - action: replace
+          regex: (\d+);((([0-9]+?)(\.|$)){4})
+          replacement: '$2:$1'
+          sourceLabels: ["__meta_kubernetes_pod_annotation_prometheus_io_port", "__meta_kubernetes_pod_ip"]
+          targetLabel: "__address__"
+        - action: labeldrop
+          regex: "__meta_kubernetes_pod_label_(.+)"
+        - sourceLabels: ["__meta_kubernetes_namespace"]
+          action: replace
+          targetLabel: namespace
+        - sourceLabels: ["__meta_kubernetes_pod_name"]
+          action: replace
+          targetLabel: pod_name
+----
+
+[[additional-resources]]
+== 7. Additional Resources
+
+**Internal Documentation:**
+
+- link:../common/istio-ambient-waypoint.adoc[Waypoint Proxy Configuration Guide] - Detailed waypoint proxy setup and usage
+- link:../common/install-bookinfo-app.adoc[Installing the Bookinfo Application] - Sample application for testing
+- link:../addons/addons.adoc[Addons and Extensions] - Additional components and observability tools
+- General installation and configuration guides in the `docs/` directory
+
+**External Resources:**
+
+These resources provide further information on ambient mode and related configurations:
+
+- https://istio.io/latest/docs/ambient/[Upstream Istio Ambient Documentation] - Official Istio ambient mode docs
diff --git a/docs/update-strategy/update-strategy.adoc b/docs/update-strategy/update-strategy.adoc
index 5be9bc089..3fce8743b 100644
--- a/docs/update-strategy/update-strategy.adoc
+++ b/docs/update-strategy/update-strategy.adoc
@@ -1,10 +1,10 @@
 // Variables embedded for GitHub compatibility
-:istio_latest_version: 1.26.3
-:istio_latest_version_revision_format: 1-26-3
-:istio_latest_tag: v1.26-latest
-:istio_release_name: release-1.26
-:istio_latest_minus_one_version: 1.26.2
-:istio_latest_minus_one_version_revision_format: 1-26-2
+:istio_latest_version: 1.28.0
+:istio_latest_version_revision_format: 1-28-0
+:istio_latest_tag: v1.28-latest
+:istio_release_name: release-1.28
+:istio_latest_minus_one_version: 1.27.3
+:istio_latest_minus_one_version_revision_format: 1-27-3
 
 link:../../README.adoc[Return to Project Root]
 
diff --git a/go.mod b/go.mod
index f999900ab..ff61150fc 100644
--- a/go.mod
+++ b/go.mod
@@ -20,20 +20,20 @@ require (
 	github.com/prometheus/common v0.66.1
 	github.com/stretchr/testify v1.11.1
 	go.uber.org/zap v1.27.0
-	golang.org/x/mod v0.27.0
-	golang.org/x/text v0.28.0
-	golang.org/x/tools v0.36.0
+	golang.org/x/mod v0.29.0
+	golang.org/x/text v0.30.0
+	golang.org/x/tools v0.38.0
 	gomodules.xyz/jsonpatch/v2 v2.5.0
 	gopkg.in/yaml.v3 v3.0.1
 	helm.sh/helm/v3 v3.18.6
-	istio.io/client-go v1.26.0-alpha.0.0.20251002142408-752760d8f171
-	istio.io/istio v0.0.0-20251007030718-724e23601921
+	istio.io/client-go v1.28.0-alpha.0.0.20251120193902-c79fe2483377
+	istio.io/istio v0.0.0-20251123165306-b2f713a9c787
 	k8s.io/api v0.34.1
 	k8s.io/apiextensions-apiserver v0.34.1
 	k8s.io/apimachinery v0.34.1
 	k8s.io/cli-runtime v0.33.3
 	k8s.io/client-go v0.34.1
-	sigs.k8s.io/controller-runtime v0.22.2
+	sigs.k8s.io/controller-runtime v0.22.4
 )
 
 require (
@@ -90,7 +90,7 @@ require (
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/gosuri/uitable v0.0.4 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
@@ -147,30 +147,29 @@ require (
 	go.opentelemetry.io/otel/metric v1.37.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
 	go.opentelemetry.io/otel/trace v1.37.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
+	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.41.0 // indirect
-	golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6 // indirect
-	golang.org/x/net v0.43.0 // indirect
-	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/crypto v0.43.0 // indirect
+	golang.org/x/exp v0.0.0-20251017212417-90e834f514db // indirect
+	golang.org/x/net v0.46.0 // indirect
+	golang.org/x/oauth2 v0.32.0 // indirect
 	golang.org/x/sync v0.17.0 // indirect
-	golang.org/x/sys v0.35.0 // indirect
-	golang.org/x/term v0.34.0 // indirect
-	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated // indirect
+	golang.org/x/sys v0.37.0 // indirect
+	golang.org/x/term v0.36.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1 // indirect
-	google.golang.org/grpc v1.75.1 // indirect
-	google.golang.org/protobuf v1.36.9 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251020155222-88f65dc88635 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251020155222-88f65dc88635 // indirect
+	google.golang.org/grpc v1.76.0 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	istio.io/api v1.26.0-alpha.0.0.20251002142010-859b66f07fad // indirect
+	istio.io/api v1.28.0-alpha.0.0.20251120193503-cb15a6cf0002 // indirect
 	k8s.io/apiserver v0.34.1 // indirect
 	k8s.io/component-base v0.34.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
diff --git a/go.sum b/go.sum
index 2a6654564..39430d5b6 100644
--- a/go.sum
+++ b/go.sum
@@ -167,8 +167,8 @@ github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc h1:GN2Lv3MGO7AS6PrR
 github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc/go.mod h1:+JKpmjMGhpgPL+rXZ5nsZieVzvarn86asRlBg4uNGnk=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -379,8 +379,8 @@ go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFh
 go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
 go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
 go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
-go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
-go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
+go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
+go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
@@ -398,22 +398,22 @@ go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
-golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
-golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6 h1:y5zboxd6LQAqYIhHnB48p0ByQ/GnQx2BE33L8BOHQkI=
-golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6/go.mod h1:U6Lno4MTRCDY+Ba7aCcauB9T60gsv5s4ralQzP72ZoQ=
+golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04=
+golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0=
+golang.org/x/exp v0.0.0-20251017212417-90e834f514db h1:by6IehL4BH5k3e3SJmcoNbOobMey2SLpAF79iPOEBvw=
+golang.org/x/exp v0.0.0-20251017212417-90e834f514db/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
-golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
-golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
-golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
-golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+golang.org/x/net v0.46.0 h1:giFlY12I07fugqwPuWJi68oOnpfqFnJIJzaIIm2JVV4=
+golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210=
+golang.org/x/oauth2 v0.32.0 h1:jsCblLleRMDrxMN29H3z/k1KliIvpLgCkE6R8FXXNgY=
+golang.org/x/oauth2 v0.32.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -425,24 +425,24 @@ golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
-golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
-golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
+golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.36.0 h1:zMPR+aF8gfksFprF/Nc/rd1wRS1EI6nDBGyWAvDzx2Q=
+golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
-golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
-golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
-golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k=
+golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
-golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
-golang.org/x/tools/go/expect v0.1.0-deprecated h1:jY2C5HGYR5lqex3gEniOQL0r7Dq5+VGVgY1nudX5lXY=
-golang.org/x/tools/go/expect v0.1.0-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
+golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -455,14 +455,14 @@ gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0
 gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
 gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a h1:DMCgtIAIQGZqJXMVzJF4MV8BlWoJh2ZuFiRdAleyr58=
-google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a/go.mod h1:y2yVLIE/CSMCPXaHnSKXxu1spLPnglFLegmgdY23uuE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1 h1:pmJpJEvT846VzausCQ5d7KreSROcDqmO388w5YbnltA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1/go.mod h1:GmFNa4BdJZ2a8G+wCe9Bg3wwThLrJun751XstdJt5Og=
-google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
-google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
-google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
-google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+google.golang.org/genproto/googleapis/api v0.0.0-20251020155222-88f65dc88635 h1:1wvBeYv+A2zfEbxROscJl69OP0m74S8wGEO+Syat26o=
+google.golang.org/genproto/googleapis/api v0.0.0-20251020155222-88f65dc88635/go.mod h1:fDMmzKV90WSg1NbozdqrE64fkuTv6mlq2zxo9ad+3yo=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251020155222-88f65dc88635 h1:3uycTxukehWrxH4HtPRtn1PDABTU331ViDjyqrUbaog=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251020155222-88f65dc88635/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
+google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A=
+google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c=
+google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
+google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -481,12 +481,12 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 helm.sh/helm/v3 v3.18.6 h1:S/2CqcYnNfLckkHLI0VgQbxgcDaU3N4A/46E3n9wSNY=
 helm.sh/helm/v3 v3.18.6/go.mod h1:L/dXDR2r539oPlFP1PJqKAC1CUgqHJDLkxKpDGrWnyg=
-istio.io/api v1.26.0-alpha.0.0.20251002142010-859b66f07fad h1:/KPSr8zxYROijN9dvolM8q9HwnmM0CP42N32fK4kQ94=
-istio.io/api v1.26.0-alpha.0.0.20251002142010-859b66f07fad/go.mod h1:BD3qv/ekm16kvSgvSpuiDawgKhEwG97wx849CednJSg=
-istio.io/client-go v1.26.0-alpha.0.0.20251002142408-752760d8f171 h1:kGlWXEWWQlzxA2WfzXI7YuGeGd/UrAPRKWDEoxF9fpk=
-istio.io/client-go v1.26.0-alpha.0.0.20251002142408-752760d8f171/go.mod h1:qq1p0YYijr4fQdp8pN2nyC8EnpZzx0HFUt5yMgNfHzY=
-istio.io/istio v0.0.0-20251007030718-724e23601921 h1:CYRyjCAXNx2nEvwaHECpG0xdpQ3ouvuGd/9M8w7jK3A=
-istio.io/istio v0.0.0-20251007030718-724e23601921/go.mod h1:rkwXkzAe+prvZU+JxLOJboEX44gr1ycbEPyl9k24CE8=
+istio.io/api v1.28.0-alpha.0.0.20251120193503-cb15a6cf0002 h1:GmCiNi/TnMKpKIu0r5WSTir1W/Mc+2D9HI/dMp+7zPA=
+istio.io/api v1.28.0-alpha.0.0.20251120193503-cb15a6cf0002/go.mod h1:BD3qv/ekm16kvSgvSpuiDawgKhEwG97wx849CednJSg=
+istio.io/client-go v1.28.0-alpha.0.0.20251120193902-c79fe2483377 h1:ghagEGUxUsjpvbgR6Llr8xaN3kObAk2zJbnWquRhP+s=
+istio.io/client-go v1.28.0-alpha.0.0.20251120193902-c79fe2483377/go.mod h1:K9qmUWxQPP5Ltt7fbTmDqHaSUm9iMF5co3dvZsl++P0=
+istio.io/istio v0.0.0-20251123165306-b2f713a9c787 h1:WsdDCL15prxtDAZqMbvFTatjs1KWyLauLvztNZaIz5g=
+istio.io/istio v0.0.0-20251123165306-b2f713a9c787/go.mod h1:W4ZkpFeATyVo6aY875t9SXlb/7kL8cUcBtYfhOSG2Qs=
 k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
 k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
 k8s.io/apiextensions-apiserver v0.34.1 h1:NNPBva8FNAPt1iSVwIE0FsdrVriRXMsaWFMqJbII2CI=
@@ -513,8 +513,8 @@ oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
 oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.32.1 h1:Cf+ed5N8038zbsaXFO7mKQDi/+VcSRafb0jM84KX5so=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.32.1/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
-sigs.k8s.io/controller-runtime v0.22.2 h1:cK2l8BGWsSWkXz09tcS4rJh95iOLney5eawcK5A33r4=
-sigs.k8s.io/controller-runtime v0.22.2/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8=
+sigs.k8s.io/controller-runtime v0.22.4 h1:GEjV7KV3TY8e+tJ2LCTxUTanW4z/FmNB7l327UfMq9A=
+sigs.k8s.io/controller-runtime v0.22.4/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8=
 sigs.k8s.io/controller-tools v0.14.0 h1:rnNoCC5wSXlrNoBKKzL70LNJKIQKEzT6lloG6/LF73A=
 sigs.k8s.io/controller-tools v0.14.0/go.mod h1:TV7uOtNNnnR72SpzhStvPkoS/U5ir0nMudrkrC4M9Sc=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
diff --git a/hack/api-docs/templates/markdown/gv_details.tpl b/hack/api-docs/templates/markdown/gv_details.tpl
index 30ad0d751..49b75be69 100644
--- a/hack/api-docs/templates/markdown/gv_details.tpl
+++ b/hack/api-docs/templates/markdown/gv_details.tpl
@@ -8,7 +8,12 @@
 {{- if $gv.Kinds  }}
 ### Resource Types
 {{- range $gv.SortedKinds }}
-- {{ $gv.TypeForKind . | markdownRenderTypeLink }}
+{{- $type := $gv.TypeForKind . }}
+{{- if $type.GVK }}
+- [{{ $type.Name }}](#{{ $type.Name | lower }}-{{ $type.GVK.Version }})
+{{- else }}
+- [{{ $type.Name }}](#{{ $type.Name | lower }})
+{{- end }}
 {{- end }}
 {{ end }}
 
diff --git a/hack/api-docs/templates/markdown/type.tpl b/hack/api-docs/templates/markdown/type.tpl
index 2b8c91e95..ebe9d1e9f 100644
--- a/hack/api-docs/templates/markdown/type.tpl
+++ b/hack/api-docs/templates/markdown/type.tpl
@@ -3,7 +3,11 @@
 {{- if markdownShouldRenderType $type -}}
 {{- if not $type.Markers.hidefromdoc -}}
 
+{{- if $type.GVK -}}
+#### {{ $type.Name }} ({{ $type.GVK.Version }})
+{{- else -}}
 #### {{ $type.Name }}
+{{- end }}
 
 {{ if $type.IsAlias }}_Underlying type:_ _{{ markdownRenderTypeLink $type.UnderlyingType  }}_{{ end }}
 
diff --git a/hack/extract-istio-crds.sh b/hack/extract-istio-crds.sh
index 6045c8a57..5333c369f 100755
--- a/hack/extract-istio-crds.sh
+++ b/hack/extract-istio-crds.sh
@@ -16,10 +16,10 @@
 
 set -euo pipefail
 
-INPUT_FILE="$(go list -m -f '{{.Dir}}' istio.io/istio)/manifests/charts/base/files/crd-all.gen.yaml"
+INPUT_FILE="$(go list -mod=readonly -m -f '{{.Dir}}' istio.io/istio)/manifests/charts/base/files/crd-all.gen.yaml"
 # check if the file exists and adjust the file path if necessary (this is needed because older Istio versions have the CRDs in a different location)
 if [ ! -f "${INPUT_FILE}" ]; then
-  INPUT_FILE="$(go list -m -f '{{.Dir}}' istio.io/istio)/manifests/charts/base/crds/crd-all.gen.yaml"
+  INPUT_FILE="$(go list -mod=readonly -m -f '{{.Dir}}' istio.io/istio)/manifests/charts/base/crds/crd-all.gen.yaml"
 fi
 
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
diff --git a/hack/operatorhub/publish-bundle.sh b/hack/operatorhub/publish-bundle.sh
index afea2c0dd..9adb79c05 100755
--- a/hack/operatorhub/publish-bundle.sh
+++ b/hack/operatorhub/publish-bundle.sh
@@ -85,7 +85,7 @@ OWNER="${OWNER:-"redhat-openshift-ecosystem"}"
 HUB_REPO_URL="${HUB_REPO_URL:-https://github.com/${OWNER}/${OPERATOR_HUB}.git}"
 HUB_BASE_BRANCH="${HUB_BASE_BRANCH:-main}"
 
-FORK="${FORK:-maistra}"
+FORK="${FORK:-openshift-service-mesh}"
 FORK_REPO_URL="${FORK_REPO_URL:-https://${GIT_USER}:${GITHUB_TOKEN}@github.com/${FORK}/${OPERATOR_HUB}.git}"
 
 BRANCH=${BRANCH:-"${OPERATOR_NAME}-${OPERATOR_VERSION}"}
diff --git a/hack/update-istio-in-docs.sh b/hack/update-istio-in-docs.sh
new file mode 100755
index 000000000..f5d12da26
--- /dev/null
+++ b/hack/update-istio-in-docs.sh
@@ -0,0 +1,72 @@
+#!/bin/bash
+
+# Copyright Istio Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+YAML_FILE="pkg/istioversion/versions.yaml"
+
+SED_CMD="sed"
+if [[ "$(uname)" == "Darwin" ]]; then
+  SED_CMD="gsed"
+fi
+
+# Check if yq is installed
+if ! command -v yq &> /dev/null
+then
+    echo "Error: 'yq' command not found." >&2
+    echo "Please install yq (e.g., 'brew install yq' or 'sudo snap install yq')." >&2
+    exit 1
+fi
+
+echo "Extracting the latest two 'version' values from $YAML_FILE..."
+
+# Disable pipefail temporarily to avoid SIGPIPE error from head
+set +o pipefail
+LATEST_VERSIONS=$(yq '.versions[] | select(.version) | .version' "$YAML_FILE" | head -n 2)
+set -o pipefail
+if [ -z "$LATEST_VERSIONS" ]; then
+    echo "No versions with a 'version' property found."
+    exit 1
+fi
+
+echo "$LATEST_VERSIONS"
+
+# Check all the ascii docs in docs/ and update the istio version variables
+# LATEST_VERSIONS[0] is latest and LATEST_VERSIONS[1] is latest minus one
+LATEST_VERSION=$(echo "$LATEST_VERSIONS" | sed -n '1p')
+LATEST_VERSION_REVISION_FORMAT=$(echo "$LATEST_VERSION" | tr '.' '-')
+LATEST_TAG="v${LATEST_VERSION%.*}-latest"
+LATEST_RELEASE_NAME="release-${LATEST_VERSION%.*}"
+LATEST_MINUS_ONE_VERSION=$(echo "$LATEST_VERSIONS" | sed -n '2p')
+LATEST_MINUS_ONE_VERSION_REVISION_FORMAT=$(echo "$LATEST_MINUS_ONE_VERSION" | tr '.' '-')
+echo "The versions to update are:"
+echo "LATEST_VERSION: $LATEST_VERSION"
+echo "LATEST_VERSION_REVISION_FORMAT: $LATEST_VERSION_REVISION_FORMAT"
+echo "LATEST_TAG: $LATEST_TAG"
+echo "LATEST_RELEASE_NAME: $LATEST_RELEASE_NAME"
+echo "LATEST_MINUS_ONE_VERSION: $LATEST_MINUS_ONE_VERSION"
+echo "LATEST_MINUS_ONE_VERSION_REVISION_FORMAT: $LATEST_MINUS_ONE_VERSION_REVISION_FORMAT"
+
+for file in docs/**/*.adoc; do
+    echo "Updating file: $file"
+    "$SED_CMD" -i -E "s/(:istio_latest_version: ).*/\1$LATEST_VERSION/" "$file"
+    "$SED_CMD" -i -E "s/(:istio_latest_version_revision_format: ).*/\1$LATEST_VERSION_REVISION_FORMAT/" "$file"
+    "$SED_CMD" -i -E "s/(:istio_latest_tag: ).*/\1$LATEST_TAG/" "$file"
+    "$SED_CMD" -i -E "s/(:istio_release_name: ).*/\1$LATEST_RELEASE_NAME/" "$file"
+    "$SED_CMD" -i -E "s/(:istio_latest_minus_one_version: ).*/\1$LATEST_MINUS_ONE_VERSION/" "$file"
+    "$SED_CMD" -i -E "s/(:istio_latest_minus_one_version_revision_format: ).*/\1$LATEST_MINUS_ONE_VERSION_REVISION_FORMAT/" "$file"
+done
+echo "Documentation files updated successfully."
\ No newline at end of file
diff --git a/hack/update-version-list.sh b/hack/update-version-list.sh
index d75b88167..ae6ef2544 100755
--- a/hack/update-version-list.sh
+++ b/hack/update-version-list.sh
@@ -61,6 +61,14 @@ function updateVersionsInIstioTypeComment() {
       -e "/\+sail:version/,/Version string/ s/(\/\/ \Must be one of:)(.*)/\1 $ztunnelversions./g" \
       -e "s/(\+kubebuilder:default=.*version: \")[^\"]*\"/\1$defaultVersion\"/g" \
       api/v1alpha1/ztunnel_types.go
+
+    sed -i -E \
+      -e "/\+sail:version/,/Version string/ s/(\/\/ \+operator-sdk:csv:customresourcedefinitions:type=spec,order=1,displayName=\"Istio Version\",xDescriptors=\{.*fieldGroup:General\")[^}]*(})/\1$ztunnelselectValues}/g" \
+      -e "/\+sail:version/,/Version string/ s/(\/\/ \+kubebuilder:validation:Enum=)(.*)/\1$ztunnelversionsEnum/g" \
+      -e "/\+sail:version/,/Version string/ s/(\/\/ \+kubebuilder:default=)(.*)/\1$defaultVersion/g" \
+      -e "/\+sail:version/,/Version string/ s/(\/\/ \Must be one of:)(.*)/\1 $ztunnelversions./g" \
+      -e "s/(\+kubebuilder:default=.*version: \")[^\"]*\"/\1$defaultVersion\"/g" \
+      api/v1/ztunnel_types.go
 }
 
 function updateVersionsInCSVDescription() {
diff --git a/pkg/istiovalues/overrides.go b/pkg/istiovalues/overrides.go
index acb8333a5..1485d5085 100644
--- a/pkg/istiovalues/overrides.go
+++ b/pkg/istiovalues/overrides.go
@@ -14,7 +14,11 @@
 
 package istiovalues
 
-import v1 "github.com/istio-ecosystem/sail-operator/api/v1"
+import (
+	v1 "github.com/istio-ecosystem/sail-operator/api/v1"
+
+	"istio.io/istio/pkg/ptr"
+)
 
 func ApplyOverrides(revisionName string, namespace string, values *v1.Values) {
 	// Set revision name to "" if revision name is "default". This is a temporary fix until we fix the injection
@@ -30,4 +34,8 @@ func ApplyOverrides(revisionName string, namespace string, values *v1.Values) {
 		values.Global = &v1.GlobalConfig{}
 	}
 	values.Global.IstioNamespace = &namespace
+
+	// Force defaultRevision to be empty to prevent creation of the default validator webhook.
+	// This field is deprecated and should be ignored by the operator.
+	values.DefaultRevision = ptr.Of("")
 }
diff --git a/pkg/istiovalues/overrides_test.go b/pkg/istiovalues/overrides_test.go
index 5c75f8294..8506cb6b7 100644
--- a/pkg/istiovalues/overrides_test.go
+++ b/pkg/istiovalues/overrides_test.go
@@ -41,6 +41,7 @@ func TestApplyOverrides(t *testing.T) {
 				Global: &v1.GlobalConfig{
 					IstioNamespace: ptr.Of("ns1"),
 				},
+				DefaultRevision: ptr.Of(""),
 			},
 		},
 		{
@@ -53,6 +54,7 @@ func TestApplyOverrides(t *testing.T) {
 				Global: &v1.GlobalConfig{
 					IstioNamespace: ptr.Of("ns1"),
 				},
+				DefaultRevision: ptr.Of(""),
 			},
 		},
 		{
@@ -67,6 +69,7 @@ func TestApplyOverrides(t *testing.T) {
 				Global: &v1.GlobalConfig{
 					IstioNamespace: ptr.Of("ns1"),
 				},
+				DefaultRevision: ptr.Of(""),
 			},
 		},
 		{
@@ -83,6 +86,22 @@ func TestApplyOverrides(t *testing.T) {
 				Global: &v1.GlobalConfig{
 					IstioNamespace: ptr.Of("ns1"),
 				},
+				DefaultRevision: ptr.Of(""),
+			},
+		},
+		{
+			name:      "defaultRevision-is-ignored-when-set-by-user",
+			revision:  "my-revision",
+			namespace: "ns1",
+			values: v1.Values{
+				DefaultRevision: ptr.Of("my-revision"),
+			},
+			expectedValues: v1.Values{
+				Revision: ptr.Of("my-revision"),
+				Global: &v1.GlobalConfig{
+					IstioNamespace: ptr.Of("ns1"),
+				},
+				DefaultRevision: ptr.Of(""),
 			},
 		},
 	}
diff --git a/pkg/istioversion/versions.yaml b/pkg/istioversion/versions.yaml
index a247fdefd..01cb69726 100644
--- a/pkg/istioversion/versions.yaml
+++ b/pkg/istioversion/versions.yaml
@@ -15,8 +15,40 @@
 # required. They will stay valid input values for the spec.version field though,
 # to avoid breaking API guarantees.
 versions:
+  - name: v1.28-latest
+    ref: v1.28.0
+  - name: v1.28.0
+    version: 1.28.0
+    repo: https://github.com/istio/istio
+    commit: 1.28.0
+    charts:
+      - https://istio-release.storage.googleapis.com/charts/base-1.28.0.tgz
+      - https://istio-release.storage.googleapis.com/charts/istiod-1.28.0.tgz
+      - https://istio-release.storage.googleapis.com/charts/gateway-1.28.0.tgz
+      - https://istio-release.storage.googleapis.com/charts/cni-1.28.0.tgz
+      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.28.0.tgz
   - name: v1.27-latest
-    ref: v1.27.1
+    ref: v1.27.3
+  - name: v1.27.3
+    version: 1.27.3
+    repo: https://github.com/istio/istio
+    commit: 1.27.3
+    charts:
+      - https://istio-release.storage.googleapis.com/charts/base-1.27.3.tgz
+      - https://istio-release.storage.googleapis.com/charts/istiod-1.27.3.tgz
+      - https://istio-release.storage.googleapis.com/charts/gateway-1.27.3.tgz
+      - https://istio-release.storage.googleapis.com/charts/cni-1.27.3.tgz
+      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.27.3.tgz
+  - name: v1.27.2
+    version: 1.27.2
+    repo: https://github.com/istio/istio
+    commit: 1.27.2
+    charts:
+      - https://istio-release.storage.googleapis.com/charts/base-1.27.2.tgz
+      - https://istio-release.storage.googleapis.com/charts/istiod-1.27.2.tgz
+      - https://istio-release.storage.googleapis.com/charts/gateway-1.27.2.tgz
+      - https://istio-release.storage.googleapis.com/charts/cni-1.27.2.tgz
+      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.27.2.tgz
   - name: v1.27.1
     version: 1.27.1
     repo: https://github.com/istio/istio
@@ -38,7 +70,27 @@ versions:
       - https://istio-release.storage.googleapis.com/charts/cni-1.27.0.tgz
       - https://istio-release.storage.googleapis.com/charts/ztunnel-1.27.0.tgz
   - name: v1.26-latest
-    ref: v1.26.4
+    ref: v1.26.6
+  - name: v1.26.6
+    version: 1.26.6
+    repo: https://github.com/istio/istio
+    commit: 1.26.6
+    charts:
+      - https://istio-release.storage.googleapis.com/charts/base-1.26.6.tgz
+      - https://istio-release.storage.googleapis.com/charts/istiod-1.26.6.tgz
+      - https://istio-release.storage.googleapis.com/charts/gateway-1.26.6.tgz
+      - https://istio-release.storage.googleapis.com/charts/cni-1.26.6.tgz
+      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.26.6.tgz
+  - name: v1.26.5
+    version: 1.26.5
+    repo: https://github.com/istio/istio
+    commit: 1.26.5
+    charts:
+      - https://istio-release.storage.googleapis.com/charts/base-1.26.5.tgz
+      - https://istio-release.storage.googleapis.com/charts/istiod-1.26.5.tgz
+      - https://istio-release.storage.googleapis.com/charts/gateway-1.26.5.tgz
+      - https://istio-release.storage.googleapis.com/charts/cni-1.26.5.tgz
+      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.26.5.tgz
   - name: v1.26.4
     version: 1.26.4
     repo: https://github.com/istio/istio
@@ -69,6 +121,16 @@ versions:
       - https://istio-release.storage.googleapis.com/charts/gateway-1.26.2.tgz
       - https://istio-release.storage.googleapis.com/charts/cni-1.26.2.tgz
       - https://istio-release.storage.googleapis.com/charts/ztunnel-1.26.2.tgz
+  - name: v1.26.1
+    version: 1.26.1
+    repo: https://github.com/istio/istio
+    commit: 1.26.1
+    charts:
+      - https://istio-release.storage.googleapis.com/charts/base-1.26.1.tgz
+      - https://istio-release.storage.googleapis.com/charts/istiod-1.26.1.tgz
+      - https://istio-release.storage.googleapis.com/charts/gateway-1.26.1.tgz
+      - https://istio-release.storage.googleapis.com/charts/cni-1.26.1.tgz
+      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.26.1.tgz
   - name: v1.26.0
     version: 1.26.0
     repo: https://github.com/istio/istio
@@ -81,128 +143,34 @@ versions:
       - https://istio-release.storage.googleapis.com/charts/ztunnel-1.26.0.tgz
   - name: v1.25-latest
     ref: v1.25.5
+    eol: true
   - name: v1.25.5
-    version: 1.25.5
-    repo: https://github.com/istio/istio
-    commit: 1.25.5
-    charts:
-      - https://istio-release.storage.googleapis.com/charts/base-1.25.5.tgz
-      - https://istio-release.storage.googleapis.com/charts/istiod-1.25.5.tgz
-      - https://istio-release.storage.googleapis.com/charts/gateway-1.25.5.tgz
-      - https://istio-release.storage.googleapis.com/charts/cni-1.25.5.tgz
-      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.25.5.tgz
+    eol: true
   - name: v1.25.4
-    version: 1.25.4
-    repo: https://github.com/istio/istio
-    commit: 1.25.4
-    charts:
-      - https://istio-release.storage.googleapis.com/charts/base-1.25.4.tgz
-      - https://istio-release.storage.googleapis.com/charts/istiod-1.25.4.tgz
-      - https://istio-release.storage.googleapis.com/charts/gateway-1.25.4.tgz
-      - https://istio-release.storage.googleapis.com/charts/cni-1.25.4.tgz
-      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.25.4.tgz
+    eol: true
   - name: v1.25.3
-    version: 1.25.3
-    repo: https://github.com/istio/istio
-    commit: 1.25.3
-    charts:
-      - https://istio-release.storage.googleapis.com/charts/base-1.25.3.tgz
-      - https://istio-release.storage.googleapis.com/charts/istiod-1.25.3.tgz
-      - https://istio-release.storage.googleapis.com/charts/gateway-1.25.3.tgz
-      - https://istio-release.storage.googleapis.com/charts/cni-1.25.3.tgz
-      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.25.3.tgz
+    eol: true
   - name: v1.25.2
-    version: 1.25.2
-    repo: https://github.com/istio/istio
-    commit: 1.25.2
-    charts:
-      - https://istio-release.storage.googleapis.com/charts/base-1.25.2.tgz
-      - https://istio-release.storage.googleapis.com/charts/istiod-1.25.2.tgz
-      - https://istio-release.storage.googleapis.com/charts/gateway-1.25.2.tgz
-      - https://istio-release.storage.googleapis.com/charts/cni-1.25.2.tgz
-      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.25.2.tgz
+    eol: true
   - name: v1.25.1
-    version: 1.25.1
-    repo: https://github.com/istio/istio
-    commit: 1.25.1
-    charts:
-      - https://istio-release.storage.googleapis.com/charts/base-1.25.1.tgz
-      - https://istio-release.storage.googleapis.com/charts/istiod-1.25.1.tgz
-      - https://istio-release.storage.googleapis.com/charts/gateway-1.25.1.tgz
-      - https://istio-release.storage.googleapis.com/charts/cni-1.25.1.tgz
-      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.25.1.tgz
+    eol: true
   - name: v1.24-latest
     ref: v1.24.6
+    eol: true
   - name: v1.24.6
-    version: 1.24.6
-    repo: https://github.com/istio/istio
-    commit: 1.24.6
-    charts:
-      - https://istio-release.storage.googleapis.com/charts/base-1.24.6.tgz
-      - https://istio-release.storage.googleapis.com/charts/istiod-1.24.6.tgz
-      - https://istio-release.storage.googleapis.com/charts/gateway-1.24.6.tgz
-      - https://istio-release.storage.googleapis.com/charts/cni-1.24.6.tgz
-      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.24.6.tgz
+    eol: true
   - name: v1.24.5
-    version: 1.24.5
-    repo: https://github.com/istio/istio
-    commit: 1.24.5
-    charts:
-      - https://istio-release.storage.googleapis.com/charts/base-1.24.5.tgz
-      - https://istio-release.storage.googleapis.com/charts/istiod-1.24.5.tgz
-      - https://istio-release.storage.googleapis.com/charts/gateway-1.24.5.tgz
-      - https://istio-release.storage.googleapis.com/charts/cni-1.24.5.tgz
-      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.24.5.tgz
+    eol: true
   - name: v1.24.4
-    version: 1.24.4
-    repo: https://github.com/istio/istio
-    commit: 1.24.4
-    charts:
-      - https://istio-release.storage.googleapis.com/charts/base-1.24.4.tgz
-      - https://istio-release.storage.googleapis.com/charts/istiod-1.24.4.tgz
-      - https://istio-release.storage.googleapis.com/charts/gateway-1.24.4.tgz
-      - https://istio-release.storage.googleapis.com/charts/cni-1.24.4.tgz
-      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.24.4.tgz
+    eol: true
   - name: v1.24.3
-    version: 1.24.3
-    repo: https://github.com/istio/istio
-    commit: 1.24.3
-    charts:
-      - https://istio-release.storage.googleapis.com/charts/base-1.24.3.tgz
-      - https://istio-release.storage.googleapis.com/charts/istiod-1.24.3.tgz
-      - https://istio-release.storage.googleapis.com/charts/gateway-1.24.3.tgz
-      - https://istio-release.storage.googleapis.com/charts/cni-1.24.3.tgz
-      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.24.3.tgz
+    eol: true
   - name: v1.24.2
-    version: 1.24.2
-    repo: https://github.com/istio/istio
-    commit: 1.24.2
-    charts:
-      - https://istio-release.storage.googleapis.com/charts/base-1.24.2.tgz
-      - https://istio-release.storage.googleapis.com/charts/istiod-1.24.2.tgz
-      - https://istio-release.storage.googleapis.com/charts/gateway-1.24.2.tgz
-      - https://istio-release.storage.googleapis.com/charts/cni-1.24.2.tgz
-      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.24.2.tgz
+    eol: true
   - name: v1.24.1
-    version: 1.24.1
-    repo: https://github.com/istio/istio
-    commit: 1.24.1
-    charts:
-      - https://istio-release.storage.googleapis.com/charts/base-1.24.1.tgz
-      - https://istio-release.storage.googleapis.com/charts/istiod-1.24.1.tgz
-      - https://istio-release.storage.googleapis.com/charts/gateway-1.24.1.tgz
-      - https://istio-release.storage.googleapis.com/charts/cni-1.24.1.tgz
-      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.24.1.tgz
+    eol: true
   - name: v1.24.0
-    version: 1.24.0
-    repo: https://github.com/istio/istio
-    commit: 1.24.0
-    charts:
-      - https://istio-release.storage.googleapis.com/charts/base-1.24.0.tgz
-      - https://istio-release.storage.googleapis.com/charts/istiod-1.24.0.tgz
-      - https://istio-release.storage.googleapis.com/charts/gateway-1.24.0.tgz
-      - https://istio-release.storage.googleapis.com/charts/cni-1.24.0.tgz
-      - https://istio-release.storage.googleapis.com/charts/ztunnel-1.24.0.tgz
+    eol: true
   - name: v1.23-latest
     ref: v1.23.6
     eol: true
@@ -230,15 +198,15 @@ versions:
   - name: v1.21.6
     eol: true
   - name: master
-    ref: v1.28-alpha.724e2360
-  - name: v1.28-alpha.724e2360
-    version: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
+    ref: v1.29-alpha.b2f713a9
+  - name: v1.29-alpha.b2f713a9
+    version: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
     repo: https://github.com/istio/istio
     branch: master
-    commit: 724e23601921b13efdc8ee85566eab9b7f3c441b
+    commit: b2f713a9c7879a0c736388ff854f94c904dcc816
     charts:
-      - https://storage.googleapis.com/istio-build/dev/1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b/helm/base-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz
-      - https://storage.googleapis.com/istio-build/dev/1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b/helm/cni-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz
-      - https://storage.googleapis.com/istio-build/dev/1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b/helm/gateway-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz
-      - https://storage.googleapis.com/istio-build/dev/1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b/helm/istiod-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz
-      - https://storage.googleapis.com/istio-build/dev/1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b/helm/ztunnel-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz
+      - https://storage.googleapis.com/istio-build/dev/1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816/helm/base-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz
+      - https://storage.googleapis.com/istio-build/dev/1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816/helm/cni-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz
+      - https://storage.googleapis.com/istio-build/dev/1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816/helm/gateway-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz
+      - https://storage.googleapis.com/istio-build/dev/1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816/helm/istiod-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz
+      - https://storage.googleapis.com/istio-build/dev/1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816/helm/ztunnel-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz
diff --git a/pkg/predicate/predicate.go b/pkg/predicate/predicate.go
index fc4f7466c..14c2c0c65 100644
--- a/pkg/predicate/predicate.go
+++ b/pkg/predicate/predicate.go
@@ -25,3 +25,17 @@ func IgnoreUpdate() predicate.Funcs {
 		UpdateFunc: func(e event.UpdateEvent) bool { return false },
 	}
 }
+
+// IgnoreUpdateWhenAnnotation returns a predicate that ignores update events
+// when the sailoperator.io/ignore annotation is set to "true" on the resource.
+func IgnoreUpdateWhenAnnotation() predicate.Funcs {
+	return predicate.Funcs{
+		UpdateFunc: func(e event.UpdateEvent) bool {
+			if e.ObjectOld == nil || e.ObjectNew == nil {
+				return false
+			}
+
+			return e.ObjectNew.GetAnnotations()["sailoperator.io/ignore"] != "true"
+		},
+	}
+}
diff --git a/pkg/predicate/predicate_test.go b/pkg/predicate/predicate_test.go
index 08dca50cb..8a876e107 100644
--- a/pkg/predicate/predicate_test.go
+++ b/pkg/predicate/predicate_test.go
@@ -18,6 +18,8 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/event"
 )
 
@@ -28,3 +30,57 @@ func TestIgnoreUpdate(t *testing.T) {
 	assert.Equal(t, true, predicate.Delete(event.DeleteEvent{}))
 	assert.Equal(t, true, predicate.Generic(event.GenericEvent{}))
 }
+
+func TestIgnoreUpdateWhenAnnotation(t *testing.T) {
+	predicate := IgnoreUpdateWhenAnnotation()
+	// Object does not contain sailoperator.io/ignore annotation
+	// so reconciliation should be done and both objects should be equal
+	assert.Equal(t, true, predicate.Update(event.UpdateEvent{
+		ObjectOld: &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{},
+		},
+		ObjectNew: &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{},
+			Data: map[string]string{
+				"foo": "bar",
+			},
+		},
+	}))
+	// Object has sailoperator.io/ignore annotation set with wrong value
+	// so reconciliation should be done and both objects should be equal
+	assert.Equal(t, true, predicate.Update(event.UpdateEvent{
+		ObjectOld: &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{},
+		},
+		ObjectNew: &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Annotations: map[string]string{
+					"sailoperator.io/ignore": "wrongvalue",
+				},
+			},
+			Data: map[string]string{
+				"foo": "bar",
+			},
+		},
+	}))
+	// Object has sailoperator.io/ignore annotation set to "true"
+	// so reconciliation should be skipped
+	assert.Equal(t, false, predicate.Update(event.UpdateEvent{
+		ObjectOld: &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{},
+		},
+		ObjectNew: &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Annotations: map[string]string{
+					"sailoperator.io/ignore": "true",
+				},
+			},
+			Data: map[string]string{
+				"foo": "bar",
+			},
+		},
+	}))
+	assert.Equal(t, true, predicate.Create(event.CreateEvent{}))
+	assert.Equal(t, true, predicate.Delete(event.DeleteEvent{}))
+	assert.Equal(t, true, predicate.Generic(event.GenericEvent{}))
+}
diff --git a/pkg/revision/dependency.go b/pkg/revision/dependency.go
index 625bed687..d03b14b3f 100644
--- a/pkg/revision/dependency.go
+++ b/pkg/revision/dependency.go
@@ -44,3 +44,26 @@ func DependsOnIstioCNI(rev *v1.IstioRevision, cfg config.ReconcilerConfig) bool
 	}
 	return isCNIEnabled
 }
+
+// DependsOnZTunnel returns true if the revision is configured for ambient mode and requires ZTunnel
+func DependsOnZTunnel(rev *v1.IstioRevision, cfg config.ReconcilerConfig) bool {
+	values, err := defaultComputeValues(rev.Spec.Values, rev.Spec.Namespace, rev.Spec.Version,
+		cfg.Platform, cfg.DefaultProfile, "", cfg.ResourceDirectory, rev.Name)
+	if err != nil || values == nil {
+		return false
+	}
+
+	// Check if ambient mode is enabled via pilot.env.PILOT_ENABLE_AMBIENT
+	if values.Pilot != nil && values.Pilot.Env != nil {
+		if ambientEnabled, exists := values.Pilot.Env["PILOT_ENABLE_AMBIENT"]; exists && ambientEnabled == "true" {
+			return true
+		}
+	}
+
+	// Also check if ambient profile is being used
+	if values.Profile != nil && *values.Profile == "ambient" {
+		return true
+	}
+
+	return false
+}
diff --git a/pkg/revision/dependency_test.go b/pkg/revision/dependency_test.go
index c391e3fcd..5653cc91f 100644
--- a/pkg/revision/dependency_test.go
+++ b/pkg/revision/dependency_test.go
@@ -26,7 +26,7 @@ import (
 
 // mockComputeValues returns the input values without any computation
 // this simulates what ComputeValues would do but without requiring actual files
-func mockComputeValues(values *v1.Values, _, _ string, platform config.Platform, _, _, _, _ string) (*v1.Values, error) {
+func mockComputeValues(values *v1.Values, _, _ string, platform config.Platform, defaultProfile, userProfile, _, _ string) (*v1.Values, error) {
 	if values == nil {
 		values = &v1.Values{}
 	}
@@ -41,6 +41,24 @@ func mockComputeValues(values *v1.Values, _, _ string, platform config.Platform,
 		}
 		values.Pilot.Cni.Enabled = ptr.Of(true)
 	}
+
+	profile := userProfile
+	if profile == "" {
+		profile = defaultProfile
+	}
+
+	// If profile is ambient, set the profile in values and enable PILOT_ENABLE_AMBIENT
+	if profile == "ambient" {
+		values.Profile = ptr.Of("ambient")
+		if values.Pilot == nil {
+			values.Pilot = &v1.PilotConfig{}
+		}
+		if values.Pilot.Env == nil {
+			values.Pilot.Env = make(map[string]string)
+		}
+		values.Pilot.Env["PILOT_ENABLE_AMBIENT"] = "true"
+	}
+
 	return values, nil
 }
 
@@ -222,3 +240,147 @@ func TestDependsOnIstioCNI(t *testing.T) {
 		})
 	}
 }
+
+func TestDependsOnZTunnel(t *testing.T) {
+	defaultComputeValues = mockComputeValues
+	defaultCfg := config.ReconcilerConfig{
+		Platform:       config.PlatformKubernetes,
+		DefaultProfile: "default",
+	}
+
+	tests := []struct {
+		name     string
+		rev      *v1.IstioRevision
+		cfg      config.ReconcilerConfig
+		expected bool
+	}{
+		{
+			name: "NilValues",
+			rev: &v1.IstioRevision{
+				Spec: v1.IstioRevisionSpec{
+					Values: nil,
+				},
+			},
+			cfg:      defaultCfg,
+			expected: false,
+		},
+		{
+			name: "NoPilot",
+			rev: &v1.IstioRevision{
+				Spec: v1.IstioRevisionSpec{
+					Values: &v1.Values{
+						Pilot: nil,
+					},
+				},
+			},
+			cfg:      defaultCfg,
+			expected: false,
+		},
+		{
+			name: "NoPilotEnv",
+			rev: &v1.IstioRevision{
+				Spec: v1.IstioRevisionSpec{
+					Values: &v1.Values{
+						Pilot: &v1.PilotConfig{
+							Env: nil,
+						},
+					},
+				},
+			},
+			cfg:      defaultCfg,
+			expected: false,
+		},
+		{
+			name: "PilotEnvAmbientDisabled",
+			rev: &v1.IstioRevision{
+				Spec: v1.IstioRevisionSpec{
+					Values: &v1.Values{
+						Pilot: &v1.PilotConfig{
+							Env: map[string]string{
+								"PILOT_ENABLE_AMBIENT": "false",
+							},
+						},
+					},
+				},
+			},
+			cfg:      defaultCfg,
+			expected: false,
+		},
+		{
+			name: "PilotEnvAmbientEnabled",
+			rev: &v1.IstioRevision{
+				Spec: v1.IstioRevisionSpec{
+					Values: &v1.Values{
+						Pilot: &v1.PilotConfig{
+							Env: map[string]string{
+								"PILOT_ENABLE_AMBIENT": "true",
+							},
+						},
+					},
+				},
+			},
+			cfg:      defaultCfg,
+			expected: true,
+		},
+		{
+			name: "AmbientProfileSet",
+			rev: &v1.IstioRevision{
+				Spec: v1.IstioRevisionSpec{
+					Values: &v1.Values{
+						Profile: ptr.Of("ambient"),
+					},
+				},
+			},
+			cfg:      defaultCfg,
+			expected: true,
+		},
+		{
+			name: "NonAmbientProfile",
+			rev: &v1.IstioRevision{
+				Spec: v1.IstioRevisionSpec{
+					Values: &v1.Values{
+						Profile: ptr.Of("default"),
+					},
+				},
+			},
+			cfg:      defaultCfg,
+			expected: false,
+		},
+		{
+			name: "AmbientProfileWithPilotEnvTrue",
+			rev: &v1.IstioRevision{
+				Spec: v1.IstioRevisionSpec{
+					Values: &v1.Values{
+						Profile: ptr.Of("ambient"),
+						Pilot: &v1.PilotConfig{
+							Env: map[string]string{
+								"PILOT_ENABLE_AMBIENT": "true",
+							},
+						},
+					},
+				},
+			},
+			cfg:      defaultCfg,
+			expected: true,
+		},
+		{
+			name: "EmptyProfile",
+			rev: &v1.IstioRevision{
+				Spec: v1.IstioRevisionSpec{
+					Values: &v1.Values{
+						Profile: ptr.Of(""),
+					},
+				},
+			},
+			cfg:      defaultCfg,
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := DependsOnZTunnel(tt.rev, tt.cfg)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
diff --git a/pkg/revision/prune.go b/pkg/revision/prune.go
index 9e8c0e73a..355e570d1 100644
--- a/pkg/revision/prune.go
+++ b/pkg/revision/prune.go
@@ -46,11 +46,17 @@ func PruneInactive(ctx context.Context, cl client.Client, ownerUID types.UID, ac
 			continue
 		}
 		inUseCondition := rev.Status.GetCondition(v1.IstioRevisionConditionInUse)
-		inUse := inUseCondition.Status == metav1.ConditionTrue
-		if inUse {
+
+		// Only prune revisions that are confirmed to be not in use (i.e., ConditionFalse).
+		// Skip revisions that are in use (ConditionTrue) or whose usage status is unknown (ConditionUnknown).
+		if inUseCondition.Status == metav1.ConditionTrue {
 			log.V(2).Info("IstioRevision is in use", "IstioRevision", rev.Name)
 			continue
 		}
+		if inUseCondition.Status != metav1.ConditionFalse {
+			log.V(2).Info("IstioRevision usage status is unknown, skipping pruning", "IstioRevision", rev.Name)
+			continue
+		}
 
 		pruneTimestamp := inUseCondition.LastTransitionTime.Time.Add(gracePeriod)
 		expired := pruneTimestamp.Before(time.Now())
diff --git a/pkg/revision/prune_test.go b/pkg/revision/prune_test.go
index 79956d28f..34bbdea3b 100644
--- a/pkg/revision/prune_test.go
+++ b/pkg/revision/prune_test.go
@@ -172,6 +172,29 @@ func TestPruneInactive(t *testing.T) {
 			expectDeletion:     true,
 			expectRequeueAfter: ptr.Of((v1.DefaultRevisionDeletionGracePeriodSeconds - 25) * time.Second),
 		},
+		{
+			name:           "preserves non-active IstioRevision with unknown usage status",
+			revName:        istioName + "-non-active",
+			ownerReference: ownedByIstio,
+			inUseCondition: &v1.IstioRevisionCondition{
+				Type:               v1.IstioRevisionConditionInUse,
+				Status:             metav1.ConditionUnknown,
+				Reason:             v1.IstioRevisionReasonUsageCheckFailed,
+				Message:            "failed to determine if revision is in use",
+				LastTransitionTime: oneMinuteAgo,
+			},
+			expectDeletion:     false,
+			expectRequeueAfter: nil,
+		},
+		{
+			name:           "preserves non-active IstioRevision with missing InUse condition",
+			revName:        istioName + "-non-active",
+			ownerReference: ownedByIstio,
+			// No InUse condition is set to simulate GetCondition returning ConditionUnknown
+			inUseCondition:     nil,
+			expectDeletion:     false,
+			expectRequeueAfter: nil,
+		},
 	}
 
 	for _, tc := range testCases {
@@ -191,9 +214,12 @@ func TestPruneInactive(t *testing.T) {
 					Name:            tc.revName,
 					OwnerReferences: []metav1.OwnerReference{tc.ownerReference},
 				},
-				Status: v1.IstioRevisionStatus{
+			}
+
+			if tc.inUseCondition != nil {
+				rev.Status = v1.IstioRevisionStatus{
 					Conditions: []v1.IstioRevisionCondition{*tc.inUseCondition},
-				},
+				}
 			}
 
 			initObjs := []client.Object{istio, rev}
diff --git a/pkg/revision/values_test.go b/pkg/revision/values_test.go
index 0c6b175dd..f55d2edf4 100644
--- a/pkg/revision/values_test.go
+++ b/pkg/revision/values_test.go
@@ -83,7 +83,8 @@ spec:
 			Platform:       ptr.Of("openshift"),
 			IstioNamespace: ptr.Of(namespace), // this value is always added/overridden based on IstioRevision.spec.namespace
 		},
-		Revision: ptr.Of(revisionName),
+		Revision:        ptr.Of(revisionName),
+		DefaultRevision: ptr.Of(""),
 	}
 
 	if !reflect.DeepEqual(result, expected) {
@@ -123,7 +124,8 @@ spec:`)), 0o644))
 			Platform:       ptr.Of("openshift"),
 			IstioNamespace: ptr.Of(namespace), // this value is always added/overridden based on IstioRevision.spec.namespace
 		},
-		Revision: ptr.Of(revisionName),
+		Revision:        ptr.Of(revisionName),
+		DefaultRevision: ptr.Of(""),
 	}
 
 	if !reflect.DeepEqual(result, expected) {
diff --git a/resources/v1.24.0/base-1.24.0.tgz.etag b/resources/v1.24.0/base-1.24.0.tgz.etag
deleted file mode 100644
index 1c48949f1..000000000
--- a/resources/v1.24.0/base-1.24.0.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-a17b1a73af26365222bbf5d3e6f61137
diff --git a/resources/v1.24.0/charts/base/Chart.yaml b/resources/v1.24.0/charts/base/Chart.yaml
deleted file mode 100644
index a6ff731e4..000000000
--- a/resources/v1.24.0/charts/base/Chart.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.0
-description: Helm chart for deploying Istio cluster resources and CRDs
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-name: base
-sources:
-- https://github.com/istio/istio
-version: 1.24.0
diff --git a/resources/v1.24.0/charts/base/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.0/charts/base/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.0/charts/base/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.0/charts/base/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.0/charts/base/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.0/charts/base/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.0/charts/base/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.0/charts/base/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.0/charts/base/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.0/charts/base/files/profile-demo.yaml b/resources/v1.24.0/charts/base/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.0/charts/base/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.0/charts/base/files/profile-platform-k3s.yaml b/resources/v1.24.0/charts/base/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.0/charts/base/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.0/charts/base/templates/zzz_profile.yaml b/resources/v1.24.0/charts/base/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.0/charts/base/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.0/charts/base/values.yaml b/resources/v1.24.0/charts/base/values.yaml
deleted file mode 100644
index 98c9c3645..000000000
--- a/resources/v1.24.0/charts/base/values.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  global:
-
-    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-
-    # Used to locate istiod.
-    istioNamespace: istio-system
-
-    # Platform where Istio is deployed. Possible values are: "openshift", "gcp".
-    # An empty value means it is a vanilla Kubernetes distribution, therefore no special
-    # treatment will be considered.
-    platform: ""
-  base:
-    # A list of CRDs to exclude. Requires `enableCRDTemplates` to be true.
-    # Example: `excludedCRDs: ["envoyfilters.networking.istio.io"]`.
-    # Note: when installing with `istioctl`, `enableIstioConfigCRDs=false` must also be set.
-    excludedCRDs: []
-    # Helm (as of V3) does not support upgrading CRDs, because it is not universally
-    # safe for them to support this.
-    # Istio as a project enforces certain backwards-compat guarantees that allow us
-    # to safely upgrade CRDs in spite of this, so we default to self-managing CRDs
-    # as standard K8S resources in Helm, and disable Helm's CRD management. See also:
-    # https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#method-2-separate-charts
-    enableCRDTemplates: true
-
-    # Validation webhook configuration url
-    # For example: https://$remotePilotAddress:15017/validate
-    validationURL: ""
-    # Validation webhook caBundle value. Useful when running pilot with a well known cert
-    validationCABundle: ""
-
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  defaultRevision: "default"
-  experimental:
-    stableValidationPolicy: false
diff --git a/resources/v1.24.0/charts/cni/Chart.yaml b/resources/v1.24.0/charts/cni/Chart.yaml
deleted file mode 100644
index e9605e000..000000000
--- a/resources/v1.24.0/charts/cni/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.0
-description: Helm chart for istio-cni components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-cni
-- istio
-name: cni
-sources:
-- https://github.com/istio/istio
-version: 1.24.0
diff --git a/resources/v1.24.0/charts/cni/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.0/charts/cni/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.0/charts/cni/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.0/charts/cni/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.0/charts/cni/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.0/charts/cni/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.0/charts/cni/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.0/charts/cni/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.0/charts/cni/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.0/charts/cni/files/profile-demo.yaml b/resources/v1.24.0/charts/cni/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.0/charts/cni/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.0/charts/cni/files/profile-platform-k3s.yaml b/resources/v1.24.0/charts/cni/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.0/charts/cni/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.0/charts/cni/templates/clusterrole.yaml b/resources/v1.24.0/charts/cni/templates/clusterrole.yaml
deleted file mode 100644
index ac36f9c0e..000000000
--- a/resources/v1.24.0/charts/cni/templates/clusterrole.yaml
+++ /dev/null
@@ -1,77 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: ["security.openshift.io"] 
-  resources: ["securitycontextconstraints"] 
-  resourceNames: ["privileged"] 
-  verbs: ["use"]
-- apiGroups: [""]
-  resources: ["pods","nodes","namespaces"]
-  verbs: ["get", "list", "watch"]
-{{- if (eq (coalesce .Values.platform .Values.global.platform) "openshift") }}
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
-{{- end }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-repair-role
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "patch"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["watch", "get", "list"]
-{{- if .Values.repair.repairPods }}
-{{- /*  No privileges needed*/}}
-{{- else if .Values.repair.deletePods }}
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["delete"]
-{{- else if .Values.repair.labelPods }}
-  - apiGroups: [""]
-    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-    resources: ["pods/status"]
-    verbs: ["patch", "update"]
-{{- end }}
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: [""]
-  {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-  resources: ["pods/status"]
-  verbs: ["patch", "update"]
-{{- end }}
diff --git a/resources/v1.24.0/charts/cni/templates/configmap-cni.yaml b/resources/v1.24.0/charts/cni/templates/configmap-cni.yaml
deleted file mode 100644
index 52d612441..000000000
--- a/resources/v1.24.0/charts/cni/templates/configmap-cni.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: {{ template "name" . }}-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  CURRENT_AGENT_VERSION: {{ .Values.tag | default .Values.global.tag | quote }}
-  AMBIENT_ENABLED: {{ .Values.ambient.enabled | quote }}
-  AMBIENT_DNS_CAPTURE: {{ .Values.ambient.dnsCapture | default "false" | quote  }}
-  AMBIENT_IPV6: {{ .Values.ambient.ipv6 | default "false" | quote }}
-  {{- if .Values.cniConfFileName }} # K8S < 1.24 doesn't like empty values
-  CNI_CONF_NAME: {{ .Values.cniConfFileName }} # Name of the CNI config file to create. Only override if you know the exact path your CNI requires..
-  {{- end }}
-  CHAINED_CNI_PLUGIN: {{ .Values.chained | quote }}
-  EXCLUDED_NAMESPACES: "{{ range $idx, $ns := .Values.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
-  REPAIR_ENABLED: {{ .Values.chained | quote }}
-  REPAIR_LABEL_PODS: {{ .Values.repair.labelPods | quote }}
-  REPAIR_DELETE_PODS: {{ .Values.repair.deletePods | quote }}
-  REPAIR_REPAIR_PODS: {{ .Values.repair.repairPods | quote }}
-  REPAIR_INIT_CONTAINER_NAME: {{ .Values.repair.initContainerName | quote }}
-  REPAIR_BROKEN_POD_LABEL_KEY: {{ .Values.repair.brokenPodLabelKey | quote }}
-  REPAIR_BROKEN_POD_LABEL_VALUE: {{ .Values.repair.brokenPodLabelValue | quote }}
-  {{- with .Values.env }}
-  {{- range $key, $val := . }}
-  {{ $key }}: "{{ $val }}"
-  {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.0/charts/cni/templates/daemonset.yaml b/resources/v1.24.0/charts/cni/templates/daemonset.yaml
deleted file mode 100644
index 7969b11b2..000000000
--- a/resources/v1.24.0/charts/cni/templates/daemonset.yaml
+++ /dev/null
@@ -1,218 +0,0 @@
-# This manifest installs the Istio install-cni container, as well
-# as the Istio CNI plugin and config on
-# each master and worker node in a Kubernetes cluster.
-{{- $defaultBinDir :=
-    (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
-      "/home/kubernetes/bin"
-      "/opt/cni/bin"
-}}
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  name: {{ template "name" . }}-node
-  namespace: {{ .Release.Namespace }}
-  labels:
-    k8s-app: {{ template "name" . }}-node
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  selector:
-    matchLabels:
-      k8s-app: {{ template "name" . }}-node
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  template:
-    metadata:
-      labels:
-        k8s-app: {{ template "name" . }}-node
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: {{ template "name" . }}
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-        # Add Prometheus Scrape annotations
-        prometheus.io/scrape: 'true'
-        prometheus.io/port: "15014"
-        prometheus.io/path: '/metrics'
-        # Custom annotations
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-      {{if .Values.ambient.enabled }}hostNetwork: true{{ end }}
-      nodeSelector:
-        kubernetes.io/os: linux
-      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      tolerations:
-        # Make sure istio-cni-node gets scheduled on all nodes.
-        - effect: NoSchedule
-          operator: Exists
-        # Mark the pod as a critical add-on for rescheduling.
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      priorityClassName: system-node-critical
-      serviceAccountName: {{ template "name" . }}
-      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
-      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
-      terminationGracePeriodSeconds: 5
-      containers:
-        # This container installs the Istio CNI binaries
-        # and CNI network config file on each node.
-        - name: install-cni
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
-{{- end }}
-{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
-{{- end }}
-          ports:
-          - containerPort: 15014
-            name: metrics
-            protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8000
-          securityContext:
-            privileged: false
-            runAsGroup: 0
-            runAsUser: 0
-            runAsNonRoot: false
-            # Both ambient and sidecar repair mode require elevated node privileges to function.
-            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
-            # add capabilities based on feature.
-            capabilities:
-              drop:
-              - ALL
-              add:
-              # CAP_NET_ADMIN is required to allow ipset and route table access
-              - NET_ADMIN
-              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
-              - NET_RAW
-              # CAP_SYS_PTRACE is required for repair mode to describe the pod's network namespace
-              # in ambient and repair mode.
-              - SYS_PTRACE
-              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
-              # network namespaces in `/proc` to obtain descriptors for entering pod network
-              # namespaces. There does not appear to be a more granular capability for this.
-              - SYS_ADMIN
-{{- if .Values.seLinuxOptions }}
-{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
-            seLinuxOptions:
-{{ toYaml . | trim | indent 14 }}
-{{- end }}
-{{- end }}
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          command: ["install-cni"]
-          args:
-            {{- if or .Values.logging.level .Values.global.logging.level }}
-            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
-            {{- end}}
-            {{- if .Values.global.logAsJson }}
-            - --log_as_json
-            {{- end}}
-          envFrom:
-            - configMapRef:
-                name: {{ template "name" . }}-config
-          env:
-            - name: REPAIR_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: REPAIR_RUN_AS_DAEMON
-              value: "true"
-            - name: REPAIR_SIDECAR_ANNOTATION
-              value: "sidecar.istio.io/status"
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  apiVersion: v1
-                  fieldPath: spec.nodeName
-            - name: GOMEMLIMIT
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.memory
-            - name: GOMAXPROCS
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.cpu
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          volumeMounts:
-            - mountPath: /host/opt/cni/bin
-              name: cni-bin-dir
-            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-            - mountPath: /host/proc
-              name: cni-host-procfs
-              readOnly: true
-            {{- end }}
-            - mountPath: /host/etc/cni/net.d
-              name: cni-net-dir
-            - mountPath: /var/run/istio-cni
-              name: cni-socket-dir
-            {{- if .Values.ambient.enabled }}
-            - mountPath: /host/var/run/netns
-              mountPropagation: HostToContainer
-              name: cni-netns-dir
-            - mountPath: /var/run/ztunnel
-              name: cni-ztunnel-sock-dir
-            {{ end }}
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-      volumes:
-        # Used to install CNI.
-        - name: cni-bin-dir
-          hostPath:
-            path: {{ .Values.cniBinDir | default $defaultBinDir }}
-        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-        - name: cni-host-procfs
-          hostPath:
-            path: /proc
-            type: Directory
-        {{- end }}
-        {{- if .Values.ambient.enabled }}
-        - name: cni-ztunnel-sock-dir
-          hostPath:
-            path: /var/run/ztunnel
-            type: DirectoryOrCreate
-        {{- end }}
-        - name: cni-net-dir
-          hostPath:
-            path: {{ default "/etc/cni/net.d" .Values.cniConfDir }}
-        # Used for UDS sockets for logging, ambient eventing
-        - name: cni-socket-dir
-          hostPath:
-            path: /var/run/istio-cni
-        - name: cni-netns-dir
-          hostPath:
-            path: {{ .Values.cniNetnsDir | default "/var/run/netns" }}
-            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
-            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
-            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.24.0/charts/cni/templates/zzz_profile.yaml b/resources/v1.24.0/charts/cni/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.0/charts/cni/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.0/charts/cni/values.yaml b/resources/v1.24.0/charts/cni/values.yaml
deleted file mode 100644
index bf78bec34..000000000
--- a/resources/v1.24.0/charts/cni/values.yaml
+++ /dev/null
@@ -1,149 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  hub: ""
-  tag: ""
-  variant: ""
-  image: install-cni
-  pullPolicy: ""
-
-  # Same as `global.logging.level`, but will override it if set
-  logging:
-    level: ""
-
-  # Configuration file to insert istio-cni plugin configuration
-  # by default this will be the first file found in the cni-conf-dir
-  # Example
-  # cniConfFileName: 10-calico.conflist
-
-  # CNI bin and conf dir override settings
-  # defaults:
-  cniBinDir: "" # Auto-detected based on version; defaults to /opt/cni/bin.
-  cniConfDir: /etc/cni/net.d
-  cniConfFileName: ""
-  # This directory must exist on the node, if it does not, consult your container runtime
-  # documentation for the appropriate path.
-  cniNetnsDir: # Defaults to '/var/run/netns', in minikube/docker/others can be '/var/run/docker/netns'.
-
-
-  excludeNamespaces:
-    - kube-system
-
-  # Allows user to set custom affinity for the DaemonSet
-  affinity: {}
-
-  # Custom annotations on pod level, if you need them
-  podAnnotations: {}
-
-  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
-  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
-  chained: true
-
-  # Custom configuration happens based on the CNI provider.
-  # Possible values: "default", "multus"
-  provider: "default"
-
-  # Configure ambient settings
-  ambient:
-    # If enabled, ambient redirection will be enabled
-    enabled: false
-    # Set ambient config dir path: defaults to /etc/ambient-config
-    configDir: ""
-    # If enabled, and ambient is enabled, DNS redirection will be enabled
-    dnsCapture: false
-    # If enabled, and ambient is enabled, enables ipv6 support
-    ipv6: true
-
-
-  repair:
-    enabled: true
-    hub: ""
-    tag: ""
-
-    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
-    # This defines the action the controller will take when a pod is detected as broken.
-
-    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
-    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
-    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
-    labelPods: false
-    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
-    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
-    deletePods: false
-    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
-    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
-    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
-    repairPods: true
-
-    initContainerName: "istio-validation"
-
-    brokenPodLabelKey: "cni.istio.io/uninitialized"
-    brokenPodLabelValue: "true"
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
-  seLinuxOptions: {}
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 100Mi
-
-  resourceQuotas:
-    enabled: false
-    pods: 5000
-
-  # The number of pods that can be unavailable during rolling update (see
-  # `updateStrategy.rollingUpdate.maxUnavailable` here:
-  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
-  # May be specified as a number of pods or as a percent of the total number
-  # of pods at the start of the update.
-  rollingMaxUnavailable: 1
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  global:
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-
-    # Default tag for Istio images.
-    tag: 1.24.0
-
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # change cni scope level to control logging out of istio-cni-node DaemonSet
-    logging:
-      level: info
-
-    logAsJson: false
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Default resources allocated
-    defaultResources:
-      requests:
-        cpu: 100m
-        memory: 100Mi
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
diff --git a/resources/v1.24.0/charts/gateway/Chart.yaml b/resources/v1.24.0/charts/gateway/Chart.yaml
deleted file mode 100644
index 07cf40586..000000000
--- a/resources/v1.24.0/charts/gateway/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.0
-description: Helm chart for deploying Istio gateways
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- gateways
-name: gateway
-sources:
-- https://github.com/istio/istio
-type: application
-version: 1.24.0
diff --git a/resources/v1.24.0/charts/gateway/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.0/charts/gateway/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.0/charts/gateway/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.0/charts/gateway/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.0/charts/gateway/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.0/charts/gateway/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.0/charts/gateway/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.0/charts/gateway/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.0/charts/gateway/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.0/charts/gateway/files/profile-demo.yaml b/resources/v1.24.0/charts/gateway/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.0/charts/gateway/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.0/charts/gateway/files/profile-platform-k3s.yaml b/resources/v1.24.0/charts/gateway/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.0/charts/gateway/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.0/charts/gateway/templates/deployment.yaml b/resources/v1.24.0/charts/gateway/templates/deployment.yaml
deleted file mode 100644
index e9bfbbd36..000000000
--- a/resources/v1.24.0/charts/gateway/templates/deployment.yaml
+++ /dev/null
@@ -1,128 +0,0 @@
-apiVersion: apps/v1
-kind: {{ .Values.kind | default "Deployment" }}
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  {{- with .Values.replicaCount }}
-  replicas: {{ . }}
-  {{- end }}
-  {{- end }}
-  {{- with .Values.strategy }}
-  strategy:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.minReadySeconds }}
-  minReadySeconds: {{ . }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "gateway.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
-        {{- include "gateway.selectorLabels" . | nindent 8 }}
-        app.kubernetes.io/name: {{ include "gateway.name" . }}
-        {{- include "istio.labels" .  | nindent 8}}
-        {{- range $key, $val := .Values.labels }}
-        {{- if and (ne $key "app") (ne $key "istio") }}
-        {{ $key | quote }}: {{ $val | quote }}
-        {{- end }}
-        {{- end }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
-      securityContext:
-      {{- if .Values.securityContext }}
-        {{- toYaml .Values.securityContext | nindent 8 }}
-      {{- else }}
-        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- end }}
-      {{- with .Values.volumes }}
-      volumes:
-        {{ toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: istio-proxy
-          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
-          image: auto
-          {{- with .Values.imagePullPolicy }}
-          imagePullPolicy: {{ . }}
-          {{- end }}
-          securityContext:
-          {{- if .Values.containerSecurityContext }}
-            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          {{- else }}
-            capabilities:
-              drop:
-              - ALL
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            {{- if not (eq .Values.platform "openshift") }}
-            runAsUser: 1337
-            runAsGroup: 1337
-            {{- end }}
-            runAsNonRoot: true
-          {{- end }}
-          env:
-          {{- with .Values.networkGateway }}
-          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-            value: "{{.}}"
-          {{- end }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: {{ $val | quote }}
-          {{- end }}
-          ports:
-          - containerPort: 15090
-            protocol: TCP
-            name: http-envoy-prom
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          {{- with .Values.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.readinessProbe }}
-          readinessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
-      {{- with .Values.priorityClassName }}
-      priorityClassName: {{ . }}
-      {{- end }}
diff --git a/resources/v1.24.0/charts/gateway/templates/service.yaml b/resources/v1.24.0/charts/gateway/templates/service.yaml
deleted file mode 100644
index 25ce3bcb0..000000000
--- a/resources/v1.24.0/charts/gateway/templates/service.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-{{- if not (eq .Values.service.type "None") }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-    {{- with .Values.networkGateway }}
-    topology.istio.io/network: "{{.}}"
-    {{- end }}
-  annotations:
-    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
-spec:
-{{- with .Values.service.loadBalancerIP }}
-  loadBalancerIP: "{{ . }}"
-{{- end }}
-{{- if eq .Values.service.type "LoadBalancer" }}
-  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
-  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
-  {{- end }}
-{{- end }}
-{{- if .Values.service.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.service.ipFamilies }}
-  ipFamilies:
-{{- range .Values.service.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
-{{- with .Values.service.loadBalancerSourceRanges }}
-  loadBalancerSourceRanges:
-{{ toYaml . | indent 4 }}
-{{- end }}
-{{- with .Values.service.externalTrafficPolicy }}
-  externalTrafficPolicy: "{{ . }}"
-{{- end }}
-  type: {{ .Values.service.type }}
-  ports:
-{{- if .Values.networkGateway }}
-  - name: status-port
-    port: 15021
-    targetPort: 15021
-  - name: tls
-    port: 15443
-    targetPort: 15443
-  - name: tls-istiod
-    port: 15012
-    targetPort: 15012
-  - name: tls-webhook
-    port: 15017
-    targetPort: 15017
-{{- else }}
-{{ .Values.service.ports | toYaml | indent 4 }}
-{{- end }}
-{{- if .Values.service.externalIPs }}
-  externalIPs: {{- range .Values.service.externalIPs }}
-    - {{.}}
-  {{- end }}
-{{- end }}
-  selector:
-    {{- include "gateway.selectorLabels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.24.0/charts/gateway/templates/zzz_profile.yaml b/resources/v1.24.0/charts/gateway/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.0/charts/gateway/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.0/charts/gateway/values.yaml b/resources/v1.24.0/charts/gateway/values.yaml
deleted file mode 100644
index b02240df1..000000000
--- a/resources/v1.24.0/charts/gateway/values.yaml
+++ /dev/null
@@ -1,166 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Name allows overriding the release name. Generally this should not be set
-  name: ""
-  # revision declares which revision this gateway is a part of
-  revision: ""
-
-  # Controls the spec.replicas setting for the Gateway deployment if set.
-  # Otherwise defaults to Kubernetes Deployment default (1).
-  replicaCount:
-
-  kind: Deployment
-
-  rbac:
-    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
-    # when using http://gateway-api.org/.
-    enabled: true
-
-  serviceAccount:
-    # If set, a service account will be created. Otherwise, the default is used
-    create: true
-    # Annotations to add to the service account
-    annotations: {}
-    # The name of the service account to use.
-    # If not set, the release name is used
-    name: ""
-
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/stats/prometheus"
-    inject.istio.io/templates: "gateway"
-    sidecar.istio.io/inject: "true"
-
-  # Define the security context for the pod.
-  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-  securityContext: {}
-  containerSecurityContext: {}
-
-  service:
-    # Type of service. Set to "None" to disable the service entirely
-    type: LoadBalancer
-    ports:
-    - name: status-port
-      port: 15021
-      protocol: TCP
-      targetPort: 15021
-    - name: http2
-      port: 80
-      protocol: TCP
-      targetPort: 80
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
-    annotations: {}
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    externalTrafficPolicy: ""
-    externalIPs: []
-    ipFamilyPolicy: ""
-    ipFamilies: []
-    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
-    # allocateLoadBalancerNodePorts: false
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: 2000m
-      memory: 1024Mi
-
-  autoscaling:
-    enabled: true
-    minReplicas: 1
-    maxReplicas: 5
-    targetCPUUtilizationPercentage: 80
-    targetMemoryUtilizationPercentage: {}
-    autoscaleBehavior: {}
-
-  # Pod environment variables
-  env: {}
-
-  # Deployment Update strategy
-  strategy: {}
-  
-  # Sets the Deployment minReadySeconds value
-  minReadySeconds:
-  
-  # Optionally configure a custom readinessProbe. By default the control plane
-  # automatically injects the readinessProbe. If you wish to override that
-  # behavior, you may define your own readinessProbe here.
-  readinessProbe: {}
-
-  # Labels to apply to all resources
-  labels: {}
-
-  # Annotations to apply to all resources
-  annotations: {}
-
-  nodeSelector: {}
-
-  tolerations: []
-
-  topologySpreadConstraints: []
-
-  affinity: {}
-
-  # If specified, the gateway will act as a network gateway for the given network.
-  networkGateway: ""
-
-  # Specify image pull policy if default behavior isn't desired.
-  # Default behavior: latest images will be Always else IfNotPresent
-  imagePullPolicy: ""
-
-  imagePullSecrets: []
-
-  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
-  #
-  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
-  # which means that no PodDisruptionBudget resource will be created.
-  #
-  # To enable the PodDisruptionBudget, configure it by specifying the
-  # `minAvailable` or `maxUnavailable`. For example, to set the
-  # minimum number of available replicas to 1, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #
-  # Or, to allow a maximum of 1 unavailable replica, you can set:
-  #
-  # podDisruptionBudget:
-  #   maxUnavailable: 1
-  #
-  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
-  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #   unhealthyPodEvictionPolicy: AlwaysAllow
-  #
-  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
-  #
-  # podDisruptionBudget: {}
-  #
-  podDisruptionBudget: {}
-
-  # Sets the per-pod terminationGracePeriodSeconds setting.
-  terminationGracePeriodSeconds: 30
-
-  # A list of `Volumes` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumes: []
-
-  # A list of `VolumeMounts` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumeMounts: []
-
-  # Configure this to a higher priority class in order to make sure your Istio gateway pods
-  # will not be killed because of low priority class.
-  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-  # for more detail.
-  priorityClassName: ""
diff --git a/resources/v1.24.0/charts/istiod/Chart.yaml b/resources/v1.24.0/charts/istiod/Chart.yaml
deleted file mode 100644
index 25750420a..000000000
--- a/resources/v1.24.0/charts/istiod/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.0
-description: Helm chart for istio control plane
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- istiod
-- istio-discovery
-name: istiod
-sources:
-- https://github.com/istio/istio
-version: 1.24.0
diff --git a/resources/v1.24.0/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.24.0/charts/istiod/files/gateway-injection-template.yaml
deleted file mode 100644
index 97ffb71f2..000000000
--- a/resources/v1.24.0/charts/istiod/files/gateway-injection-template.yaml
+++ /dev/null
@@ -1,250 +0,0 @@
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if eq (len $containers) 1 }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{ end }}
-  }
-spec:
-  securityContext:
-  {{- if .Values.gateways.securityContext }}
-    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
-  {{- else }}
-    sysctls:
-    - name: net.ipv4.ip_unprivileged_port_start
-      value: "0"
-  {{- end }}
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - router
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- end }}
-    securityContext:
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-    env:
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-  volumes:
-  - emptyDir: {}
-    name: workload-socket
-  - emptyDir: {}
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else}}
-  - emptyDir: {}
-    name: workload-certs
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.0/charts/istiod/files/grpc-agent.yaml b/resources/v1.24.0/charts/istiod/files/grpc-agent.yaml
deleted file mode 100644
index 7290fcdca..000000000
--- a/resources/v1.24.0/charts/istiod/files/grpc-agent.yaml
+++ /dev/null
@@ -1,310 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-    sidecar.istio.io/rewriteAppHTTPProbers: "false",
-  }
-spec:
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15020
-      protocol: TCP
-      name: mesh-metrics
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-          - --url=http://localhost:15020/healthz/ready
-    env:
-    - name: ISTIO_META_GENERATOR
-      value: grpc
-    - name: OUTPUT_CERTS
-      value: /var/lib/istio/data
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    # grpc uses xds:/// to resolve – no need to resolve VIP
-    - name: ISTIO_META_DNS_CAPTURE
-      value: "false"
-    - name: DISABLE_ENVOY
-      value: "true"
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15020
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # UDS channel between istioagent and gRPC client for XDS/SDS
-    - mountPath: /etc/istio/proxy
-      name: istio-xds
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-{{- range $index, $container := .Spec.Containers  }}
-{{ if not (eq $container.Name "istio-proxy") }}
-  - name: {{ $container.Name }}
-    env:
-      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
-        value: "true"
-      - name: "GRPC_XDS_BOOTSTRAP"
-        value: "/etc/istio/proxy/grpc-bootstrap.json"
-    volumeMounts:
-      - mountPath: /var/lib/istio/data
-        name: istio-data
-      # UDS channel between istioagent and gRPC client for XDS/SDS
-      - mountPath: /etc/istio/proxy
-        name: istio-xds
-      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-        readOnly: true
-      {{- else }}
-      - name: workload-certs
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-      {{- end }}
-{{- end }}
-{{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-xds
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.0/charts/istiod/files/injection-template.yaml b/resources/v1.24.0/charts/istiod/files/injection-template.yaml
deleted file mode 100644
index 0ef948e6a..000000000
--- a/resources/v1.24.0/charts/istiod/files/injection-template.yaml
+++ /dev/null
@@ -1,510 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
-    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
-    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
-    {{- end }}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-{{- if .Values.pilot.cni.enabled }}
-    {{- if eq .Values.pilot.cni.provider "multus" }}
-    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
-    {{- end }}
-    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}traffic.sidecar.istio.io/includeInboundPorts: "{{.}}",{{ end }}
-    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
-    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
-    {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
-    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
-    {{- end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
-{{- end }}
-  }
-spec:
-  {{- $holdProxy := and
-      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
-      (not $nativeSidecar) }}
-  initContainers:
-  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
-  {{ if .Values.pilot.cni.enabled -}}
-  - name: istio-validation
-  {{ else -}}
-  - name: istio-init
-  {{ end -}}
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    args:
-    - istio-iptables
-    - "-p"
-    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
-    - "-z"
-    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
-    - "-u"
-    - {{ .ProxyUID | default "1337" | quote }}
-    - "-m"
-    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
-    - "-i"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
-    - "-x"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
-    - "-b"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
-    - "-d"
-  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
-    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
-  {{- else }}
-    - "15090,15021"
-  {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
-    - "-q"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
-    {{ end -}}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
-    - "-o"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
-    {{ end -}}
-     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
-    - "-c"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
-    {{ end -}}
-    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
-    {{ if .Values.global.logAsJson -}}
-    - "--log_as_json"
-    {{ end -}}
-    {{ if .Values.pilot.cni.enabled -}}
-    - "--run-validation"
-    - "--skip-rule-apply"
-    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
-    - "--force-apply"
-    {{ end -}}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-  {{- if .ProxyConfig.ProxyMetadata }}
-    env:
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-  {{- end }}
-    resources:
-  {{ template "resources" . }}
-    securityContext:
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      privileged: {{ .Values.global.proxy.privileged }}
-      capabilities:
-    {{- if not .Values.pilot.cni.enabled }}
-        add:
-        - NET_ADMIN
-        - NET_RAW
-    {{- end }}
-        drop:
-        - ALL
-    {{- if not .Values.pilot.cni.enabled }}
-      readOnlyRootFilesystem: false
-      runAsGroup: 0
-      runAsNonRoot: false
-      runAsUser: 0
-    {{- else }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsNonRoot: true
-    {{- end }}
-  {{ end -}}
-  {{ if not $nativeSidecar }}
-  containers:
-  {{ end }}
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.outlierLogPath }}
-    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-  {{- end}}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- else if $holdProxy }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-  {{- else if $nativeSidecar }}
-    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
-    lifecycle:
-      preStop:
-        exec:
-          command:
-          - pilot-agent
-          - request
-          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
-          - POST
-          - drain
-  {{- end }}
-    env:
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - name: ISTIO_BOOTSTRAP_OVERRIDE
-      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
-    {{- end }}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-  {{ if .Values.global.proxy.startupProbe.enabled }}
-    startupProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: 0
-      periodSeconds: 1
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
-  {{ end }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    {{ end -}}
-    securityContext:
-      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
-      allowPrivilegeEscalation: true
-      capabilities:
-        add:
-        - NET_ADMIN
-        drop:
-        - ALL
-      privileged: true
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else }}
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      capabilities:
-        {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-        add:
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
-        - NET_ADMIN
-        {{- end }}
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
-        - NET_BIND_SERVICE
-        {{- end }}
-        {{- end }}
-        drop:
-        - ALL
-      privileged: {{ .Values.global.proxy.privileged }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else -}}
-      runAsNonRoot: true
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      {{- end }}
-      {{- end }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - mountPath: /etc/istio/custom-bootstrap
-      name: custom-bootstrap-volume
-    {{- end }}
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
-      name: lightstep-certs
-      readOnly: true
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  - emptyDir:
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-  - name: lightstep-certs
-    secret:
-      optional: true
-      secretName: lightstep.cacert
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.0/charts/istiod/files/kube-gateway.yaml b/resources/v1.24.0/charts/istiod/files/kube-gateway.yaml
deleted file mode 100644
index dbe158de1..000000000
--- a/resources/v1.24.0/charts/istiod/files/kube-gateway.yaml
+++ /dev/null
@@ -1,345 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-gateway-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": {{.Name}}
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-gateway-controller"
-          ) | nindent 8 }}
-    spec:
-      securityContext:
-      {{- if .Values.gateways.securityContext }}
-        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
-      {{- else }}
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- if .Values.gateways.seccompProfile }}
-        seccompProfile:
-      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
-      {{- end }}
-      {{- end }}
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-      {{- else }}
-        image: "{{ .ProxyImage }}"
-      {{- end }}
-        {{- if .Values.global.proxy.resources }}
-        resources:
-          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsUser: {{ .ProxyUID | default "1337" }}
-          runAsGroup: {{ .ProxyGID | default "1337" }}
-          runAsNonRoot: true
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        args:
-        - proxy
-        - router
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-      {{- if .Values.global.sts.servicePort }}
-        - --stsPort={{ .Values.global.sts.servicePort }}
-      {{- end }}
-      {{- if .Values.global.logAsJson }}
-        - --log_as_json
-      {{- end }}
-      {{- if .Values.global.proxy.lifecycle }}
-        lifecycle:
-          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
-      {{- end }}
-        env:
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        - name: ISTIO_META_POD_PORTS
-          value: "[]"
-        - name: ISTIO_META_APP_CONTAINERS
-          value: ""
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: "{{ .ProxyConfig.InterceptionMode.String }}"
-        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
-        - name: ISTIO_META_NETWORK
-          value: {{.|quote}}
-        {{- end }}
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName|quote}}
-        - name: ISTIO_META_OWNER
-          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
-        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-          value: {{.|quote}}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        volumeMounts:
-        - name: workload-socket
-          mountPath: /var/run/secrets/workload-spiffe-uds
-        - name: credential-socket
-          mountPath: /var/run/secrets/credential-uds
-        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-        - name: gke-workload-certificate
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-          readOnly: true
-        {{- else }}
-        - name: workload-certs
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-        {{- end }}
-        {{- if eq .Values.global.pilotCertProvider "istiod" }}
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        {{- end }}
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        # SDS channel between istioagent and Envoy
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - name: istio-podinfo
-          mountPath: /etc/istio/pod
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir: {}
-        name: credential-socket
-      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        csi:
-          driver: workloadcertificates.security.cloud.google.com
-      {{- else}}
-      - emptyDir: {}
-        name: workload-certs
-      {{- end }}
-      # SDS channel between istioagent and Envoy
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - name: istio-data
-        emptyDir: {}
-      - name: istio-podinfo
-        downwardAPI:
-          items:
-            - path: "labels"
-              fieldRef:
-                fieldPath: metadata.labels
-            - path: "annotations"
-              fieldRef:
-                fieldPath: metadata.annotations
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: {{ .Values.global.sds.token.aud }}
-      {{- if eq .Values.global.pilotCertProvider "istiod" }}
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: {{.UID}}
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": {{.Name}}
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.24.0/charts/istiod/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.0/charts/istiod/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.0/charts/istiod/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.0/charts/istiod/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.0/charts/istiod/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.0/charts/istiod/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.0/charts/istiod/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.0/charts/istiod/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.0/charts/istiod/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.0/charts/istiod/files/profile-demo.yaml b/resources/v1.24.0/charts/istiod/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.0/charts/istiod/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.0/charts/istiod/files/profile-platform-k3s.yaml b/resources/v1.24.0/charts/istiod/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.0/charts/istiod/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.0/charts/istiod/files/waypoint.yaml b/resources/v1.24.0/charts/istiod/files/waypoint.yaml
deleted file mode 100644
index bbe47674b..000000000
--- a/resources/v1.24.0/charts/istiod/files/waypoint.yaml
+++ /dev/null
@@ -1,333 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-mesh-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": "{{.Name}}"
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "istio.io/dataplane-mode" "none"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-mesh-controller"
-          ) | nindent 8}}
-    spec:
-      {{- if .Values.global.waypoint.affinity }}
-      affinity:
-      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.topologySpreadConstraints }}
-      topologySpreadConstraints:
-      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.nodeSelector }}
-      nodeSelector:
-      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.tolerations }}
-      tolerations:
-      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: 2
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-        {{- else }}
-        image: "{{ .ProxyImage }}"
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        args:
-        - proxy
-        - waypoint
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --serviceCluster
-        - {{.ServiceAccount}}.$(POD_NAMESPACE)
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-        {{- if .Values.global.logAsJson }}
-        - --log_as_json
-        {{- end }}
-        env:
-        - name: ISTIO_META_SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        {{- if .ProxyConfig.ProxyMetadata }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
-        {{- if $network }}
-        - name: ISTIO_META_NETWORK
-          value: "{{ $network }}"
-        {{- end }}
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: REDIRECT
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName}}
-        - name: ISTIO_META_OWNER
-          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- if .Values.global.waypoint.resources }}
-        resources:
-        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        securityContext:
-          privileged: false
-        {{- if not (eq .Values.global.platform "openshift") }}
-          runAsGroup: 1337
-          runAsUser: 1337
-        {{- end }}
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-            - ALL
-{{- if .Values.gateways.seccompProfile }}
-          seccompProfile:
-{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
-{{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/workload-spiffe-uds
-          name: workload-socket
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /etc/istio/pod
-          name: istio-podinfo
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - emptyDir:
-          medium: Memory
-        name: go-proxy-envoy
-      - emptyDir: {}
-        name: istio-data
-      - emptyDir: {}
-        name: go-proxy-data
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.labels
-            path: labels
-          - fieldRef:
-              fieldPath: metadata.annotations
-            path: annotations
-        name: istio-podinfo
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              audience: istio-ca
-              expirationSeconds: 43200
-              path: istio-token
-      - configMap:
-          name: istio-ca-root-cert
-        name: istiod-ca-cert
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap
-      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
-      (omit .InfrastructureAnnotations
-        "kubectl.kubernetes.io/last-applied-configuration"
-        "gateway.istio.io/name-override"
-        "gateway.istio.io/service-account"
-        "gateway.istio.io/controller-version"
-      ) | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": "{{.Name}}"
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.24.0/charts/istiod/templates/clusterrole.yaml b/resources/v1.24.0/charts/istiod/templates/clusterrole.yaml
deleted file mode 100644
index 0c340b5b3..000000000
--- a/resources/v1.24.0/charts/istiod/templates/clusterrole.yaml
+++ /dev/null
@@ -1,187 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  # sidecar injection controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-
-  # configuration validation webhook controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-
-  # istio configuration
-  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
-  # please proceed with caution
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["get", "watch", "list"]
-    resources: ["*"]
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["update", "patch"]
-    resources:
-    - authorizationpolicies/status
-    - destinationrules/status
-    - envoyfilters/status
-    - gateways/status
-    - peerauthentications/status
-    - proxyconfigs/status
-    - requestauthentications/status
-    - serviceentries/status
-    - sidecars/status
-    - telemetries/status
-    - virtualservices/status
-    - wasmplugins/status
-    - workloadentries/status
-    - workloadgroups/status
-{{- end }}
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries/status",  "serviceentries/status" ]
-  - apiGroups: ["security.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "authorizationpolicies/status" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services/status" ]
-
-  # auto-detect installed CRD definitions
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-
-  # discovery and routing
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-
-{{- if .Values.taint.enabled }}
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["patch"]
-{{- end }}
-
-  # ingress controller
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-{{- end}}
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses", "ingressclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-
-  # required for CA's namespace controller
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-
-  # Istiod and bootstrap.
-{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
-{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "certificatesigningrequests"
-      - "certificatesigningrequests/approval"
-      - "certificatesigningrequests/status"
-    verbs: ["update", "create", "get", "delete", "watch"]
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "signers"
-    resourceNames:
-{{- range .Values.global.certSigners }}
-    - {{ . | quote }}
-{{- end }}
-    verbs: ["approve"]
-{{- end}}
-
-  # Used by Istiod to verify the JWT tokens
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-
-  # Used by Istiod to verify gateway SDS
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-
-  # Use for Kubernetes Service APIs
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources:
-    - backendtlspolicies/status
-    - gatewayclasses/status
-    - gateways/status
-    - grpcroutes/status
-    - httproutes/status
-    - referencegrants/status
-    - tcproutes/status
-    - tlsroutes/status
-    - udproutes/status
-    verbs: ["update", "patch"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["gatewayclasses"]
-    verbs: ["create", "update", "patch", "delete"]
-
-  # Needed for multicluster secret reading, possibly ingress certs in the future
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "watch", "list"]
-
-  # Used for MCS serviceexport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: [ "get", "watch", "list", "create", "delete"]
-
-  # Used for MCS serviceimport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "watch", "list"]
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: ["apps"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "deployments" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "serviceaccounts"]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.0/charts/istiod/templates/configmap-values.yaml b/resources/v1.24.0/charts/istiod/templates/configmap-values.yaml
deleted file mode 100644
index a7e60369d..000000000
--- a/resources/v1.24.0/charts/istiod/templates/configmap-values.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  original-values: |-
-{{ .Values._original | toPrettyJson | indent 4 }}
-{{- $_ := unset $.Values "_original" }}
-  merged-values: |-
-{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.24.0/charts/istiod/templates/configmap.yaml b/resources/v1.24.0/charts/istiod/templates/configmap.yaml
deleted file mode 100644
index 57702ea53..000000000
--- a/resources/v1.24.0/charts/istiod/templates/configmap.yaml
+++ /dev/null
@@ -1,109 +0,0 @@
-{{- define "mesh" }}
-    # The trust domain corresponds to the trust root of a system.
-    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
-    trustDomain: "cluster.local"
-
-    # The namespace to treat as the administrative root namespace for Istio configuration.
-    # When processing a leaf namespace Istio will search for declarations in that namespace first
-    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
-    # is processed as if it were declared in the leaf namespace.
-    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
-
-  {{ $prom := include "default-prometheus" . | eq "true" }}
-  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
-  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
-  {{- if or $prom $sdMetrics $sdLogs }}
-    defaultProviders:
-    {{- if or $prom $sdMetrics }}
-      metrics:
-      {{ if $prom }}- prometheus{{ end }}
-      {{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
-    {{- end }}
-    {{- if and $sdMetrics $sdLogs }}
-      accessLogging:
-      - stackdriver
-    {{- end }}
-  {{- end }}
-
-    defaultConfig:
-      {{- if .Values.global.meshID }}
-      meshId: "{{ .Values.global.meshID }}"
-      {{- end }}
-      {{- with (.Values.global.proxy.variant | default .Values.global.variant) }}
-      image:
-        imageType: {{. | quote}}
-      {{- end }}
-      {{- if not (eq .Values.global.proxy.tracer "none") }}
-      tracing:
-      {{- if eq .Values.global.proxy.tracer "lightstep" }}
-        lightstep:
-          # Address of the LightStep Satellite pool
-          address: {{ .Values.global.tracer.lightstep.address }}
-          # Access Token used to communicate with the Satellite pool
-          accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
-      {{- else if eq .Values.global.proxy.tracer "zipkin" }}
-        zipkin:
-          # Address of the Zipkin collector
-          address: {{ ((.Values.global.tracer).zipkin).address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
-      {{- else if eq .Values.global.proxy.tracer "datadog" }}
-        datadog:
-          # Address of the Datadog Agent
-          address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
-      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
-        stackdriver:
-          # enables trace output to stdout.
-          debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}
-          # The global default max number of attributes per span.
-          maxNumberOfAttributes: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAttributes | default "200" }}
-          # The global default max number of annotation events per span.
-          maxNumberOfAnnotations: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAnnotations | default "200" }}
-          # The global default max number of message events per span.
-          maxNumberOfMessageEvents: {{ (($.Values.global.tracer).stackdriver).maxNumberOfMessageEvents | default "200" }}
-      {{- else if eq .Values.global.proxy.tracer "openCensusAgent" }}
-      {{/* Fill in openCensusAgent configuration from meshConfig so it isn't overwritten below */}}
-{{ toYaml $.Values.meshConfig.defaultConfig.tracing | indent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- if .Values.global.remotePilotAddress }}
-      discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
-      {{- else }}
-      discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
-      {{- end }}
-{{- end }}
-
-{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
-{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
-{{- $originalMesh := include "mesh" . | fromYaml }}
-{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
-
-{{- if .Values.configMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-
-  # Configuration file for the mesh networks to be used by the Split Horizon EDS.
-  meshNetworks: |-
-  {{- if .Values.global.meshNetworks }}
-    networks:
-{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
-  {{- else }}
-    networks: {}
-  {{- end }}
-
-  mesh: |-
-{{- if .Values.meshConfig }}
-{{ $mesh | toYaml | indent 4 }}
-{{- else }}
-{{- include "mesh" . }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.0/charts/istiod/templates/deployment.yaml b/resources/v1.24.0/charts/istiod/templates/deployment.yaml
deleted file mode 100644
index cd48ab757..000000000
--- a/resources/v1.24.0/charts/istiod/templates/deployment.yaml
+++ /dev/null
@@ -1,290 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- range $key, $val := .Values.deploymentLabels }}
-    {{ $key }}: "{{ $val }}"
-{{- end }}
-spec:
-{{- if not .Values.autoscaleEnabled }}
-{{- if .Values.replicaCount }}
-  replicas: {{ .Values.replicaCount }}
-{{- end }}
-{{- end }}
-  strategy:
-    rollingUpdate:
-      maxSurge: {{ .Values.rollingMaxSurge }}
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  selector:
-    matchLabels:
-      {{- if ne .Values.revision "" }}
-      app: istiod
-      istio.io/rev: {{ .Values.revision | default "default" | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
-  template:
-    metadata:
-      labels:
-        app: istiod
-        istio.io/rev: {{ .Values.revision | default "default" | quote }}
-        sidecar.istio.io/inject: "false"
-        operator.istio.io/component: "Pilot"
-        {{- if ne .Values.revision "" }}
-        istio: istiod
-        {{- else }}
-        istio: pilot
-        {{- end }}
-        {{- range $key, $val := .Values.podLabels }}
-        {{ $key }}: "{{ $val }}"
-        {{- end }}
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: "istiod"
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        prometheus.io/port: "15014"
-        prometheus.io/scrape: "true"
-        sidecar.istio.io/inject: "false"
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{- if .Values.nodeSelector }}
-      nodeSelector:
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- with .Values.affinity }}
-      affinity:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      tolerations:
-        - key: cni.istio.io/not-ready
-          operator: "Exists"
-{{- with .Values.tolerations }}
-{{- toYaml . | nindent 8 }}
-{{- end }}
-{{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- if .Values.global.priorityClassName }}
-      priorityClassName: "{{ .Values.global.priorityClassName }}"
-{{- end }}
-{{- with .Values.initContainers }}
-      initContainers:
-        {{- tpl (toYaml .) $ | nindent 8 }}
-{{- end }}
-      containers:
-        - name: discovery
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
-{{- end }}
-{{- if .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
-{{- end }}
-          args:
-          - "discovery"
-          - --monitoringAddr=:15014
-{{- if .Values.global.logging.level }}
-          - --log_output_level={{ .Values.global.logging.level }}
-{{- end}}
-{{- if .Values.global.logAsJson }}
-          - --log_as_json
-{{- end }}
-          - --domain
-          - {{ .Values.global.proxy.clusterDomain }}
-{{- if .Values.taint.namespace }}
-          - --cniNamespace={{ .Values.taint.namespace }}
-{{- end }}
-          - --keepaliveMaxServerConnectionAge
-          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
-{{- if .Values.extraContainerArgs }}
-          {{- with .Values.extraContainerArgs }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-{{- end }}
-          ports:
-          - containerPort: 8080
-            protocol: TCP
-            name: http-debug
-          - containerPort: 15010
-            protocol: TCP
-            name: grpc-xds
-          - containerPort: 15012
-            protocol: TCP
-            name: tls-xds
-          - containerPort: 15017
-            protocol: TCP
-            name: https-webhooks
-          - containerPort: 15014
-            protocol: TCP
-            name: http-monitoring
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 8080
-            initialDelaySeconds: 1
-            periodSeconds: 3
-            timeoutSeconds: 5
-          env:
-          - name: REVISION
-            value: "{{ .Values.revision | default `default` }}"
-          - name: PILOT_CERT_PROVIDER
-            value: {{ .Values.global.pilotCertProvider }}
-          - name: POD_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.name
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.namespace
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: spec.serviceAccountName
-          - name: KUBECONFIG
-            value: /var/run/secrets/remote/config
-          # If you explicitly told us where ztunnel lives, use that.
-          # Otherwise, assume it lives in our namespace
-          # Also, check for an explicit ENV override (legacy approach) and prefer that
-          # if present
-          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
-          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
-          - name: CA_TRUSTED_NODE_ACCOUNTS
-            value: "{{ $ztTrustedNS }}/ztunnel"
-          {{- end }}
-          {{- if .Values.env }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: "{{ $val }}"
-          {{- end }}
-          {{- end }}
-{{- if .Values.traceSampling }}
-          - name: PILOT_TRACE_SAMPLING
-            value: "{{ .Values.traceSampling }}"
-{{- end }}
-# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
-# don't set it here to avoid duplication.
-# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
-{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
-          - name: EXTERNAL_ISTIOD
-            value: "{{ .Values.global.externalIstiod }}"
-{{- end }}
-          - name: PILOT_ENABLE_ANALYSIS
-            value: "{{ .Values.global.istiod.enableAnalysis }}"
-          - name: CLUSTER_ID
-            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
-          - name: GOMEMLIMIT
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.memory
-          - name: GOMAXPROCS
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.cpu
-                divisor: "1"
-          - name: PLATFORM
-            value: "{{ coalesce .Values.global.platform .Values.platform }}"
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-              - ALL
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          volumeMounts:
-          - name: istio-token
-            mountPath: /var/run/secrets/tokens
-            readOnly: true
-          - name: local-certs
-            mountPath: /var/run/secrets/istio-dns
-          - name: cacerts
-            mountPath: /etc/cacerts
-            readOnly: true
-          - name: istio-kubeconfig
-            mountPath: /var/run/secrets/remote
-            readOnly: true
-          {{- if .Values.jwksResolverExtraRootCA }}
-          - name: extracacerts
-            mountPath: /cacerts
-          {{- end }}
-          - name: istio-csr-dns-cert
-            mountPath: /var/run/secrets/istiod/tls
-            readOnly: true
-          - name: istio-csr-ca-configmap
-            mountPath: /var/run/secrets/istiod/ca
-            readOnly: true
-          {{- with .Values.volumeMounts }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-      volumes:
-      # Technically not needed on this pod - but it helps debugging/testing SDS
-      # Should be removed after everything works.
-      - emptyDir:
-          medium: Memory
-        name: local-certs
-      - name: istio-token
-        projected:
-          sources:
-            - serviceAccountToken:
-                audience: {{ .Values.global.sds.token.aud }}
-                expirationSeconds: 43200
-                path: istio-token
-      # Optional: user-generated root
-      - name: cacerts
-        secret:
-          secretName: cacerts
-          optional: true
-      - name: istio-kubeconfig
-        secret:
-          secretName: istio-kubeconfig
-          optional: true
-      # Optional: istio-csr dns pilot certs
-      - name: istio-csr-dns-cert
-        secret:
-          secretName: istiod-tls
-          optional: true
-      - name: istio-csr-ca-configmap
-        configMap:
-          name: istio-ca-root-cert
-          defaultMode: 420
-          optional: true
-  {{- if .Values.jwksResolverExtraRootCA }}
-      - name: extracacerts
-        configMap:
-          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  {{- end }}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
-
----
-{{- end }}
diff --git a/resources/v1.24.0/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.24.0/charts/istiod/templates/istiod-injector-configmap.yaml
deleted file mode 100644
index 560c284ff..000000000
--- a/resources/v1.24.0/charts/istiod/templates/istiod-injector-configmap.yaml
+++ /dev/null
@@ -1,81 +0,0 @@
-{{- if not .Values.global.omitSidecarInjectorConfigMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
-  values: |-
-{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
-{{ $pilotVals := pick .Values "cni" -}}
-{{ $vals = set $vals "pilot" $pilotVals -}}
-{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
-{{ $vals = set $vals "gateways" $gatewayVals -}}
-{{ $vals | toPrettyJson | indent 4 }}
-
-  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
-  # and istiod webhook functionality.
-  #
-  # New fields should not use Values - it is a 'primary' config object, users should be able
-  # to fine tune it or use it with kube-inject.
-  config: |-
-    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
-    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
-    defaultTemplates:
-{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
-    - {{ . }}
-{{- end }}
-    {{- else }}
-    defaultTemplates: [sidecar]
-    {{- end }}
-    policy: {{ .Values.global.proxy.autoInject }}
-    alwaysInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
-    neverInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
-    injectedAnnotations:
-      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
-      "{{ $key }}": {{ $val | quote }}
-      {{- end }}
-    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
-         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
-         This should make it obvious that their installation is broken.
-     */}}
-    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
-    templates:
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
-      sidecar: |
-{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
-      gateway: |
-{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
-      grpc-simple: |
-{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
-      grpc-agent: |
-{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
-      waypoint: |
-{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
-      kube-gateway: |
-{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
-{{- end }}
-{{- with .Values.sidecarInjectorWebhook.templates }}
-{{ toYaml . | trim | indent 6 }}
-{{- end }}
-
-{{- end }}
diff --git a/resources/v1.24.0/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.24.0/charts/istiod/templates/remote-istiod-service.yaml
deleted file mode 100644
index 220277dc0..000000000
--- a/resources/v1.24.0/charts/istiod/templates/remote-istiod-service.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 443
-    targetPort: 15017
-    name: tcp-webhook
-    protocol: TCP
-  {{- if and .Values.global.remotePilotAddress (not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress)) }}
-  # if the remotePilotAddress is not an IP addr, we use ExternalName
-  type: ExternalName
-  externalName: {{ .Values.global.remotePilotAddress }}
-  {{- end }}
-{{- if .Values.global.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.global.ipFamilies }}
-  ipFamilies:
-{{- range .Values.global.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.0/charts/istiod/templates/revision-tags.yaml b/resources/v1.24.0/charts/istiod/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.24.0/charts/istiod/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.0/charts/istiod/templates/serviceaccount.yaml b/resources/v1.24.0/charts/istiod/templates/serviceaccount.yaml
deleted file mode 100644
index 22b841e87..000000000
--- a/resources/v1.24.0/charts/istiod/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-  {{- if .Values.serviceAccountAnnotations }}
-  annotations:
-{{- toYaml .Values.serviceAccountAnnotations | indent 4 }}
-  {{- end }}
-{{- end }}
----
diff --git a/resources/v1.24.0/charts/istiod/templates/zzz_profile.yaml b/resources/v1.24.0/charts/istiod/templates/zzz_profile.yaml
deleted file mode 100644
index 52f665fbd..000000000
--- a/resources/v1.24.0/charts/istiod/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $x := set $.Values "_original" (deepCopy $.Values) }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.0/charts/istiod/values.yaml b/resources/v1.24.0/charts/istiod/values.yaml
deleted file mode 100644
index 761208bb3..000000000
--- a/resources/v1.24.0/charts/istiod/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.24.0
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.24.0/charts/revisiontags/Chart.yaml b/resources/v1.24.0/charts/revisiontags/Chart.yaml
deleted file mode 100644
index 023963826..000000000
--- a/resources/v1.24.0/charts/revisiontags/Chart.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.0
-description: Helm chart for istio revision tags
-name: revisiontags
-sources:
-- https://github.com/istio-ecosystem/sail-operator
-version: 0.1.0
-
diff --git a/resources/v1.24.0/charts/revisiontags/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.0/charts/revisiontags/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.0/charts/revisiontags/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.0/charts/revisiontags/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.0/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.0/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.0/charts/revisiontags/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.0/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.0/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.0/charts/revisiontags/files/profile-demo.yaml b/resources/v1.24.0/charts/revisiontags/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.0/charts/revisiontags/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.0/charts/revisiontags/files/profile-platform-k3s.yaml b/resources/v1.24.0/charts/revisiontags/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.0/charts/revisiontags/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.0/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.24.0/charts/revisiontags/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.24.0/charts/revisiontags/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.0/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.24.0/charts/revisiontags/templates/zzz_profile.yaml
deleted file mode 100644
index 52f665fbd..000000000
--- a/resources/v1.24.0/charts/revisiontags/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $x := set $.Values "_original" (deepCopy $.Values) }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.0/charts/revisiontags/values.yaml b/resources/v1.24.0/charts/revisiontags/values.yaml
deleted file mode 100644
index 761208bb3..000000000
--- a/resources/v1.24.0/charts/revisiontags/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.24.0
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.24.0/charts/ztunnel/Chart.yaml b/resources/v1.24.0/charts/ztunnel/Chart.yaml
deleted file mode 100644
index 27965303c..000000000
--- a/resources/v1.24.0/charts/ztunnel/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.0
-description: Helm chart for istio ztunnel components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-ztunnel
-- istio
-name: ztunnel
-sources:
-- https://github.com/istio/istio
-version: 1.24.0
diff --git a/resources/v1.24.0/charts/ztunnel/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.0/charts/ztunnel/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.0/charts/ztunnel/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.0/charts/ztunnel/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.0/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.0/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.0/charts/ztunnel/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.0/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.0/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.0/charts/ztunnel/files/profile-demo.yaml b/resources/v1.24.0/charts/ztunnel/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.0/charts/ztunnel/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.0/charts/ztunnel/files/profile-platform-k3s.yaml b/resources/v1.24.0/charts/ztunnel/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.0/charts/ztunnel/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.0/charts/ztunnel/templates/daemonset.yaml b/resources/v1.24.0/charts/ztunnel/templates/daemonset.yaml
deleted file mode 100644
index c6e2daf48..000000000
--- a/resources/v1.24.0/charts/ztunnel/templates/daemonset.yaml
+++ /dev/null
@@ -1,197 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-spec:
-  updateStrategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app: ztunnel
-  template:
-    metadata:
-      labels:
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app: ztunnel
-        app.kubernetes.io/name: ztunnel
-        {{- include "istio.labels" . | nindent 8}}
-{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-{{- if .Values.revision }}
-        istio.io/rev: {{ .Values.revision }}
-{{- end }}
-{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-{{- if .Values.nodeSelector }}
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- if .Values.affinity }}
-      affinity:
-{{ toYaml .Values.affinity | trim | indent 8 }}
-{{- end }}
-      serviceAccountName: ztunnel
-      tolerations:
-        - effect: NoSchedule
-          operator: Exists
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      containers:
-      - name: istio-proxy
-{{- if contains "/" .Values.image }}
-        image: "{{ .Values.image }}"
-{{- else }}
-        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
-{{- end }}
-        ports:
-        - containerPort: 15020
-          name: ztunnel-stats
-          protocol: TCP
-        resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 10 }}
-{{- end }}
-{{- with .Values.imagePullPolicy }}
-        imagePullPolicy: {{ . }}
-{{- end }}
-        securityContext:
-          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
-          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
-          allowPrivilegeEscalation: true
-          privileged: false
-          capabilities:
-            drop:
-            - ALL
-            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
-            - NET_ADMIN # Required for TPROXY and setsockopt
-            - SYS_ADMIN # Required for `setns` - doing things in other netns
-            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
-          readOnlyRootFilesystem: true
-          runAsGroup: 1337
-          runAsNonRoot: false
-          runAsUser: 0
-{{- if .Values.seLinuxOptions }}
-          seLinuxOptions:
-{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
-{{- end }}
-        readinessProbe:
-          httpGet:
-            port: 15021
-            path: /healthz/ready
-        args:
-        - proxy
-        - ztunnel
-        env:
-        - name: CA_ADDRESS
-        {{- if .Values.caAddress }}
-          value: {{ .Values.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: XDS_ADDRESS
-        {{- if .Values.xdsAddress }}
-          value: {{ .Values.xdsAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        {{- if .Values.logAsJson }}
-        - name: LOG_FORMAT
-          value: json
-        {{- end}}
-        - name: RUST_LOG
-          value: {{ .Values.logLevel | quote }}
-        - name: RUST_BACKTRACE
-          value: "1"
-        - name: ISTIO_META_CLUSTER_ID
-          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
-        - name: INPOD_ENABLED
-          value: "true"
-        - name: TERMINATION_GRACE_PERIOD_SECONDS
-          value: "{{ .Values.terminationGracePeriodSeconds }}"
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
-        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        {{- with .Values.env }}
-        {{- range $key, $val := . }}
-        - name: {{ $key }}
-          value: "{{ $val }}"
-        {{- end }}
-        {{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /var/run/ztunnel
-          name: cni-ztunnel-sock-dir
-        - mountPath: /tmp
-          name: tmp
-        {{- with .Values.volumeMounts }}
-          {{- toYaml . | nindent 8 }}
-        {{- end }}
-      priorityClassName: system-node-critical
-      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
-      volumes:
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: istio-ca
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      - name: cni-ztunnel-sock-dir
-        hostPath:
-          path: /var/run/ztunnel
-          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
-      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
-      - name: tmp
-        emptyDir: {}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
diff --git a/resources/v1.24.0/charts/ztunnel/templates/rbac.yaml b/resources/v1.24.0/charts/ztunnel/templates/rbac.yaml
deleted file mode 100644
index 44275dacd..000000000
--- a/resources/v1.24.0/charts/ztunnel/templates/rbac.yaml
+++ /dev/null
@@ -1,72 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-  {{- with .Values.imagePullSecrets }}
-imagePullSecrets:
-  {{- range . }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
----
-{{- if (eq .Values.platform "openshift") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: ztunnel
-  labels:
-    app: ztunnel
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-rules:
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: ztunnel
-  labels:
-    app: ztunnel
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ztunnel
-subjects:
-- kind: ServiceAccount
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-{{- end }}
----
diff --git a/resources/v1.24.0/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.24.0/charts/ztunnel/templates/zzz_profile.yaml
deleted file mode 100644
index 72d3adc53..000000000
--- a/resources/v1.24.0/charts/ztunnel/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.0/charts/ztunnel/values.yaml b/resources/v1.24.0/charts/ztunnel/values.yaml
deleted file mode 100644
index 2d0464b1c..000000000
--- a/resources/v1.24.0/charts/ztunnel/values.yaml
+++ /dev/null
@@ -1,98 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
-  hub: gcr.io/istio-release
-  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
-  tag: 1.24.0
-  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
-  variant: ""
-
-  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
-  # If Image contains a "/", it will replace the entire `image` in the pod.
-  image: ztunnel
-
-  # Labels to apply to all top level resources
-  labels: {}
-  # Annotations to apply to all top level resources
-  annotations: {}
-
-  # Additional volumeMounts to the ztunnel container
-  volumeMounts: []
-
-  # Additional volumes to the ztunnel pod
-  volumes: []
-
-  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-
-  # Additional labels to apply on the pod level
-  podLabels: {}
-
-  # Pod resource configuration
-  resources:
-    requests:
-      cpu: 200m
-      # Ztunnel memory scales with the size of the cluster and traffic load
-      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
-      memory: 512Mi
-
-  # List of secret names to add to the service account as image pull secrets
-  imagePullSecrets: []
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
-
-  # Override for the pod imagePullPolicy
-  imagePullPolicy: ""
-
-  # Settings for multicluster
-  multiCluster:
-    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
-    # with Istiod configuration.
-    clusterName: ""
-
-  # meshConfig defines runtime configuration of components.
-  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
-  # components.
-  # TODO: https://github.com/istio/istio/issues/43248
-  meshConfig:
-    defaultConfig:
-      proxyMetadata: {}
-
-  # This value defines:
-  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
-  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
-  # Default K8S value is 30 seconds
-  terminationGracePeriodSeconds: 30
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
-  revision: ""
-
-  # The customized CA address to retrieve certificates for the pods in the cluster.
-  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-  caAddress: ""
-
-  # The customized XDS address to retrieve configuration.
-  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
-  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
-  xdsAddress: ""
-
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
-  istioNamespace: istio-system
-
-  # Configuration log level of ztunnel binary, default is info.
-  # Valid values are: trace, debug, info, warn, error
-  logLevel: info
-
-  # To output all logs in json format
-  logAsJson: false
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seLinuxOptions: {}
-  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
-  #seLinuxOptions:
-  #  type: spc_t
diff --git a/resources/v1.24.0/cni-1.24.0.tgz.etag b/resources/v1.24.0/cni-1.24.0.tgz.etag
deleted file mode 100644
index 061e82346..000000000
--- a/resources/v1.24.0/cni-1.24.0.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-34c406af2450d845720fd857f38a70c9
diff --git a/resources/v1.24.0/commit b/resources/v1.24.0/commit
deleted file mode 100644
index 53cc1a6f9..000000000
--- a/resources/v1.24.0/commit
+++ /dev/null
@@ -1 +0,0 @@
-1.24.0
diff --git a/resources/v1.24.0/gateway-1.24.0.tgz.etag b/resources/v1.24.0/gateway-1.24.0.tgz.etag
deleted file mode 100644
index f78803f6f..000000000
--- a/resources/v1.24.0/gateway-1.24.0.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-8cc74e979b9878ac908795b5de00389b
diff --git a/resources/v1.24.0/istiod-1.24.0.tgz.etag b/resources/v1.24.0/istiod-1.24.0.tgz.etag
deleted file mode 100644
index 8e2aceda6..000000000
--- a/resources/v1.24.0/istiod-1.24.0.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-8c6bcd5d496676fd36490fe0f8890f40
diff --git a/resources/v1.24.0/profiles/default.yaml b/resources/v1.24.0/profiles/default.yaml
deleted file mode 100644
index e9e0a3931..000000000
--- a/resources/v1.24.0/profiles/default.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  # Most default values come from the helm chart's values.yaml
-  # Below are the things that differ
-  values:
-    defaultRevision: ""
-    global:
-      istioNamespace: istio-system
-      configValidation: true
diff --git a/resources/v1.24.0/ztunnel-1.24.0.tgz.etag b/resources/v1.24.0/ztunnel-1.24.0.tgz.etag
deleted file mode 100644
index 00565d4c7..000000000
--- a/resources/v1.24.0/ztunnel-1.24.0.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-65b760291d00246a553e4dfd4bf8a610
diff --git a/resources/v1.24.1/base-1.24.1.tgz.etag b/resources/v1.24.1/base-1.24.1.tgz.etag
deleted file mode 100644
index 4c416e99b..000000000
--- a/resources/v1.24.1/base-1.24.1.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-a95f98cb2187a3f88fc1d143f2ad778c
diff --git a/resources/v1.24.1/charts/base/Chart.yaml b/resources/v1.24.1/charts/base/Chart.yaml
deleted file mode 100644
index 07cb70a79..000000000
--- a/resources/v1.24.1/charts/base/Chart.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.1
-description: Helm chart for deploying Istio cluster resources and CRDs
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-name: base
-sources:
-- https://github.com/istio/istio
-version: 1.24.1
diff --git a/resources/v1.24.1/charts/base/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.1/charts/base/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.1/charts/base/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.1/charts/base/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.1/charts/base/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.1/charts/base/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.1/charts/base/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.1/charts/base/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.1/charts/base/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.1/charts/base/files/profile-demo.yaml b/resources/v1.24.1/charts/base/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.1/charts/base/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.1/charts/base/files/profile-platform-k3s.yaml b/resources/v1.24.1/charts/base/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.1/charts/base/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.1/charts/base/templates/zzz_profile.yaml b/resources/v1.24.1/charts/base/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.1/charts/base/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.1/charts/base/values.yaml b/resources/v1.24.1/charts/base/values.yaml
deleted file mode 100644
index 98c9c3645..000000000
--- a/resources/v1.24.1/charts/base/values.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  global:
-
-    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-
-    # Used to locate istiod.
-    istioNamespace: istio-system
-
-    # Platform where Istio is deployed. Possible values are: "openshift", "gcp".
-    # An empty value means it is a vanilla Kubernetes distribution, therefore no special
-    # treatment will be considered.
-    platform: ""
-  base:
-    # A list of CRDs to exclude. Requires `enableCRDTemplates` to be true.
-    # Example: `excludedCRDs: ["envoyfilters.networking.istio.io"]`.
-    # Note: when installing with `istioctl`, `enableIstioConfigCRDs=false` must also be set.
-    excludedCRDs: []
-    # Helm (as of V3) does not support upgrading CRDs, because it is not universally
-    # safe for them to support this.
-    # Istio as a project enforces certain backwards-compat guarantees that allow us
-    # to safely upgrade CRDs in spite of this, so we default to self-managing CRDs
-    # as standard K8S resources in Helm, and disable Helm's CRD management. See also:
-    # https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#method-2-separate-charts
-    enableCRDTemplates: true
-
-    # Validation webhook configuration url
-    # For example: https://$remotePilotAddress:15017/validate
-    validationURL: ""
-    # Validation webhook caBundle value. Useful when running pilot with a well known cert
-    validationCABundle: ""
-
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  defaultRevision: "default"
-  experimental:
-    stableValidationPolicy: false
diff --git a/resources/v1.24.1/charts/cni/Chart.yaml b/resources/v1.24.1/charts/cni/Chart.yaml
deleted file mode 100644
index bbe35e910..000000000
--- a/resources/v1.24.1/charts/cni/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.1
-description: Helm chart for istio-cni components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-cni
-- istio
-name: cni
-sources:
-- https://github.com/istio/istio
-version: 1.24.1
diff --git a/resources/v1.24.1/charts/cni/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.1/charts/cni/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.1/charts/cni/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.1/charts/cni/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.1/charts/cni/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.1/charts/cni/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.1/charts/cni/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.1/charts/cni/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.1/charts/cni/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.1/charts/cni/files/profile-demo.yaml b/resources/v1.24.1/charts/cni/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.1/charts/cni/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.1/charts/cni/files/profile-platform-k3s.yaml b/resources/v1.24.1/charts/cni/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.1/charts/cni/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.1/charts/cni/templates/clusterrole.yaml b/resources/v1.24.1/charts/cni/templates/clusterrole.yaml
deleted file mode 100644
index ac36f9c0e..000000000
--- a/resources/v1.24.1/charts/cni/templates/clusterrole.yaml
+++ /dev/null
@@ -1,77 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: ["security.openshift.io"] 
-  resources: ["securitycontextconstraints"] 
-  resourceNames: ["privileged"] 
-  verbs: ["use"]
-- apiGroups: [""]
-  resources: ["pods","nodes","namespaces"]
-  verbs: ["get", "list", "watch"]
-{{- if (eq (coalesce .Values.platform .Values.global.platform) "openshift") }}
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
-{{- end }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-repair-role
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "patch"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["watch", "get", "list"]
-{{- if .Values.repair.repairPods }}
-{{- /*  No privileges needed*/}}
-{{- else if .Values.repair.deletePods }}
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["delete"]
-{{- else if .Values.repair.labelPods }}
-  - apiGroups: [""]
-    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-    resources: ["pods/status"]
-    verbs: ["patch", "update"]
-{{- end }}
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: [""]
-  {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-  resources: ["pods/status"]
-  verbs: ["patch", "update"]
-{{- end }}
diff --git a/resources/v1.24.1/charts/cni/templates/configmap-cni.yaml b/resources/v1.24.1/charts/cni/templates/configmap-cni.yaml
deleted file mode 100644
index 52d612441..000000000
--- a/resources/v1.24.1/charts/cni/templates/configmap-cni.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: {{ template "name" . }}-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  CURRENT_AGENT_VERSION: {{ .Values.tag | default .Values.global.tag | quote }}
-  AMBIENT_ENABLED: {{ .Values.ambient.enabled | quote }}
-  AMBIENT_DNS_CAPTURE: {{ .Values.ambient.dnsCapture | default "false" | quote  }}
-  AMBIENT_IPV6: {{ .Values.ambient.ipv6 | default "false" | quote }}
-  {{- if .Values.cniConfFileName }} # K8S < 1.24 doesn't like empty values
-  CNI_CONF_NAME: {{ .Values.cniConfFileName }} # Name of the CNI config file to create. Only override if you know the exact path your CNI requires..
-  {{- end }}
-  CHAINED_CNI_PLUGIN: {{ .Values.chained | quote }}
-  EXCLUDED_NAMESPACES: "{{ range $idx, $ns := .Values.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
-  REPAIR_ENABLED: {{ .Values.chained | quote }}
-  REPAIR_LABEL_PODS: {{ .Values.repair.labelPods | quote }}
-  REPAIR_DELETE_PODS: {{ .Values.repair.deletePods | quote }}
-  REPAIR_REPAIR_PODS: {{ .Values.repair.repairPods | quote }}
-  REPAIR_INIT_CONTAINER_NAME: {{ .Values.repair.initContainerName | quote }}
-  REPAIR_BROKEN_POD_LABEL_KEY: {{ .Values.repair.brokenPodLabelKey | quote }}
-  REPAIR_BROKEN_POD_LABEL_VALUE: {{ .Values.repair.brokenPodLabelValue | quote }}
-  {{- with .Values.env }}
-  {{- range $key, $val := . }}
-  {{ $key }}: "{{ $val }}"
-  {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.1/charts/cni/templates/daemonset.yaml b/resources/v1.24.1/charts/cni/templates/daemonset.yaml
deleted file mode 100644
index b36f5ea02..000000000
--- a/resources/v1.24.1/charts/cni/templates/daemonset.yaml
+++ /dev/null
@@ -1,227 +0,0 @@
-# This manifest installs the Istio install-cni container, as well
-# as the Istio CNI plugin and config on
-# each master and worker node in a Kubernetes cluster.
-{{- $defaultBinDir :=
-    (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
-      "/home/kubernetes/bin"
-      "/opt/cni/bin"
-}}
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  name: {{ template "name" . }}-node
-  namespace: {{ .Release.Namespace }}
-  labels:
-    k8s-app: {{ template "name" . }}-node
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  selector:
-    matchLabels:
-      k8s-app: {{ template "name" . }}-node
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  template:
-    metadata:
-      labels:
-        k8s-app: {{ template "name" . }}-node
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: {{ template "name" . }}
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-        # Add Prometheus Scrape annotations
-        prometheus.io/scrape: 'true'
-        prometheus.io/port: "15014"
-        prometheus.io/path: '/metrics'
-        # Add AppArmor annotation
-        # This is required to avoid conflicts with AppArmor profiles which block certain
-        # privileged pod capabilities.
-        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
-        # securityContext which is otherwise preferred.
-        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
-        # Custom annotations
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{if .Values.ambient.enabled }}
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-{{ end }}
-      nodeSelector:
-        kubernetes.io/os: linux
-      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      tolerations:
-        # Make sure istio-cni-node gets scheduled on all nodes.
-        - effect: NoSchedule
-          operator: Exists
-        # Mark the pod as a critical add-on for rescheduling.
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      priorityClassName: system-node-critical
-      serviceAccountName: {{ template "name" . }}
-      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
-      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
-      terminationGracePeriodSeconds: 5
-      containers:
-        # This container installs the Istio CNI binaries
-        # and CNI network config file on each node.
-        - name: install-cni
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
-{{- end }}
-{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
-{{- end }}
-          ports:
-          - containerPort: 15014
-            name: metrics
-            protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8000
-          securityContext:
-            privileged: false
-            runAsGroup: 0
-            runAsUser: 0
-            runAsNonRoot: false
-            # Both ambient and sidecar repair mode require elevated node privileges to function.
-            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
-            # add capabilities based on feature.
-            capabilities:
-              drop:
-              - ALL
-              add:
-              # CAP_NET_ADMIN is required to allow ipset and route table access
-              - NET_ADMIN
-              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
-              - NET_RAW
-              # CAP_SYS_PTRACE is required for repair mode to describe the pod's network namespace
-              # in ambient and repair mode.
-              - SYS_PTRACE
-              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
-              # network namespaces in `/proc` to obtain descriptors for entering pod network
-              # namespaces. There does not appear to be a more granular capability for this.
-              - SYS_ADMIN
-{{- if .Values.seLinuxOptions }}
-{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
-            seLinuxOptions:
-{{ toYaml . | trim | indent 14 }}
-{{- end }}
-{{- end }}
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          command: ["install-cni"]
-          args:
-            {{- if or .Values.logging.level .Values.global.logging.level }}
-            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
-            {{- end}}
-            {{- if .Values.global.logAsJson }}
-            - --log_as_json
-            {{- end}}
-          envFrom:
-            - configMapRef:
-                name: {{ template "name" . }}-config
-          env:
-            - name: REPAIR_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: REPAIR_RUN_AS_DAEMON
-              value: "true"
-            - name: REPAIR_SIDECAR_ANNOTATION
-              value: "sidecar.istio.io/status"
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  apiVersion: v1
-                  fieldPath: spec.nodeName
-            - name: GOMEMLIMIT
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.memory
-            - name: GOMAXPROCS
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.cpu
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          volumeMounts:
-            - mountPath: /host/opt/cni/bin
-              name: cni-bin-dir
-            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-            - mountPath: /host/proc
-              name: cni-host-procfs
-              readOnly: true
-            {{- end }}
-            - mountPath: /host/etc/cni/net.d
-              name: cni-net-dir
-            - mountPath: /var/run/istio-cni
-              name: cni-socket-dir
-            {{- if .Values.ambient.enabled }}
-            - mountPath: /host/var/run/netns
-              mountPropagation: HostToContainer
-              name: cni-netns-dir
-            - mountPath: /var/run/ztunnel
-              name: cni-ztunnel-sock-dir
-            {{ end }}
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-      volumes:
-        # Used to install CNI.
-        - name: cni-bin-dir
-          hostPath:
-            path: {{ .Values.cniBinDir | default $defaultBinDir }}
-        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-        - name: cni-host-procfs
-          hostPath:
-            path: /proc
-            type: Directory
-        {{- end }}
-        {{- if .Values.ambient.enabled }}
-        - name: cni-ztunnel-sock-dir
-          hostPath:
-            path: /var/run/ztunnel
-            type: DirectoryOrCreate
-        {{- end }}
-        - name: cni-net-dir
-          hostPath:
-            path: {{ default "/etc/cni/net.d" .Values.cniConfDir }}
-        # Used for UDS sockets for logging, ambient eventing
-        - name: cni-socket-dir
-          hostPath:
-            path: /var/run/istio-cni
-        - name: cni-netns-dir
-          hostPath:
-            path: {{ .Values.cniNetnsDir | default "/var/run/netns" }}
-            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
-            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
-            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.24.1/charts/cni/templates/zzz_profile.yaml b/resources/v1.24.1/charts/cni/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.1/charts/cni/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.1/charts/cni/values.yaml b/resources/v1.24.1/charts/cni/values.yaml
deleted file mode 100644
index f4bac1ef0..000000000
--- a/resources/v1.24.1/charts/cni/values.yaml
+++ /dev/null
@@ -1,149 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  hub: ""
-  tag: ""
-  variant: ""
-  image: install-cni
-  pullPolicy: ""
-
-  # Same as `global.logging.level`, but will override it if set
-  logging:
-    level: ""
-
-  # Configuration file to insert istio-cni plugin configuration
-  # by default this will be the first file found in the cni-conf-dir
-  # Example
-  # cniConfFileName: 10-calico.conflist
-
-  # CNI bin and conf dir override settings
-  # defaults:
-  cniBinDir: "" # Auto-detected based on version; defaults to /opt/cni/bin.
-  cniConfDir: /etc/cni/net.d
-  cniConfFileName: ""
-  # This directory must exist on the node, if it does not, consult your container runtime
-  # documentation for the appropriate path.
-  cniNetnsDir: # Defaults to '/var/run/netns', in minikube/docker/others can be '/var/run/docker/netns'.
-
-
-  excludeNamespaces:
-    - kube-system
-
-  # Allows user to set custom affinity for the DaemonSet
-  affinity: {}
-
-  # Custom annotations on pod level, if you need them
-  podAnnotations: {}
-
-  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
-  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
-  chained: true
-
-  # Custom configuration happens based on the CNI provider.
-  # Possible values: "default", "multus"
-  provider: "default"
-
-  # Configure ambient settings
-  ambient:
-    # If enabled, ambient redirection will be enabled
-    enabled: false
-    # Set ambient config dir path: defaults to /etc/ambient-config
-    configDir: ""
-    # If enabled, and ambient is enabled, DNS redirection will be enabled
-    dnsCapture: false
-    # If enabled, and ambient is enabled, enables ipv6 support
-    ipv6: true
-
-
-  repair:
-    enabled: true
-    hub: ""
-    tag: ""
-
-    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
-    # This defines the action the controller will take when a pod is detected as broken.
-
-    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
-    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
-    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
-    labelPods: false
-    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
-    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
-    deletePods: false
-    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
-    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
-    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
-    repairPods: true
-
-    initContainerName: "istio-validation"
-
-    brokenPodLabelKey: "cni.istio.io/uninitialized"
-    brokenPodLabelValue: "true"
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
-  seLinuxOptions: {}
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 100Mi
-
-  resourceQuotas:
-    enabled: false
-    pods: 5000
-
-  # The number of pods that can be unavailable during rolling update (see
-  # `updateStrategy.rollingUpdate.maxUnavailable` here:
-  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
-  # May be specified as a number of pods or as a percent of the total number
-  # of pods at the start of the update.
-  rollingMaxUnavailable: 1
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  global:
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-
-    # Default tag for Istio images.
-    tag: 1.24.1
-
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # change cni scope level to control logging out of istio-cni-node DaemonSet
-    logging:
-      level: info
-
-    logAsJson: false
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Default resources allocated
-    defaultResources:
-      requests:
-        cpu: 100m
-        memory: 100Mi
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
diff --git a/resources/v1.24.1/charts/gateway/Chart.yaml b/resources/v1.24.1/charts/gateway/Chart.yaml
deleted file mode 100644
index 147d38e7f..000000000
--- a/resources/v1.24.1/charts/gateway/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.1
-description: Helm chart for deploying Istio gateways
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- gateways
-name: gateway
-sources:
-- https://github.com/istio/istio
-type: application
-version: 1.24.1
diff --git a/resources/v1.24.1/charts/gateway/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.1/charts/gateway/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.1/charts/gateway/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.1/charts/gateway/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.1/charts/gateway/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.1/charts/gateway/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.1/charts/gateway/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.1/charts/gateway/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.1/charts/gateway/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.1/charts/gateway/files/profile-demo.yaml b/resources/v1.24.1/charts/gateway/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.1/charts/gateway/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.1/charts/gateway/files/profile-platform-k3s.yaml b/resources/v1.24.1/charts/gateway/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.1/charts/gateway/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.1/charts/gateway/templates/deployment.yaml b/resources/v1.24.1/charts/gateway/templates/deployment.yaml
deleted file mode 100644
index e9bfbbd36..000000000
--- a/resources/v1.24.1/charts/gateway/templates/deployment.yaml
+++ /dev/null
@@ -1,128 +0,0 @@
-apiVersion: apps/v1
-kind: {{ .Values.kind | default "Deployment" }}
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  {{- with .Values.replicaCount }}
-  replicas: {{ . }}
-  {{- end }}
-  {{- end }}
-  {{- with .Values.strategy }}
-  strategy:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.minReadySeconds }}
-  minReadySeconds: {{ . }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "gateway.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
-        {{- include "gateway.selectorLabels" . | nindent 8 }}
-        app.kubernetes.io/name: {{ include "gateway.name" . }}
-        {{- include "istio.labels" .  | nindent 8}}
-        {{- range $key, $val := .Values.labels }}
-        {{- if and (ne $key "app") (ne $key "istio") }}
-        {{ $key | quote }}: {{ $val | quote }}
-        {{- end }}
-        {{- end }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
-      securityContext:
-      {{- if .Values.securityContext }}
-        {{- toYaml .Values.securityContext | nindent 8 }}
-      {{- else }}
-        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- end }}
-      {{- with .Values.volumes }}
-      volumes:
-        {{ toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: istio-proxy
-          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
-          image: auto
-          {{- with .Values.imagePullPolicy }}
-          imagePullPolicy: {{ . }}
-          {{- end }}
-          securityContext:
-          {{- if .Values.containerSecurityContext }}
-            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          {{- else }}
-            capabilities:
-              drop:
-              - ALL
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            {{- if not (eq .Values.platform "openshift") }}
-            runAsUser: 1337
-            runAsGroup: 1337
-            {{- end }}
-            runAsNonRoot: true
-          {{- end }}
-          env:
-          {{- with .Values.networkGateway }}
-          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-            value: "{{.}}"
-          {{- end }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: {{ $val | quote }}
-          {{- end }}
-          ports:
-          - containerPort: 15090
-            protocol: TCP
-            name: http-envoy-prom
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          {{- with .Values.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.readinessProbe }}
-          readinessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
-      {{- with .Values.priorityClassName }}
-      priorityClassName: {{ . }}
-      {{- end }}
diff --git a/resources/v1.24.1/charts/gateway/templates/service.yaml b/resources/v1.24.1/charts/gateway/templates/service.yaml
deleted file mode 100644
index 25ce3bcb0..000000000
--- a/resources/v1.24.1/charts/gateway/templates/service.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-{{- if not (eq .Values.service.type "None") }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-    {{- with .Values.networkGateway }}
-    topology.istio.io/network: "{{.}}"
-    {{- end }}
-  annotations:
-    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
-spec:
-{{- with .Values.service.loadBalancerIP }}
-  loadBalancerIP: "{{ . }}"
-{{- end }}
-{{- if eq .Values.service.type "LoadBalancer" }}
-  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
-  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
-  {{- end }}
-{{- end }}
-{{- if .Values.service.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.service.ipFamilies }}
-  ipFamilies:
-{{- range .Values.service.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
-{{- with .Values.service.loadBalancerSourceRanges }}
-  loadBalancerSourceRanges:
-{{ toYaml . | indent 4 }}
-{{- end }}
-{{- with .Values.service.externalTrafficPolicy }}
-  externalTrafficPolicy: "{{ . }}"
-{{- end }}
-  type: {{ .Values.service.type }}
-  ports:
-{{- if .Values.networkGateway }}
-  - name: status-port
-    port: 15021
-    targetPort: 15021
-  - name: tls
-    port: 15443
-    targetPort: 15443
-  - name: tls-istiod
-    port: 15012
-    targetPort: 15012
-  - name: tls-webhook
-    port: 15017
-    targetPort: 15017
-{{- else }}
-{{ .Values.service.ports | toYaml | indent 4 }}
-{{- end }}
-{{- if .Values.service.externalIPs }}
-  externalIPs: {{- range .Values.service.externalIPs }}
-    - {{.}}
-  {{- end }}
-{{- end }}
-  selector:
-    {{- include "gateway.selectorLabels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.24.1/charts/gateway/templates/zzz_profile.yaml b/resources/v1.24.1/charts/gateway/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.1/charts/gateway/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.1/charts/gateway/values.schema.json b/resources/v1.24.1/charts/gateway/values.schema.json
deleted file mode 100644
index 3fdaa2730..000000000
--- a/resources/v1.24.1/charts/gateway/values.schema.json
+++ /dev/null
@@ -1,330 +0,0 @@
-{
-  "$schema": "http://json-schema.org/schema#",
-  "$defs": {
-    "values": {
-      "type": "object",
-      "properties": {
-        "global": {
-          "type": "object"
-        },
-        "affinity": {
-          "type": "object"
-        },
-        "securityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "containerSecurityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "kind": {
-          "type": "string",
-          "enum": [
-            "Deployment",
-            "DaemonSet"
-          ]
-        },
-        "annotations": {
-          "additionalProperties": {
-            "type": [
-              "string",
-              "integer"
-            ]
-          },
-          "type": "object"
-        },
-        "autoscaling": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            },
-            "maxReplicas": {
-              "type": "integer"
-            },
-            "minReplicas": {
-              "type": "integer"
-            },
-            "targetCPUUtilizationPercentage": {
-              "type": "integer"
-            }
-          }
-        },
-        "env": {
-          "type": "object"
-        },
-        "strategy": {
-          "type": "object"
-        },
-        "minReadySeconds": {
-          "type": [
-            "null",
-            "integer"
-          ]
-        },
-        "readinessProbe": {
-          "type": [
-            "null",
-            "object"
-          ]
-        },
-        "labels": {
-          "type": "object"
-        },
-        "name": {
-          "type": "string"
-        },
-        "nodeSelector": {
-          "type": "object"
-        },
-        "podAnnotations": {
-          "type": "object",
-          "properties": {
-            "inject.istio.io/templates": {
-              "type": "string"
-            },
-            "prometheus.io/path": {
-              "type": "string"
-            },
-            "prometheus.io/port": {
-              "type": "string"
-            },
-            "prometheus.io/scrape": {
-              "type": "string"
-            }
-          }
-        },
-        "replicaCount": {
-          "type": [
-            "integer",
-            "null"
-          ]
-        },
-        "resources": {
-          "type": "object",
-          "properties": {
-            "limits": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            },
-            "requests": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            }
-          }
-        },
-        "revision": {
-          "type": "string"
-        },
-        "compatibilityVersion": {
-          "type": "string"
-        },
-        "runAsRoot": {
-          "type": "boolean"
-        },
-        "unprivilegedPort": {
-          "type": [
-            "string",
-            "boolean"
-          ],
-          "enum": [
-            true,
-            false,
-            "auto"
-          ]
-        },
-        "service": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "externalTrafficPolicy": {
-              "type": "string"
-            },
-            "loadBalancerIP": {
-              "type": "string"
-            },
-            "loadBalancerSourceRanges": {
-              "type": "array"
-            },
-            "ipFamilies": {
-              "items": {
-                "type": "string",
-                "enum": [
-                  "IPv4",
-                  "IPv6"
-                ]
-              }
-            },
-            "ipFamilyPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "SingleStack",
-                "PreferDualStack",
-                "RequireDualStack"
-              ]
-            },
-            "ports": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string"
-                  },
-                  "port": {
-                    "type": "integer"
-                  },
-                  "protocol": {
-                    "type": "string"
-                  },
-                  "targetPort": {
-                    "type": "integer"
-                  }
-                }
-              }
-            },
-            "type": {
-              "type": "string"
-            }
-          }
-        },
-        "serviceAccount": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "name": {
-              "type": "string"
-            },
-            "create": {
-              "type": "boolean"
-            }
-          }
-        },
-        "rbac": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            }
-          }
-        },
-        "tolerations": {
-          "type": "array"
-        },
-        "topologySpreadConstraints": {
-          "type": "array"
-        },
-        "networkGateway": {
-          "type": "string"
-        },
-        "imagePullPolicy": {
-          "type": "string",
-          "enum": [
-            "",
-            "Always",
-            "IfNotPresent",
-            "Never"
-          ]
-        },
-        "imagePullSecrets": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "name": {
-                "type": "string"
-              }
-            }
-          }
-        },
-        "podDisruptionBudget": {
-          "type": "object",
-          "properties": {
-            "minAvailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "maxUnavailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "unhealthyPodEvictionPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "IfHealthyBudget",
-                "AlwaysAllow"
-              ]
-            }
-          }
-        },
-        "terminationGracePeriodSeconds": {
-          "type": "number"
-        },
-        "volumes": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "volumeMounts": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "priorityClassName": {
-          "type": "string"
-        },
-        "_internal_defaults_do_not_set": {
-          "type": "object"
-        }
-      },
-      "additionalProperties": false
-    }
-  },
-  "defaults": {
-    "$ref": "#/$defs/values"
-  },
-  "$ref": "#/$defs/values"
-}
diff --git a/resources/v1.24.1/charts/gateway/values.yaml b/resources/v1.24.1/charts/gateway/values.yaml
deleted file mode 100644
index b02240df1..000000000
--- a/resources/v1.24.1/charts/gateway/values.yaml
+++ /dev/null
@@ -1,166 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Name allows overriding the release name. Generally this should not be set
-  name: ""
-  # revision declares which revision this gateway is a part of
-  revision: ""
-
-  # Controls the spec.replicas setting for the Gateway deployment if set.
-  # Otherwise defaults to Kubernetes Deployment default (1).
-  replicaCount:
-
-  kind: Deployment
-
-  rbac:
-    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
-    # when using http://gateway-api.org/.
-    enabled: true
-
-  serviceAccount:
-    # If set, a service account will be created. Otherwise, the default is used
-    create: true
-    # Annotations to add to the service account
-    annotations: {}
-    # The name of the service account to use.
-    # If not set, the release name is used
-    name: ""
-
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/stats/prometheus"
-    inject.istio.io/templates: "gateway"
-    sidecar.istio.io/inject: "true"
-
-  # Define the security context for the pod.
-  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-  securityContext: {}
-  containerSecurityContext: {}
-
-  service:
-    # Type of service. Set to "None" to disable the service entirely
-    type: LoadBalancer
-    ports:
-    - name: status-port
-      port: 15021
-      protocol: TCP
-      targetPort: 15021
-    - name: http2
-      port: 80
-      protocol: TCP
-      targetPort: 80
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
-    annotations: {}
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    externalTrafficPolicy: ""
-    externalIPs: []
-    ipFamilyPolicy: ""
-    ipFamilies: []
-    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
-    # allocateLoadBalancerNodePorts: false
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: 2000m
-      memory: 1024Mi
-
-  autoscaling:
-    enabled: true
-    minReplicas: 1
-    maxReplicas: 5
-    targetCPUUtilizationPercentage: 80
-    targetMemoryUtilizationPercentage: {}
-    autoscaleBehavior: {}
-
-  # Pod environment variables
-  env: {}
-
-  # Deployment Update strategy
-  strategy: {}
-  
-  # Sets the Deployment minReadySeconds value
-  minReadySeconds:
-  
-  # Optionally configure a custom readinessProbe. By default the control plane
-  # automatically injects the readinessProbe. If you wish to override that
-  # behavior, you may define your own readinessProbe here.
-  readinessProbe: {}
-
-  # Labels to apply to all resources
-  labels: {}
-
-  # Annotations to apply to all resources
-  annotations: {}
-
-  nodeSelector: {}
-
-  tolerations: []
-
-  topologySpreadConstraints: []
-
-  affinity: {}
-
-  # If specified, the gateway will act as a network gateway for the given network.
-  networkGateway: ""
-
-  # Specify image pull policy if default behavior isn't desired.
-  # Default behavior: latest images will be Always else IfNotPresent
-  imagePullPolicy: ""
-
-  imagePullSecrets: []
-
-  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
-  #
-  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
-  # which means that no PodDisruptionBudget resource will be created.
-  #
-  # To enable the PodDisruptionBudget, configure it by specifying the
-  # `minAvailable` or `maxUnavailable`. For example, to set the
-  # minimum number of available replicas to 1, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #
-  # Or, to allow a maximum of 1 unavailable replica, you can set:
-  #
-  # podDisruptionBudget:
-  #   maxUnavailable: 1
-  #
-  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
-  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #   unhealthyPodEvictionPolicy: AlwaysAllow
-  #
-  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
-  #
-  # podDisruptionBudget: {}
-  #
-  podDisruptionBudget: {}
-
-  # Sets the per-pod terminationGracePeriodSeconds setting.
-  terminationGracePeriodSeconds: 30
-
-  # A list of `Volumes` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumes: []
-
-  # A list of `VolumeMounts` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumeMounts: []
-
-  # Configure this to a higher priority class in order to make sure your Istio gateway pods
-  # will not be killed because of low priority class.
-  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-  # for more detail.
-  priorityClassName: ""
diff --git a/resources/v1.24.1/charts/istiod/Chart.yaml b/resources/v1.24.1/charts/istiod/Chart.yaml
deleted file mode 100644
index b932015df..000000000
--- a/resources/v1.24.1/charts/istiod/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.1
-description: Helm chart for istio control plane
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- istiod
-- istio-discovery
-name: istiod
-sources:
-- https://github.com/istio/istio
-version: 1.24.1
diff --git a/resources/v1.24.1/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.24.1/charts/istiod/files/gateway-injection-template.yaml
deleted file mode 100644
index 97ffb71f2..000000000
--- a/resources/v1.24.1/charts/istiod/files/gateway-injection-template.yaml
+++ /dev/null
@@ -1,250 +0,0 @@
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if eq (len $containers) 1 }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{ end }}
-  }
-spec:
-  securityContext:
-  {{- if .Values.gateways.securityContext }}
-    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
-  {{- else }}
-    sysctls:
-    - name: net.ipv4.ip_unprivileged_port_start
-      value: "0"
-  {{- end }}
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - router
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- end }}
-    securityContext:
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-    env:
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-  volumes:
-  - emptyDir: {}
-    name: workload-socket
-  - emptyDir: {}
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else}}
-  - emptyDir: {}
-    name: workload-certs
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.1/charts/istiod/files/grpc-agent.yaml b/resources/v1.24.1/charts/istiod/files/grpc-agent.yaml
deleted file mode 100644
index 7290fcdca..000000000
--- a/resources/v1.24.1/charts/istiod/files/grpc-agent.yaml
+++ /dev/null
@@ -1,310 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-    sidecar.istio.io/rewriteAppHTTPProbers: "false",
-  }
-spec:
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15020
-      protocol: TCP
-      name: mesh-metrics
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-          - --url=http://localhost:15020/healthz/ready
-    env:
-    - name: ISTIO_META_GENERATOR
-      value: grpc
-    - name: OUTPUT_CERTS
-      value: /var/lib/istio/data
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    # grpc uses xds:/// to resolve – no need to resolve VIP
-    - name: ISTIO_META_DNS_CAPTURE
-      value: "false"
-    - name: DISABLE_ENVOY
-      value: "true"
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15020
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # UDS channel between istioagent and gRPC client for XDS/SDS
-    - mountPath: /etc/istio/proxy
-      name: istio-xds
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-{{- range $index, $container := .Spec.Containers  }}
-{{ if not (eq $container.Name "istio-proxy") }}
-  - name: {{ $container.Name }}
-    env:
-      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
-        value: "true"
-      - name: "GRPC_XDS_BOOTSTRAP"
-        value: "/etc/istio/proxy/grpc-bootstrap.json"
-    volumeMounts:
-      - mountPath: /var/lib/istio/data
-        name: istio-data
-      # UDS channel between istioagent and gRPC client for XDS/SDS
-      - mountPath: /etc/istio/proxy
-        name: istio-xds
-      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-        readOnly: true
-      {{- else }}
-      - name: workload-certs
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-      {{- end }}
-{{- end }}
-{{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-xds
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.1/charts/istiod/files/injection-template.yaml b/resources/v1.24.1/charts/istiod/files/injection-template.yaml
deleted file mode 100644
index 0ef948e6a..000000000
--- a/resources/v1.24.1/charts/istiod/files/injection-template.yaml
+++ /dev/null
@@ -1,510 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
-    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
-    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
-    {{- end }}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-{{- if .Values.pilot.cni.enabled }}
-    {{- if eq .Values.pilot.cni.provider "multus" }}
-    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
-    {{- end }}
-    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}traffic.sidecar.istio.io/includeInboundPorts: "{{.}}",{{ end }}
-    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
-    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
-    {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
-    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
-    {{- end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
-{{- end }}
-  }
-spec:
-  {{- $holdProxy := and
-      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
-      (not $nativeSidecar) }}
-  initContainers:
-  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
-  {{ if .Values.pilot.cni.enabled -}}
-  - name: istio-validation
-  {{ else -}}
-  - name: istio-init
-  {{ end -}}
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    args:
-    - istio-iptables
-    - "-p"
-    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
-    - "-z"
-    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
-    - "-u"
-    - {{ .ProxyUID | default "1337" | quote }}
-    - "-m"
-    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
-    - "-i"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
-    - "-x"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
-    - "-b"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
-    - "-d"
-  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
-    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
-  {{- else }}
-    - "15090,15021"
-  {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
-    - "-q"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
-    {{ end -}}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
-    - "-o"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
-    {{ end -}}
-     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
-    - "-c"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
-    {{ end -}}
-    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
-    {{ if .Values.global.logAsJson -}}
-    - "--log_as_json"
-    {{ end -}}
-    {{ if .Values.pilot.cni.enabled -}}
-    - "--run-validation"
-    - "--skip-rule-apply"
-    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
-    - "--force-apply"
-    {{ end -}}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-  {{- if .ProxyConfig.ProxyMetadata }}
-    env:
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-  {{- end }}
-    resources:
-  {{ template "resources" . }}
-    securityContext:
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      privileged: {{ .Values.global.proxy.privileged }}
-      capabilities:
-    {{- if not .Values.pilot.cni.enabled }}
-        add:
-        - NET_ADMIN
-        - NET_RAW
-    {{- end }}
-        drop:
-        - ALL
-    {{- if not .Values.pilot.cni.enabled }}
-      readOnlyRootFilesystem: false
-      runAsGroup: 0
-      runAsNonRoot: false
-      runAsUser: 0
-    {{- else }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsNonRoot: true
-    {{- end }}
-  {{ end -}}
-  {{ if not $nativeSidecar }}
-  containers:
-  {{ end }}
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.outlierLogPath }}
-    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-  {{- end}}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- else if $holdProxy }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-  {{- else if $nativeSidecar }}
-    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
-    lifecycle:
-      preStop:
-        exec:
-          command:
-          - pilot-agent
-          - request
-          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
-          - POST
-          - drain
-  {{- end }}
-    env:
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - name: ISTIO_BOOTSTRAP_OVERRIDE
-      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
-    {{- end }}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-  {{ if .Values.global.proxy.startupProbe.enabled }}
-    startupProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: 0
-      periodSeconds: 1
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
-  {{ end }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    {{ end -}}
-    securityContext:
-      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
-      allowPrivilegeEscalation: true
-      capabilities:
-        add:
-        - NET_ADMIN
-        drop:
-        - ALL
-      privileged: true
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else }}
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      capabilities:
-        {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-        add:
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
-        - NET_ADMIN
-        {{- end }}
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
-        - NET_BIND_SERVICE
-        {{- end }}
-        {{- end }}
-        drop:
-        - ALL
-      privileged: {{ .Values.global.proxy.privileged }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else -}}
-      runAsNonRoot: true
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      {{- end }}
-      {{- end }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - mountPath: /etc/istio/custom-bootstrap
-      name: custom-bootstrap-volume
-    {{- end }}
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
-      name: lightstep-certs
-      readOnly: true
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  - emptyDir:
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-  - name: lightstep-certs
-    secret:
-      optional: true
-      secretName: lightstep.cacert
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.1/charts/istiod/files/kube-gateway.yaml b/resources/v1.24.1/charts/istiod/files/kube-gateway.yaml
deleted file mode 100644
index dbe158de1..000000000
--- a/resources/v1.24.1/charts/istiod/files/kube-gateway.yaml
+++ /dev/null
@@ -1,345 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-gateway-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": {{.Name}}
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-gateway-controller"
-          ) | nindent 8 }}
-    spec:
-      securityContext:
-      {{- if .Values.gateways.securityContext }}
-        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
-      {{- else }}
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- if .Values.gateways.seccompProfile }}
-        seccompProfile:
-      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
-      {{- end }}
-      {{- end }}
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-      {{- else }}
-        image: "{{ .ProxyImage }}"
-      {{- end }}
-        {{- if .Values.global.proxy.resources }}
-        resources:
-          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsUser: {{ .ProxyUID | default "1337" }}
-          runAsGroup: {{ .ProxyGID | default "1337" }}
-          runAsNonRoot: true
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        args:
-        - proxy
-        - router
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-      {{- if .Values.global.sts.servicePort }}
-        - --stsPort={{ .Values.global.sts.servicePort }}
-      {{- end }}
-      {{- if .Values.global.logAsJson }}
-        - --log_as_json
-      {{- end }}
-      {{- if .Values.global.proxy.lifecycle }}
-        lifecycle:
-          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
-      {{- end }}
-        env:
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        - name: ISTIO_META_POD_PORTS
-          value: "[]"
-        - name: ISTIO_META_APP_CONTAINERS
-          value: ""
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: "{{ .ProxyConfig.InterceptionMode.String }}"
-        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
-        - name: ISTIO_META_NETWORK
-          value: {{.|quote}}
-        {{- end }}
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName|quote}}
-        - name: ISTIO_META_OWNER
-          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
-        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-          value: {{.|quote}}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        volumeMounts:
-        - name: workload-socket
-          mountPath: /var/run/secrets/workload-spiffe-uds
-        - name: credential-socket
-          mountPath: /var/run/secrets/credential-uds
-        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-        - name: gke-workload-certificate
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-          readOnly: true
-        {{- else }}
-        - name: workload-certs
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-        {{- end }}
-        {{- if eq .Values.global.pilotCertProvider "istiod" }}
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        {{- end }}
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        # SDS channel between istioagent and Envoy
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - name: istio-podinfo
-          mountPath: /etc/istio/pod
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir: {}
-        name: credential-socket
-      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        csi:
-          driver: workloadcertificates.security.cloud.google.com
-      {{- else}}
-      - emptyDir: {}
-        name: workload-certs
-      {{- end }}
-      # SDS channel between istioagent and Envoy
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - name: istio-data
-        emptyDir: {}
-      - name: istio-podinfo
-        downwardAPI:
-          items:
-            - path: "labels"
-              fieldRef:
-                fieldPath: metadata.labels
-            - path: "annotations"
-              fieldRef:
-                fieldPath: metadata.annotations
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: {{ .Values.global.sds.token.aud }}
-      {{- if eq .Values.global.pilotCertProvider "istiod" }}
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: {{.UID}}
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": {{.Name}}
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.24.1/charts/istiod/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.1/charts/istiod/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.1/charts/istiod/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.1/charts/istiod/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.1/charts/istiod/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.1/charts/istiod/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.1/charts/istiod/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.1/charts/istiod/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.1/charts/istiod/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.1/charts/istiod/files/profile-demo.yaml b/resources/v1.24.1/charts/istiod/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.1/charts/istiod/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.1/charts/istiod/files/profile-platform-k3s.yaml b/resources/v1.24.1/charts/istiod/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.1/charts/istiod/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.1/charts/istiod/files/waypoint.yaml b/resources/v1.24.1/charts/istiod/files/waypoint.yaml
deleted file mode 100644
index bbe47674b..000000000
--- a/resources/v1.24.1/charts/istiod/files/waypoint.yaml
+++ /dev/null
@@ -1,333 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-mesh-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": "{{.Name}}"
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "istio.io/dataplane-mode" "none"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-mesh-controller"
-          ) | nindent 8}}
-    spec:
-      {{- if .Values.global.waypoint.affinity }}
-      affinity:
-      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.topologySpreadConstraints }}
-      topologySpreadConstraints:
-      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.nodeSelector }}
-      nodeSelector:
-      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.tolerations }}
-      tolerations:
-      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: 2
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-        {{- else }}
-        image: "{{ .ProxyImage }}"
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        args:
-        - proxy
-        - waypoint
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --serviceCluster
-        - {{.ServiceAccount}}.$(POD_NAMESPACE)
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-        {{- if .Values.global.logAsJson }}
-        - --log_as_json
-        {{- end }}
-        env:
-        - name: ISTIO_META_SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        {{- if .ProxyConfig.ProxyMetadata }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
-        {{- if $network }}
-        - name: ISTIO_META_NETWORK
-          value: "{{ $network }}"
-        {{- end }}
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: REDIRECT
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName}}
-        - name: ISTIO_META_OWNER
-          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- if .Values.global.waypoint.resources }}
-        resources:
-        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        securityContext:
-          privileged: false
-        {{- if not (eq .Values.global.platform "openshift") }}
-          runAsGroup: 1337
-          runAsUser: 1337
-        {{- end }}
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-            - ALL
-{{- if .Values.gateways.seccompProfile }}
-          seccompProfile:
-{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
-{{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/workload-spiffe-uds
-          name: workload-socket
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /etc/istio/pod
-          name: istio-podinfo
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - emptyDir:
-          medium: Memory
-        name: go-proxy-envoy
-      - emptyDir: {}
-        name: istio-data
-      - emptyDir: {}
-        name: go-proxy-data
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.labels
-            path: labels
-          - fieldRef:
-              fieldPath: metadata.annotations
-            path: annotations
-        name: istio-podinfo
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              audience: istio-ca
-              expirationSeconds: 43200
-              path: istio-token
-      - configMap:
-          name: istio-ca-root-cert
-        name: istiod-ca-cert
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap
-      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
-      (omit .InfrastructureAnnotations
-        "kubectl.kubernetes.io/last-applied-configuration"
-        "gateway.istio.io/name-override"
-        "gateway.istio.io/service-account"
-        "gateway.istio.io/controller-version"
-      ) | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": "{{.Name}}"
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.24.1/charts/istiod/templates/clusterrole.yaml b/resources/v1.24.1/charts/istiod/templates/clusterrole.yaml
deleted file mode 100644
index 0c340b5b3..000000000
--- a/resources/v1.24.1/charts/istiod/templates/clusterrole.yaml
+++ /dev/null
@@ -1,187 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  # sidecar injection controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-
-  # configuration validation webhook controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-
-  # istio configuration
-  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
-  # please proceed with caution
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["get", "watch", "list"]
-    resources: ["*"]
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["update", "patch"]
-    resources:
-    - authorizationpolicies/status
-    - destinationrules/status
-    - envoyfilters/status
-    - gateways/status
-    - peerauthentications/status
-    - proxyconfigs/status
-    - requestauthentications/status
-    - serviceentries/status
-    - sidecars/status
-    - telemetries/status
-    - virtualservices/status
-    - wasmplugins/status
-    - workloadentries/status
-    - workloadgroups/status
-{{- end }}
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries/status",  "serviceentries/status" ]
-  - apiGroups: ["security.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "authorizationpolicies/status" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services/status" ]
-
-  # auto-detect installed CRD definitions
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-
-  # discovery and routing
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-
-{{- if .Values.taint.enabled }}
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["patch"]
-{{- end }}
-
-  # ingress controller
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-{{- end}}
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses", "ingressclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-
-  # required for CA's namespace controller
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-
-  # Istiod and bootstrap.
-{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
-{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "certificatesigningrequests"
-      - "certificatesigningrequests/approval"
-      - "certificatesigningrequests/status"
-    verbs: ["update", "create", "get", "delete", "watch"]
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "signers"
-    resourceNames:
-{{- range .Values.global.certSigners }}
-    - {{ . | quote }}
-{{- end }}
-    verbs: ["approve"]
-{{- end}}
-
-  # Used by Istiod to verify the JWT tokens
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-
-  # Used by Istiod to verify gateway SDS
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-
-  # Use for Kubernetes Service APIs
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources:
-    - backendtlspolicies/status
-    - gatewayclasses/status
-    - gateways/status
-    - grpcroutes/status
-    - httproutes/status
-    - referencegrants/status
-    - tcproutes/status
-    - tlsroutes/status
-    - udproutes/status
-    verbs: ["update", "patch"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["gatewayclasses"]
-    verbs: ["create", "update", "patch", "delete"]
-
-  # Needed for multicluster secret reading, possibly ingress certs in the future
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "watch", "list"]
-
-  # Used for MCS serviceexport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: [ "get", "watch", "list", "create", "delete"]
-
-  # Used for MCS serviceimport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "watch", "list"]
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: ["apps"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "deployments" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "serviceaccounts"]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.1/charts/istiod/templates/configmap-values.yaml b/resources/v1.24.1/charts/istiod/templates/configmap-values.yaml
deleted file mode 100644
index a7e60369d..000000000
--- a/resources/v1.24.1/charts/istiod/templates/configmap-values.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  original-values: |-
-{{ .Values._original | toPrettyJson | indent 4 }}
-{{- $_ := unset $.Values "_original" }}
-  merged-values: |-
-{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.24.1/charts/istiod/templates/configmap.yaml b/resources/v1.24.1/charts/istiod/templates/configmap.yaml
deleted file mode 100644
index 57702ea53..000000000
--- a/resources/v1.24.1/charts/istiod/templates/configmap.yaml
+++ /dev/null
@@ -1,109 +0,0 @@
-{{- define "mesh" }}
-    # The trust domain corresponds to the trust root of a system.
-    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
-    trustDomain: "cluster.local"
-
-    # The namespace to treat as the administrative root namespace for Istio configuration.
-    # When processing a leaf namespace Istio will search for declarations in that namespace first
-    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
-    # is processed as if it were declared in the leaf namespace.
-    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
-
-  {{ $prom := include "default-prometheus" . | eq "true" }}
-  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
-  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
-  {{- if or $prom $sdMetrics $sdLogs }}
-    defaultProviders:
-    {{- if or $prom $sdMetrics }}
-      metrics:
-      {{ if $prom }}- prometheus{{ end }}
-      {{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
-    {{- end }}
-    {{- if and $sdMetrics $sdLogs }}
-      accessLogging:
-      - stackdriver
-    {{- end }}
-  {{- end }}
-
-    defaultConfig:
-      {{- if .Values.global.meshID }}
-      meshId: "{{ .Values.global.meshID }}"
-      {{- end }}
-      {{- with (.Values.global.proxy.variant | default .Values.global.variant) }}
-      image:
-        imageType: {{. | quote}}
-      {{- end }}
-      {{- if not (eq .Values.global.proxy.tracer "none") }}
-      tracing:
-      {{- if eq .Values.global.proxy.tracer "lightstep" }}
-        lightstep:
-          # Address of the LightStep Satellite pool
-          address: {{ .Values.global.tracer.lightstep.address }}
-          # Access Token used to communicate with the Satellite pool
-          accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
-      {{- else if eq .Values.global.proxy.tracer "zipkin" }}
-        zipkin:
-          # Address of the Zipkin collector
-          address: {{ ((.Values.global.tracer).zipkin).address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
-      {{- else if eq .Values.global.proxy.tracer "datadog" }}
-        datadog:
-          # Address of the Datadog Agent
-          address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
-      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
-        stackdriver:
-          # enables trace output to stdout.
-          debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}
-          # The global default max number of attributes per span.
-          maxNumberOfAttributes: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAttributes | default "200" }}
-          # The global default max number of annotation events per span.
-          maxNumberOfAnnotations: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAnnotations | default "200" }}
-          # The global default max number of message events per span.
-          maxNumberOfMessageEvents: {{ (($.Values.global.tracer).stackdriver).maxNumberOfMessageEvents | default "200" }}
-      {{- else if eq .Values.global.proxy.tracer "openCensusAgent" }}
-      {{/* Fill in openCensusAgent configuration from meshConfig so it isn't overwritten below */}}
-{{ toYaml $.Values.meshConfig.defaultConfig.tracing | indent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- if .Values.global.remotePilotAddress }}
-      discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
-      {{- else }}
-      discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
-      {{- end }}
-{{- end }}
-
-{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
-{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
-{{- $originalMesh := include "mesh" . | fromYaml }}
-{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
-
-{{- if .Values.configMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-
-  # Configuration file for the mesh networks to be used by the Split Horizon EDS.
-  meshNetworks: |-
-  {{- if .Values.global.meshNetworks }}
-    networks:
-{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
-  {{- else }}
-    networks: {}
-  {{- end }}
-
-  mesh: |-
-{{- if .Values.meshConfig }}
-{{ $mesh | toYaml | indent 4 }}
-{{- else }}
-{{- include "mesh" . }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.1/charts/istiod/templates/deployment.yaml b/resources/v1.24.1/charts/istiod/templates/deployment.yaml
deleted file mode 100644
index cd48ab757..000000000
--- a/resources/v1.24.1/charts/istiod/templates/deployment.yaml
+++ /dev/null
@@ -1,290 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- range $key, $val := .Values.deploymentLabels }}
-    {{ $key }}: "{{ $val }}"
-{{- end }}
-spec:
-{{- if not .Values.autoscaleEnabled }}
-{{- if .Values.replicaCount }}
-  replicas: {{ .Values.replicaCount }}
-{{- end }}
-{{- end }}
-  strategy:
-    rollingUpdate:
-      maxSurge: {{ .Values.rollingMaxSurge }}
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  selector:
-    matchLabels:
-      {{- if ne .Values.revision "" }}
-      app: istiod
-      istio.io/rev: {{ .Values.revision | default "default" | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
-  template:
-    metadata:
-      labels:
-        app: istiod
-        istio.io/rev: {{ .Values.revision | default "default" | quote }}
-        sidecar.istio.io/inject: "false"
-        operator.istio.io/component: "Pilot"
-        {{- if ne .Values.revision "" }}
-        istio: istiod
-        {{- else }}
-        istio: pilot
-        {{- end }}
-        {{- range $key, $val := .Values.podLabels }}
-        {{ $key }}: "{{ $val }}"
-        {{- end }}
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: "istiod"
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        prometheus.io/port: "15014"
-        prometheus.io/scrape: "true"
-        sidecar.istio.io/inject: "false"
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{- if .Values.nodeSelector }}
-      nodeSelector:
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- with .Values.affinity }}
-      affinity:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      tolerations:
-        - key: cni.istio.io/not-ready
-          operator: "Exists"
-{{- with .Values.tolerations }}
-{{- toYaml . | nindent 8 }}
-{{- end }}
-{{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- if .Values.global.priorityClassName }}
-      priorityClassName: "{{ .Values.global.priorityClassName }}"
-{{- end }}
-{{- with .Values.initContainers }}
-      initContainers:
-        {{- tpl (toYaml .) $ | nindent 8 }}
-{{- end }}
-      containers:
-        - name: discovery
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
-{{- end }}
-{{- if .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
-{{- end }}
-          args:
-          - "discovery"
-          - --monitoringAddr=:15014
-{{- if .Values.global.logging.level }}
-          - --log_output_level={{ .Values.global.logging.level }}
-{{- end}}
-{{- if .Values.global.logAsJson }}
-          - --log_as_json
-{{- end }}
-          - --domain
-          - {{ .Values.global.proxy.clusterDomain }}
-{{- if .Values.taint.namespace }}
-          - --cniNamespace={{ .Values.taint.namespace }}
-{{- end }}
-          - --keepaliveMaxServerConnectionAge
-          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
-{{- if .Values.extraContainerArgs }}
-          {{- with .Values.extraContainerArgs }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-{{- end }}
-          ports:
-          - containerPort: 8080
-            protocol: TCP
-            name: http-debug
-          - containerPort: 15010
-            protocol: TCP
-            name: grpc-xds
-          - containerPort: 15012
-            protocol: TCP
-            name: tls-xds
-          - containerPort: 15017
-            protocol: TCP
-            name: https-webhooks
-          - containerPort: 15014
-            protocol: TCP
-            name: http-monitoring
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 8080
-            initialDelaySeconds: 1
-            periodSeconds: 3
-            timeoutSeconds: 5
-          env:
-          - name: REVISION
-            value: "{{ .Values.revision | default `default` }}"
-          - name: PILOT_CERT_PROVIDER
-            value: {{ .Values.global.pilotCertProvider }}
-          - name: POD_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.name
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.namespace
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: spec.serviceAccountName
-          - name: KUBECONFIG
-            value: /var/run/secrets/remote/config
-          # If you explicitly told us where ztunnel lives, use that.
-          # Otherwise, assume it lives in our namespace
-          # Also, check for an explicit ENV override (legacy approach) and prefer that
-          # if present
-          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
-          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
-          - name: CA_TRUSTED_NODE_ACCOUNTS
-            value: "{{ $ztTrustedNS }}/ztunnel"
-          {{- end }}
-          {{- if .Values.env }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: "{{ $val }}"
-          {{- end }}
-          {{- end }}
-{{- if .Values.traceSampling }}
-          - name: PILOT_TRACE_SAMPLING
-            value: "{{ .Values.traceSampling }}"
-{{- end }}
-# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
-# don't set it here to avoid duplication.
-# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
-{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
-          - name: EXTERNAL_ISTIOD
-            value: "{{ .Values.global.externalIstiod }}"
-{{- end }}
-          - name: PILOT_ENABLE_ANALYSIS
-            value: "{{ .Values.global.istiod.enableAnalysis }}"
-          - name: CLUSTER_ID
-            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
-          - name: GOMEMLIMIT
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.memory
-          - name: GOMAXPROCS
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.cpu
-                divisor: "1"
-          - name: PLATFORM
-            value: "{{ coalesce .Values.global.platform .Values.platform }}"
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-              - ALL
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          volumeMounts:
-          - name: istio-token
-            mountPath: /var/run/secrets/tokens
-            readOnly: true
-          - name: local-certs
-            mountPath: /var/run/secrets/istio-dns
-          - name: cacerts
-            mountPath: /etc/cacerts
-            readOnly: true
-          - name: istio-kubeconfig
-            mountPath: /var/run/secrets/remote
-            readOnly: true
-          {{- if .Values.jwksResolverExtraRootCA }}
-          - name: extracacerts
-            mountPath: /cacerts
-          {{- end }}
-          - name: istio-csr-dns-cert
-            mountPath: /var/run/secrets/istiod/tls
-            readOnly: true
-          - name: istio-csr-ca-configmap
-            mountPath: /var/run/secrets/istiod/ca
-            readOnly: true
-          {{- with .Values.volumeMounts }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-      volumes:
-      # Technically not needed on this pod - but it helps debugging/testing SDS
-      # Should be removed after everything works.
-      - emptyDir:
-          medium: Memory
-        name: local-certs
-      - name: istio-token
-        projected:
-          sources:
-            - serviceAccountToken:
-                audience: {{ .Values.global.sds.token.aud }}
-                expirationSeconds: 43200
-                path: istio-token
-      # Optional: user-generated root
-      - name: cacerts
-        secret:
-          secretName: cacerts
-          optional: true
-      - name: istio-kubeconfig
-        secret:
-          secretName: istio-kubeconfig
-          optional: true
-      # Optional: istio-csr dns pilot certs
-      - name: istio-csr-dns-cert
-        secret:
-          secretName: istiod-tls
-          optional: true
-      - name: istio-csr-ca-configmap
-        configMap:
-          name: istio-ca-root-cert
-          defaultMode: 420
-          optional: true
-  {{- if .Values.jwksResolverExtraRootCA }}
-      - name: extracacerts
-        configMap:
-          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  {{- end }}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
-
----
-{{- end }}
diff --git a/resources/v1.24.1/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.24.1/charts/istiod/templates/istiod-injector-configmap.yaml
deleted file mode 100644
index 560c284ff..000000000
--- a/resources/v1.24.1/charts/istiod/templates/istiod-injector-configmap.yaml
+++ /dev/null
@@ -1,81 +0,0 @@
-{{- if not .Values.global.omitSidecarInjectorConfigMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
-  values: |-
-{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
-{{ $pilotVals := pick .Values "cni" -}}
-{{ $vals = set $vals "pilot" $pilotVals -}}
-{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
-{{ $vals = set $vals "gateways" $gatewayVals -}}
-{{ $vals | toPrettyJson | indent 4 }}
-
-  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
-  # and istiod webhook functionality.
-  #
-  # New fields should not use Values - it is a 'primary' config object, users should be able
-  # to fine tune it or use it with kube-inject.
-  config: |-
-    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
-    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
-    defaultTemplates:
-{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
-    - {{ . }}
-{{- end }}
-    {{- else }}
-    defaultTemplates: [sidecar]
-    {{- end }}
-    policy: {{ .Values.global.proxy.autoInject }}
-    alwaysInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
-    neverInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
-    injectedAnnotations:
-      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
-      "{{ $key }}": {{ $val | quote }}
-      {{- end }}
-    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
-         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
-         This should make it obvious that their installation is broken.
-     */}}
-    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
-    templates:
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
-      sidecar: |
-{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
-      gateway: |
-{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
-      grpc-simple: |
-{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
-      grpc-agent: |
-{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
-      waypoint: |
-{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
-      kube-gateway: |
-{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
-{{- end }}
-{{- with .Values.sidecarInjectorWebhook.templates }}
-{{ toYaml . | trim | indent 6 }}
-{{- end }}
-
-{{- end }}
diff --git a/resources/v1.24.1/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.24.1/charts/istiod/templates/remote-istiod-service.yaml
deleted file mode 100644
index 220277dc0..000000000
--- a/resources/v1.24.1/charts/istiod/templates/remote-istiod-service.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 443
-    targetPort: 15017
-    name: tcp-webhook
-    protocol: TCP
-  {{- if and .Values.global.remotePilotAddress (not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress)) }}
-  # if the remotePilotAddress is not an IP addr, we use ExternalName
-  type: ExternalName
-  externalName: {{ .Values.global.remotePilotAddress }}
-  {{- end }}
-{{- if .Values.global.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.global.ipFamilies }}
-  ipFamilies:
-{{- range .Values.global.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.1/charts/istiod/templates/revision-tags.yaml b/resources/v1.24.1/charts/istiod/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.24.1/charts/istiod/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.1/charts/istiod/templates/serviceaccount.yaml b/resources/v1.24.1/charts/istiod/templates/serviceaccount.yaml
deleted file mode 100644
index 22b841e87..000000000
--- a/resources/v1.24.1/charts/istiod/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-  {{- if .Values.serviceAccountAnnotations }}
-  annotations:
-{{- toYaml .Values.serviceAccountAnnotations | indent 4 }}
-  {{- end }}
-{{- end }}
----
diff --git a/resources/v1.24.1/charts/istiod/templates/zzz_profile.yaml b/resources/v1.24.1/charts/istiod/templates/zzz_profile.yaml
deleted file mode 100644
index 52f665fbd..000000000
--- a/resources/v1.24.1/charts/istiod/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $x := set $.Values "_original" (deepCopy $.Values) }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.1/charts/istiod/values.yaml b/resources/v1.24.1/charts/istiod/values.yaml
deleted file mode 100644
index 43ea8e57a..000000000
--- a/resources/v1.24.1/charts/istiod/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.24.1
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.24.1/charts/revisiontags/Chart.yaml b/resources/v1.24.1/charts/revisiontags/Chart.yaml
deleted file mode 100644
index b31dd4ad4..000000000
--- a/resources/v1.24.1/charts/revisiontags/Chart.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.1
-description: Helm chart for istio revision tags
-name: revisiontags
-sources:
-- https://github.com/istio-ecosystem/sail-operator
-version: 0.1.0
-
diff --git a/resources/v1.24.1/charts/revisiontags/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.1/charts/revisiontags/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.1/charts/revisiontags/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.1/charts/revisiontags/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.1/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.1/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.1/charts/revisiontags/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.1/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.1/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.1/charts/revisiontags/files/profile-demo.yaml b/resources/v1.24.1/charts/revisiontags/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.1/charts/revisiontags/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.1/charts/revisiontags/files/profile-platform-k3s.yaml b/resources/v1.24.1/charts/revisiontags/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.1/charts/revisiontags/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.1/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.24.1/charts/revisiontags/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.24.1/charts/revisiontags/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.1/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.24.1/charts/revisiontags/templates/zzz_profile.yaml
deleted file mode 100644
index 52f665fbd..000000000
--- a/resources/v1.24.1/charts/revisiontags/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $x := set $.Values "_original" (deepCopy $.Values) }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.1/charts/revisiontags/values.yaml b/resources/v1.24.1/charts/revisiontags/values.yaml
deleted file mode 100644
index 43ea8e57a..000000000
--- a/resources/v1.24.1/charts/revisiontags/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.24.1
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.24.1/charts/ztunnel/Chart.yaml b/resources/v1.24.1/charts/ztunnel/Chart.yaml
deleted file mode 100644
index ba6a8e40f..000000000
--- a/resources/v1.24.1/charts/ztunnel/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.1
-description: Helm chart for istio ztunnel components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-ztunnel
-- istio
-name: ztunnel
-sources:
-- https://github.com/istio/istio
-version: 1.24.1
diff --git a/resources/v1.24.1/charts/ztunnel/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.1/charts/ztunnel/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.1/charts/ztunnel/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.1/charts/ztunnel/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.1/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.1/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.1/charts/ztunnel/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.1/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.1/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.1/charts/ztunnel/files/profile-demo.yaml b/resources/v1.24.1/charts/ztunnel/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.1/charts/ztunnel/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.1/charts/ztunnel/files/profile-platform-k3s.yaml b/resources/v1.24.1/charts/ztunnel/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.1/charts/ztunnel/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.1/charts/ztunnel/templates/daemonset.yaml b/resources/v1.24.1/charts/ztunnel/templates/daemonset.yaml
deleted file mode 100644
index c6e2daf48..000000000
--- a/resources/v1.24.1/charts/ztunnel/templates/daemonset.yaml
+++ /dev/null
@@ -1,197 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-spec:
-  updateStrategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app: ztunnel
-  template:
-    metadata:
-      labels:
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app: ztunnel
-        app.kubernetes.io/name: ztunnel
-        {{- include "istio.labels" . | nindent 8}}
-{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-{{- if .Values.revision }}
-        istio.io/rev: {{ .Values.revision }}
-{{- end }}
-{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-{{- if .Values.nodeSelector }}
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- if .Values.affinity }}
-      affinity:
-{{ toYaml .Values.affinity | trim | indent 8 }}
-{{- end }}
-      serviceAccountName: ztunnel
-      tolerations:
-        - effect: NoSchedule
-          operator: Exists
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      containers:
-      - name: istio-proxy
-{{- if contains "/" .Values.image }}
-        image: "{{ .Values.image }}"
-{{- else }}
-        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
-{{- end }}
-        ports:
-        - containerPort: 15020
-          name: ztunnel-stats
-          protocol: TCP
-        resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 10 }}
-{{- end }}
-{{- with .Values.imagePullPolicy }}
-        imagePullPolicy: {{ . }}
-{{- end }}
-        securityContext:
-          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
-          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
-          allowPrivilegeEscalation: true
-          privileged: false
-          capabilities:
-            drop:
-            - ALL
-            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
-            - NET_ADMIN # Required for TPROXY and setsockopt
-            - SYS_ADMIN # Required for `setns` - doing things in other netns
-            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
-          readOnlyRootFilesystem: true
-          runAsGroup: 1337
-          runAsNonRoot: false
-          runAsUser: 0
-{{- if .Values.seLinuxOptions }}
-          seLinuxOptions:
-{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
-{{- end }}
-        readinessProbe:
-          httpGet:
-            port: 15021
-            path: /healthz/ready
-        args:
-        - proxy
-        - ztunnel
-        env:
-        - name: CA_ADDRESS
-        {{- if .Values.caAddress }}
-          value: {{ .Values.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: XDS_ADDRESS
-        {{- if .Values.xdsAddress }}
-          value: {{ .Values.xdsAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        {{- if .Values.logAsJson }}
-        - name: LOG_FORMAT
-          value: json
-        {{- end}}
-        - name: RUST_LOG
-          value: {{ .Values.logLevel | quote }}
-        - name: RUST_BACKTRACE
-          value: "1"
-        - name: ISTIO_META_CLUSTER_ID
-          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
-        - name: INPOD_ENABLED
-          value: "true"
-        - name: TERMINATION_GRACE_PERIOD_SECONDS
-          value: "{{ .Values.terminationGracePeriodSeconds }}"
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
-        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        {{- with .Values.env }}
-        {{- range $key, $val := . }}
-        - name: {{ $key }}
-          value: "{{ $val }}"
-        {{- end }}
-        {{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /var/run/ztunnel
-          name: cni-ztunnel-sock-dir
-        - mountPath: /tmp
-          name: tmp
-        {{- with .Values.volumeMounts }}
-          {{- toYaml . | nindent 8 }}
-        {{- end }}
-      priorityClassName: system-node-critical
-      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
-      volumes:
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: istio-ca
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      - name: cni-ztunnel-sock-dir
-        hostPath:
-          path: /var/run/ztunnel
-          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
-      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
-      - name: tmp
-        emptyDir: {}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
diff --git a/resources/v1.24.1/charts/ztunnel/templates/rbac.yaml b/resources/v1.24.1/charts/ztunnel/templates/rbac.yaml
deleted file mode 100644
index 44275dacd..000000000
--- a/resources/v1.24.1/charts/ztunnel/templates/rbac.yaml
+++ /dev/null
@@ -1,72 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-  {{- with .Values.imagePullSecrets }}
-imagePullSecrets:
-  {{- range . }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
----
-{{- if (eq .Values.platform "openshift") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: ztunnel
-  labels:
-    app: ztunnel
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-rules:
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: ztunnel
-  labels:
-    app: ztunnel
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ztunnel
-subjects:
-- kind: ServiceAccount
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-{{- end }}
----
diff --git a/resources/v1.24.1/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.24.1/charts/ztunnel/templates/zzz_profile.yaml
deleted file mode 100644
index 72d3adc53..000000000
--- a/resources/v1.24.1/charts/ztunnel/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.1/charts/ztunnel/values.yaml b/resources/v1.24.1/charts/ztunnel/values.yaml
deleted file mode 100644
index c9c1ea489..000000000
--- a/resources/v1.24.1/charts/ztunnel/values.yaml
+++ /dev/null
@@ -1,98 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
-  hub: gcr.io/istio-release
-  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
-  tag: 1.24.1
-  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
-  variant: ""
-
-  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
-  # If Image contains a "/", it will replace the entire `image` in the pod.
-  image: ztunnel
-
-  # Labels to apply to all top level resources
-  labels: {}
-  # Annotations to apply to all top level resources
-  annotations: {}
-
-  # Additional volumeMounts to the ztunnel container
-  volumeMounts: []
-
-  # Additional volumes to the ztunnel pod
-  volumes: []
-
-  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-
-  # Additional labels to apply on the pod level
-  podLabels: {}
-
-  # Pod resource configuration
-  resources:
-    requests:
-      cpu: 200m
-      # Ztunnel memory scales with the size of the cluster and traffic load
-      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
-      memory: 512Mi
-
-  # List of secret names to add to the service account as image pull secrets
-  imagePullSecrets: []
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
-
-  # Override for the pod imagePullPolicy
-  imagePullPolicy: ""
-
-  # Settings for multicluster
-  multiCluster:
-    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
-    # with Istiod configuration.
-    clusterName: ""
-
-  # meshConfig defines runtime configuration of components.
-  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
-  # components.
-  # TODO: https://github.com/istio/istio/issues/43248
-  meshConfig:
-    defaultConfig:
-      proxyMetadata: {}
-
-  # This value defines:
-  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
-  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
-  # Default K8S value is 30 seconds
-  terminationGracePeriodSeconds: 30
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
-  revision: ""
-
-  # The customized CA address to retrieve certificates for the pods in the cluster.
-  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-  caAddress: ""
-
-  # The customized XDS address to retrieve configuration.
-  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
-  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
-  xdsAddress: ""
-
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
-  istioNamespace: istio-system
-
-  # Configuration log level of ztunnel binary, default is info.
-  # Valid values are: trace, debug, info, warn, error
-  logLevel: info
-
-  # To output all logs in json format
-  logAsJson: false
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seLinuxOptions: {}
-  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
-  #seLinuxOptions:
-  #  type: spc_t
diff --git a/resources/v1.24.1/cni-1.24.1.tgz.etag b/resources/v1.24.1/cni-1.24.1.tgz.etag
deleted file mode 100644
index 19cb3ff61..000000000
--- a/resources/v1.24.1/cni-1.24.1.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-21334f50dcc74ccbf2e8a0d500a78644
diff --git a/resources/v1.24.1/commit b/resources/v1.24.1/commit
deleted file mode 100644
index f9e8384bb..000000000
--- a/resources/v1.24.1/commit
+++ /dev/null
@@ -1 +0,0 @@
-1.24.1
diff --git a/resources/v1.24.1/gateway-1.24.1.tgz.etag b/resources/v1.24.1/gateway-1.24.1.tgz.etag
deleted file mode 100644
index 3303dc964..000000000
--- a/resources/v1.24.1/gateway-1.24.1.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-043744317f7fccd20339a6a9c998451f
diff --git a/resources/v1.24.1/istiod-1.24.1.tgz.etag b/resources/v1.24.1/istiod-1.24.1.tgz.etag
deleted file mode 100644
index 79697f707..000000000
--- a/resources/v1.24.1/istiod-1.24.1.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-22de115a27b6fcd195ec00bcae9209cc
diff --git a/resources/v1.24.1/profiles/default.yaml b/resources/v1.24.1/profiles/default.yaml
deleted file mode 100644
index e9e0a3931..000000000
--- a/resources/v1.24.1/profiles/default.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  # Most default values come from the helm chart's values.yaml
-  # Below are the things that differ
-  values:
-    defaultRevision: ""
-    global:
-      istioNamespace: istio-system
-      configValidation: true
diff --git a/resources/v1.24.1/ztunnel-1.24.1.tgz.etag b/resources/v1.24.1/ztunnel-1.24.1.tgz.etag
deleted file mode 100644
index 885921d9e..000000000
--- a/resources/v1.24.1/ztunnel-1.24.1.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-c8d8705a3da586fefc569ad9dc8b257d
diff --git a/resources/v1.24.2/base-1.24.2.tgz.etag b/resources/v1.24.2/base-1.24.2.tgz.etag
deleted file mode 100644
index c2cfc813e..000000000
--- a/resources/v1.24.2/base-1.24.2.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-872d049e65dd52d2ee0b121c1cc1ff44
diff --git a/resources/v1.24.2/charts/base/Chart.yaml b/resources/v1.24.2/charts/base/Chart.yaml
deleted file mode 100644
index 9368f5350..000000000
--- a/resources/v1.24.2/charts/base/Chart.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.2
-description: Helm chart for deploying Istio cluster resources and CRDs
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-name: base
-sources:
-- https://github.com/istio/istio
-version: 1.24.2
diff --git a/resources/v1.24.2/charts/base/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.2/charts/base/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.2/charts/base/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.2/charts/base/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.2/charts/base/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.2/charts/base/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.2/charts/base/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.2/charts/base/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.2/charts/base/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.2/charts/base/files/profile-demo.yaml b/resources/v1.24.2/charts/base/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.2/charts/base/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.2/charts/base/files/profile-platform-k3s.yaml b/resources/v1.24.2/charts/base/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.2/charts/base/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.2/charts/base/templates/zzz_profile.yaml b/resources/v1.24.2/charts/base/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.2/charts/base/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.2/charts/base/values.yaml b/resources/v1.24.2/charts/base/values.yaml
deleted file mode 100644
index 98c9c3645..000000000
--- a/resources/v1.24.2/charts/base/values.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  global:
-
-    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-
-    # Used to locate istiod.
-    istioNamespace: istio-system
-
-    # Platform where Istio is deployed. Possible values are: "openshift", "gcp".
-    # An empty value means it is a vanilla Kubernetes distribution, therefore no special
-    # treatment will be considered.
-    platform: ""
-  base:
-    # A list of CRDs to exclude. Requires `enableCRDTemplates` to be true.
-    # Example: `excludedCRDs: ["envoyfilters.networking.istio.io"]`.
-    # Note: when installing with `istioctl`, `enableIstioConfigCRDs=false` must also be set.
-    excludedCRDs: []
-    # Helm (as of V3) does not support upgrading CRDs, because it is not universally
-    # safe for them to support this.
-    # Istio as a project enforces certain backwards-compat guarantees that allow us
-    # to safely upgrade CRDs in spite of this, so we default to self-managing CRDs
-    # as standard K8S resources in Helm, and disable Helm's CRD management. See also:
-    # https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#method-2-separate-charts
-    enableCRDTemplates: true
-
-    # Validation webhook configuration url
-    # For example: https://$remotePilotAddress:15017/validate
-    validationURL: ""
-    # Validation webhook caBundle value. Useful when running pilot with a well known cert
-    validationCABundle: ""
-
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  defaultRevision: "default"
-  experimental:
-    stableValidationPolicy: false
diff --git a/resources/v1.24.2/charts/cni/Chart.yaml b/resources/v1.24.2/charts/cni/Chart.yaml
deleted file mode 100644
index 912e92841..000000000
--- a/resources/v1.24.2/charts/cni/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.2
-description: Helm chart for istio-cni components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-cni
-- istio
-name: cni
-sources:
-- https://github.com/istio/istio
-version: 1.24.2
diff --git a/resources/v1.24.2/charts/cni/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.2/charts/cni/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.2/charts/cni/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.2/charts/cni/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.2/charts/cni/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.2/charts/cni/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.2/charts/cni/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.2/charts/cni/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.2/charts/cni/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.2/charts/cni/files/profile-demo.yaml b/resources/v1.24.2/charts/cni/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.2/charts/cni/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.2/charts/cni/files/profile-platform-k3s.yaml b/resources/v1.24.2/charts/cni/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.2/charts/cni/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.2/charts/cni/templates/clusterrole.yaml b/resources/v1.24.2/charts/cni/templates/clusterrole.yaml
deleted file mode 100644
index ac36f9c0e..000000000
--- a/resources/v1.24.2/charts/cni/templates/clusterrole.yaml
+++ /dev/null
@@ -1,77 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: ["security.openshift.io"] 
-  resources: ["securitycontextconstraints"] 
-  resourceNames: ["privileged"] 
-  verbs: ["use"]
-- apiGroups: [""]
-  resources: ["pods","nodes","namespaces"]
-  verbs: ["get", "list", "watch"]
-{{- if (eq (coalesce .Values.platform .Values.global.platform) "openshift") }}
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
-{{- end }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-repair-role
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "patch"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["watch", "get", "list"]
-{{- if .Values.repair.repairPods }}
-{{- /*  No privileges needed*/}}
-{{- else if .Values.repair.deletePods }}
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["delete"]
-{{- else if .Values.repair.labelPods }}
-  - apiGroups: [""]
-    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-    resources: ["pods/status"]
-    verbs: ["patch", "update"]
-{{- end }}
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: [""]
-  {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-  resources: ["pods/status"]
-  verbs: ["patch", "update"]
-{{- end }}
diff --git a/resources/v1.24.2/charts/cni/templates/configmap-cni.yaml b/resources/v1.24.2/charts/cni/templates/configmap-cni.yaml
deleted file mode 100644
index 52d612441..000000000
--- a/resources/v1.24.2/charts/cni/templates/configmap-cni.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: {{ template "name" . }}-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  CURRENT_AGENT_VERSION: {{ .Values.tag | default .Values.global.tag | quote }}
-  AMBIENT_ENABLED: {{ .Values.ambient.enabled | quote }}
-  AMBIENT_DNS_CAPTURE: {{ .Values.ambient.dnsCapture | default "false" | quote  }}
-  AMBIENT_IPV6: {{ .Values.ambient.ipv6 | default "false" | quote }}
-  {{- if .Values.cniConfFileName }} # K8S < 1.24 doesn't like empty values
-  CNI_CONF_NAME: {{ .Values.cniConfFileName }} # Name of the CNI config file to create. Only override if you know the exact path your CNI requires..
-  {{- end }}
-  CHAINED_CNI_PLUGIN: {{ .Values.chained | quote }}
-  EXCLUDED_NAMESPACES: "{{ range $idx, $ns := .Values.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
-  REPAIR_ENABLED: {{ .Values.chained | quote }}
-  REPAIR_LABEL_PODS: {{ .Values.repair.labelPods | quote }}
-  REPAIR_DELETE_PODS: {{ .Values.repair.deletePods | quote }}
-  REPAIR_REPAIR_PODS: {{ .Values.repair.repairPods | quote }}
-  REPAIR_INIT_CONTAINER_NAME: {{ .Values.repair.initContainerName | quote }}
-  REPAIR_BROKEN_POD_LABEL_KEY: {{ .Values.repair.brokenPodLabelKey | quote }}
-  REPAIR_BROKEN_POD_LABEL_VALUE: {{ .Values.repair.brokenPodLabelValue | quote }}
-  {{- with .Values.env }}
-  {{- range $key, $val := . }}
-  {{ $key }}: "{{ $val }}"
-  {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.2/charts/cni/templates/daemonset.yaml b/resources/v1.24.2/charts/cni/templates/daemonset.yaml
deleted file mode 100644
index d287dba40..000000000
--- a/resources/v1.24.2/charts/cni/templates/daemonset.yaml
+++ /dev/null
@@ -1,232 +0,0 @@
-# This manifest installs the Istio install-cni container, as well
-# as the Istio CNI plugin and config on
-# each master and worker node in a Kubernetes cluster.
-{{- $defaultBinDir :=
-    (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
-      "/home/kubernetes/bin"
-      "/opt/cni/bin"
-}}
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  name: {{ template "name" . }}-node
-  namespace: {{ .Release.Namespace }}
-  labels:
-    k8s-app: {{ template "name" . }}-node
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  selector:
-    matchLabels:
-      k8s-app: {{ template "name" . }}-node
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  template:
-    metadata:
-      labels:
-        k8s-app: {{ template "name" . }}-node
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: {{ template "name" . }}
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-        # Add Prometheus Scrape annotations
-        prometheus.io/scrape: 'true'
-        prometheus.io/port: "15014"
-        prometheus.io/path: '/metrics'
-        # Add AppArmor annotation
-        # This is required to avoid conflicts with AppArmor profiles which block certain
-        # privileged pod capabilities.
-        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
-        # securityContext which is otherwise preferred.
-        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
-        # Custom annotations
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{if .Values.ambient.enabled }}
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-{{ end }}
-      nodeSelector:
-        kubernetes.io/os: linux
-      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      tolerations:
-        # Make sure istio-cni-node gets scheduled on all nodes.
-        - effect: NoSchedule
-          operator: Exists
-        # Mark the pod as a critical add-on for rescheduling.
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      priorityClassName: system-node-critical
-      serviceAccountName: {{ template "name" . }}
-      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
-      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
-      terminationGracePeriodSeconds: 5
-      containers:
-        # This container installs the Istio CNI binaries
-        # and CNI network config file on each node.
-        - name: install-cni
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
-{{- end }}
-{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
-{{- end }}
-          ports:
-          - containerPort: 15014
-            name: metrics
-            protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8000
-          securityContext:
-            privileged: false
-            runAsGroup: 0
-            runAsUser: 0
-            runAsNonRoot: false
-            # Both ambient and sidecar repair mode require elevated node privileges to function.
-            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
-            # add capabilities based on feature.
-            capabilities:
-              drop:
-              - ALL
-              add:
-              # CAP_NET_ADMIN is required to allow ipset and route table access
-              - NET_ADMIN
-              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
-              - NET_RAW
-              # CAP_SYS_PTRACE is required for repair mode to describe the pod's network namespace
-              # in ambient and repair mode.
-              - SYS_PTRACE
-              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
-              # network namespaces in `/proc` to obtain descriptors for entering pod network
-              # namespaces. There does not appear to be a more granular capability for this.
-              - SYS_ADMIN
-              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
-              # the typical ability to read/write to folders owned by others.
-              # This can cause problems if the hostPath mounts we use, which we require write access into,
-              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
-              - DAC_OVERRIDE
-{{- if .Values.seLinuxOptions }}
-{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
-            seLinuxOptions:
-{{ toYaml . | trim | indent 14 }}
-{{- end }}
-{{- end }}
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          command: ["install-cni"]
-          args:
-            {{- if or .Values.logging.level .Values.global.logging.level }}
-            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
-            {{- end}}
-            {{- if .Values.global.logAsJson }}
-            - --log_as_json
-            {{- end}}
-          envFrom:
-            - configMapRef:
-                name: {{ template "name" . }}-config
-          env:
-            - name: REPAIR_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: REPAIR_RUN_AS_DAEMON
-              value: "true"
-            - name: REPAIR_SIDECAR_ANNOTATION
-              value: "sidecar.istio.io/status"
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  apiVersion: v1
-                  fieldPath: spec.nodeName
-            - name: GOMEMLIMIT
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.memory
-            - name: GOMAXPROCS
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.cpu
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          volumeMounts:
-            - mountPath: /host/opt/cni/bin
-              name: cni-bin-dir
-            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-            - mountPath: /host/proc
-              name: cni-host-procfs
-              readOnly: true
-            {{- end }}
-            - mountPath: /host/etc/cni/net.d
-              name: cni-net-dir
-            - mountPath: /var/run/istio-cni
-              name: cni-socket-dir
-            {{- if .Values.ambient.enabled }}
-            - mountPath: /host/var/run/netns
-              mountPropagation: HostToContainer
-              name: cni-netns-dir
-            - mountPath: /var/run/ztunnel
-              name: cni-ztunnel-sock-dir
-            {{ end }}
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-      volumes:
-        # Used to install CNI.
-        - name: cni-bin-dir
-          hostPath:
-            path: {{ .Values.cniBinDir | default $defaultBinDir }}
-        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-        - name: cni-host-procfs
-          hostPath:
-            path: /proc
-            type: Directory
-        {{- end }}
-        {{- if .Values.ambient.enabled }}
-        - name: cni-ztunnel-sock-dir
-          hostPath:
-            path: /var/run/ztunnel
-            type: DirectoryOrCreate
-        {{- end }}
-        - name: cni-net-dir
-          hostPath:
-            path: {{ default "/etc/cni/net.d" .Values.cniConfDir }}
-        # Used for UDS sockets for logging, ambient eventing
-        - name: cni-socket-dir
-          hostPath:
-            path: /var/run/istio-cni
-        - name: cni-netns-dir
-          hostPath:
-            path: {{ .Values.cniNetnsDir | default "/var/run/netns" }}
-            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
-            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
-            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.24.2/charts/cni/templates/zzz_profile.yaml b/resources/v1.24.2/charts/cni/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.2/charts/cni/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.2/charts/cni/values.yaml b/resources/v1.24.2/charts/cni/values.yaml
deleted file mode 100644
index ea7347874..000000000
--- a/resources/v1.24.2/charts/cni/values.yaml
+++ /dev/null
@@ -1,149 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  hub: ""
-  tag: ""
-  variant: ""
-  image: install-cni
-  pullPolicy: ""
-
-  # Same as `global.logging.level`, but will override it if set
-  logging:
-    level: ""
-
-  # Configuration file to insert istio-cni plugin configuration
-  # by default this will be the first file found in the cni-conf-dir
-  # Example
-  # cniConfFileName: 10-calico.conflist
-
-  # CNI bin and conf dir override settings
-  # defaults:
-  cniBinDir: "" # Auto-detected based on version; defaults to /opt/cni/bin.
-  cniConfDir: /etc/cni/net.d
-  cniConfFileName: ""
-  # This directory must exist on the node, if it does not, consult your container runtime
-  # documentation for the appropriate path.
-  cniNetnsDir: # Defaults to '/var/run/netns', in minikube/docker/others can be '/var/run/docker/netns'.
-
-
-  excludeNamespaces:
-    - kube-system
-
-  # Allows user to set custom affinity for the DaemonSet
-  affinity: {}
-
-  # Custom annotations on pod level, if you need them
-  podAnnotations: {}
-
-  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
-  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
-  chained: true
-
-  # Custom configuration happens based on the CNI provider.
-  # Possible values: "default", "multus"
-  provider: "default"
-
-  # Configure ambient settings
-  ambient:
-    # If enabled, ambient redirection will be enabled
-    enabled: false
-    # Set ambient config dir path: defaults to /etc/ambient-config
-    configDir: ""
-    # If enabled, and ambient is enabled, DNS redirection will be enabled
-    dnsCapture: false
-    # If enabled, and ambient is enabled, enables ipv6 support
-    ipv6: true
-
-
-  repair:
-    enabled: true
-    hub: ""
-    tag: ""
-
-    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
-    # This defines the action the controller will take when a pod is detected as broken.
-
-    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
-    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
-    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
-    labelPods: false
-    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
-    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
-    deletePods: false
-    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
-    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
-    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
-    repairPods: true
-
-    initContainerName: "istio-validation"
-
-    brokenPodLabelKey: "cni.istio.io/uninitialized"
-    brokenPodLabelValue: "true"
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
-  seLinuxOptions: {}
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 100Mi
-
-  resourceQuotas:
-    enabled: false
-    pods: 5000
-
-  # The number of pods that can be unavailable during rolling update (see
-  # `updateStrategy.rollingUpdate.maxUnavailable` here:
-  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
-  # May be specified as a number of pods or as a percent of the total number
-  # of pods at the start of the update.
-  rollingMaxUnavailable: 1
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  global:
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-
-    # Default tag for Istio images.
-    tag: 1.24.2
-
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # change cni scope level to control logging out of istio-cni-node DaemonSet
-    logging:
-      level: info
-
-    logAsJson: false
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Default resources allocated
-    defaultResources:
-      requests:
-        cpu: 100m
-        memory: 100Mi
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
diff --git a/resources/v1.24.2/charts/gateway/Chart.yaml b/resources/v1.24.2/charts/gateway/Chart.yaml
deleted file mode 100644
index 33743efd2..000000000
--- a/resources/v1.24.2/charts/gateway/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.2
-description: Helm chart for deploying Istio gateways
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- gateways
-name: gateway
-sources:
-- https://github.com/istio/istio
-type: application
-version: 1.24.2
diff --git a/resources/v1.24.2/charts/gateway/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.2/charts/gateway/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.2/charts/gateway/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.2/charts/gateway/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.2/charts/gateway/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.2/charts/gateway/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.2/charts/gateway/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.2/charts/gateway/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.2/charts/gateway/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.2/charts/gateway/files/profile-demo.yaml b/resources/v1.24.2/charts/gateway/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.2/charts/gateway/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.2/charts/gateway/files/profile-platform-k3s.yaml b/resources/v1.24.2/charts/gateway/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.2/charts/gateway/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.2/charts/gateway/templates/deployment.yaml b/resources/v1.24.2/charts/gateway/templates/deployment.yaml
deleted file mode 100644
index e9bfbbd36..000000000
--- a/resources/v1.24.2/charts/gateway/templates/deployment.yaml
+++ /dev/null
@@ -1,128 +0,0 @@
-apiVersion: apps/v1
-kind: {{ .Values.kind | default "Deployment" }}
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  {{- with .Values.replicaCount }}
-  replicas: {{ . }}
-  {{- end }}
-  {{- end }}
-  {{- with .Values.strategy }}
-  strategy:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.minReadySeconds }}
-  minReadySeconds: {{ . }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "gateway.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
-        {{- include "gateway.selectorLabels" . | nindent 8 }}
-        app.kubernetes.io/name: {{ include "gateway.name" . }}
-        {{- include "istio.labels" .  | nindent 8}}
-        {{- range $key, $val := .Values.labels }}
-        {{- if and (ne $key "app") (ne $key "istio") }}
-        {{ $key | quote }}: {{ $val | quote }}
-        {{- end }}
-        {{- end }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
-      securityContext:
-      {{- if .Values.securityContext }}
-        {{- toYaml .Values.securityContext | nindent 8 }}
-      {{- else }}
-        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- end }}
-      {{- with .Values.volumes }}
-      volumes:
-        {{ toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: istio-proxy
-          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
-          image: auto
-          {{- with .Values.imagePullPolicy }}
-          imagePullPolicy: {{ . }}
-          {{- end }}
-          securityContext:
-          {{- if .Values.containerSecurityContext }}
-            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          {{- else }}
-            capabilities:
-              drop:
-              - ALL
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            {{- if not (eq .Values.platform "openshift") }}
-            runAsUser: 1337
-            runAsGroup: 1337
-            {{- end }}
-            runAsNonRoot: true
-          {{- end }}
-          env:
-          {{- with .Values.networkGateway }}
-          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-            value: "{{.}}"
-          {{- end }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: {{ $val | quote }}
-          {{- end }}
-          ports:
-          - containerPort: 15090
-            protocol: TCP
-            name: http-envoy-prom
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          {{- with .Values.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.readinessProbe }}
-          readinessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
-      {{- with .Values.priorityClassName }}
-      priorityClassName: {{ . }}
-      {{- end }}
diff --git a/resources/v1.24.2/charts/gateway/templates/service.yaml b/resources/v1.24.2/charts/gateway/templates/service.yaml
deleted file mode 100644
index 25ce3bcb0..000000000
--- a/resources/v1.24.2/charts/gateway/templates/service.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-{{- if not (eq .Values.service.type "None") }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-    {{- with .Values.networkGateway }}
-    topology.istio.io/network: "{{.}}"
-    {{- end }}
-  annotations:
-    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
-spec:
-{{- with .Values.service.loadBalancerIP }}
-  loadBalancerIP: "{{ . }}"
-{{- end }}
-{{- if eq .Values.service.type "LoadBalancer" }}
-  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
-  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
-  {{- end }}
-{{- end }}
-{{- if .Values.service.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.service.ipFamilies }}
-  ipFamilies:
-{{- range .Values.service.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
-{{- with .Values.service.loadBalancerSourceRanges }}
-  loadBalancerSourceRanges:
-{{ toYaml . | indent 4 }}
-{{- end }}
-{{- with .Values.service.externalTrafficPolicy }}
-  externalTrafficPolicy: "{{ . }}"
-{{- end }}
-  type: {{ .Values.service.type }}
-  ports:
-{{- if .Values.networkGateway }}
-  - name: status-port
-    port: 15021
-    targetPort: 15021
-  - name: tls
-    port: 15443
-    targetPort: 15443
-  - name: tls-istiod
-    port: 15012
-    targetPort: 15012
-  - name: tls-webhook
-    port: 15017
-    targetPort: 15017
-{{- else }}
-{{ .Values.service.ports | toYaml | indent 4 }}
-{{- end }}
-{{- if .Values.service.externalIPs }}
-  externalIPs: {{- range .Values.service.externalIPs }}
-    - {{.}}
-  {{- end }}
-{{- end }}
-  selector:
-    {{- include "gateway.selectorLabels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.24.2/charts/gateway/templates/zzz_profile.yaml b/resources/v1.24.2/charts/gateway/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.2/charts/gateway/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.2/charts/gateway/values.schema.json b/resources/v1.24.2/charts/gateway/values.schema.json
deleted file mode 100644
index 3fdaa2730..000000000
--- a/resources/v1.24.2/charts/gateway/values.schema.json
+++ /dev/null
@@ -1,330 +0,0 @@
-{
-  "$schema": "http://json-schema.org/schema#",
-  "$defs": {
-    "values": {
-      "type": "object",
-      "properties": {
-        "global": {
-          "type": "object"
-        },
-        "affinity": {
-          "type": "object"
-        },
-        "securityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "containerSecurityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "kind": {
-          "type": "string",
-          "enum": [
-            "Deployment",
-            "DaemonSet"
-          ]
-        },
-        "annotations": {
-          "additionalProperties": {
-            "type": [
-              "string",
-              "integer"
-            ]
-          },
-          "type": "object"
-        },
-        "autoscaling": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            },
-            "maxReplicas": {
-              "type": "integer"
-            },
-            "minReplicas": {
-              "type": "integer"
-            },
-            "targetCPUUtilizationPercentage": {
-              "type": "integer"
-            }
-          }
-        },
-        "env": {
-          "type": "object"
-        },
-        "strategy": {
-          "type": "object"
-        },
-        "minReadySeconds": {
-          "type": [
-            "null",
-            "integer"
-          ]
-        },
-        "readinessProbe": {
-          "type": [
-            "null",
-            "object"
-          ]
-        },
-        "labels": {
-          "type": "object"
-        },
-        "name": {
-          "type": "string"
-        },
-        "nodeSelector": {
-          "type": "object"
-        },
-        "podAnnotations": {
-          "type": "object",
-          "properties": {
-            "inject.istio.io/templates": {
-              "type": "string"
-            },
-            "prometheus.io/path": {
-              "type": "string"
-            },
-            "prometheus.io/port": {
-              "type": "string"
-            },
-            "prometheus.io/scrape": {
-              "type": "string"
-            }
-          }
-        },
-        "replicaCount": {
-          "type": [
-            "integer",
-            "null"
-          ]
-        },
-        "resources": {
-          "type": "object",
-          "properties": {
-            "limits": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            },
-            "requests": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            }
-          }
-        },
-        "revision": {
-          "type": "string"
-        },
-        "compatibilityVersion": {
-          "type": "string"
-        },
-        "runAsRoot": {
-          "type": "boolean"
-        },
-        "unprivilegedPort": {
-          "type": [
-            "string",
-            "boolean"
-          ],
-          "enum": [
-            true,
-            false,
-            "auto"
-          ]
-        },
-        "service": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "externalTrafficPolicy": {
-              "type": "string"
-            },
-            "loadBalancerIP": {
-              "type": "string"
-            },
-            "loadBalancerSourceRanges": {
-              "type": "array"
-            },
-            "ipFamilies": {
-              "items": {
-                "type": "string",
-                "enum": [
-                  "IPv4",
-                  "IPv6"
-                ]
-              }
-            },
-            "ipFamilyPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "SingleStack",
-                "PreferDualStack",
-                "RequireDualStack"
-              ]
-            },
-            "ports": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string"
-                  },
-                  "port": {
-                    "type": "integer"
-                  },
-                  "protocol": {
-                    "type": "string"
-                  },
-                  "targetPort": {
-                    "type": "integer"
-                  }
-                }
-              }
-            },
-            "type": {
-              "type": "string"
-            }
-          }
-        },
-        "serviceAccount": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "name": {
-              "type": "string"
-            },
-            "create": {
-              "type": "boolean"
-            }
-          }
-        },
-        "rbac": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            }
-          }
-        },
-        "tolerations": {
-          "type": "array"
-        },
-        "topologySpreadConstraints": {
-          "type": "array"
-        },
-        "networkGateway": {
-          "type": "string"
-        },
-        "imagePullPolicy": {
-          "type": "string",
-          "enum": [
-            "",
-            "Always",
-            "IfNotPresent",
-            "Never"
-          ]
-        },
-        "imagePullSecrets": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "name": {
-                "type": "string"
-              }
-            }
-          }
-        },
-        "podDisruptionBudget": {
-          "type": "object",
-          "properties": {
-            "minAvailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "maxUnavailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "unhealthyPodEvictionPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "IfHealthyBudget",
-                "AlwaysAllow"
-              ]
-            }
-          }
-        },
-        "terminationGracePeriodSeconds": {
-          "type": "number"
-        },
-        "volumes": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "volumeMounts": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "priorityClassName": {
-          "type": "string"
-        },
-        "_internal_defaults_do_not_set": {
-          "type": "object"
-        }
-      },
-      "additionalProperties": false
-    }
-  },
-  "defaults": {
-    "$ref": "#/$defs/values"
-  },
-  "$ref": "#/$defs/values"
-}
diff --git a/resources/v1.24.2/charts/gateway/values.yaml b/resources/v1.24.2/charts/gateway/values.yaml
deleted file mode 100644
index b02240df1..000000000
--- a/resources/v1.24.2/charts/gateway/values.yaml
+++ /dev/null
@@ -1,166 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Name allows overriding the release name. Generally this should not be set
-  name: ""
-  # revision declares which revision this gateway is a part of
-  revision: ""
-
-  # Controls the spec.replicas setting for the Gateway deployment if set.
-  # Otherwise defaults to Kubernetes Deployment default (1).
-  replicaCount:
-
-  kind: Deployment
-
-  rbac:
-    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
-    # when using http://gateway-api.org/.
-    enabled: true
-
-  serviceAccount:
-    # If set, a service account will be created. Otherwise, the default is used
-    create: true
-    # Annotations to add to the service account
-    annotations: {}
-    # The name of the service account to use.
-    # If not set, the release name is used
-    name: ""
-
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/stats/prometheus"
-    inject.istio.io/templates: "gateway"
-    sidecar.istio.io/inject: "true"
-
-  # Define the security context for the pod.
-  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-  securityContext: {}
-  containerSecurityContext: {}
-
-  service:
-    # Type of service. Set to "None" to disable the service entirely
-    type: LoadBalancer
-    ports:
-    - name: status-port
-      port: 15021
-      protocol: TCP
-      targetPort: 15021
-    - name: http2
-      port: 80
-      protocol: TCP
-      targetPort: 80
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
-    annotations: {}
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    externalTrafficPolicy: ""
-    externalIPs: []
-    ipFamilyPolicy: ""
-    ipFamilies: []
-    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
-    # allocateLoadBalancerNodePorts: false
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: 2000m
-      memory: 1024Mi
-
-  autoscaling:
-    enabled: true
-    minReplicas: 1
-    maxReplicas: 5
-    targetCPUUtilizationPercentage: 80
-    targetMemoryUtilizationPercentage: {}
-    autoscaleBehavior: {}
-
-  # Pod environment variables
-  env: {}
-
-  # Deployment Update strategy
-  strategy: {}
-  
-  # Sets the Deployment minReadySeconds value
-  minReadySeconds:
-  
-  # Optionally configure a custom readinessProbe. By default the control plane
-  # automatically injects the readinessProbe. If you wish to override that
-  # behavior, you may define your own readinessProbe here.
-  readinessProbe: {}
-
-  # Labels to apply to all resources
-  labels: {}
-
-  # Annotations to apply to all resources
-  annotations: {}
-
-  nodeSelector: {}
-
-  tolerations: []
-
-  topologySpreadConstraints: []
-
-  affinity: {}
-
-  # If specified, the gateway will act as a network gateway for the given network.
-  networkGateway: ""
-
-  # Specify image pull policy if default behavior isn't desired.
-  # Default behavior: latest images will be Always else IfNotPresent
-  imagePullPolicy: ""
-
-  imagePullSecrets: []
-
-  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
-  #
-  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
-  # which means that no PodDisruptionBudget resource will be created.
-  #
-  # To enable the PodDisruptionBudget, configure it by specifying the
-  # `minAvailable` or `maxUnavailable`. For example, to set the
-  # minimum number of available replicas to 1, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #
-  # Or, to allow a maximum of 1 unavailable replica, you can set:
-  #
-  # podDisruptionBudget:
-  #   maxUnavailable: 1
-  #
-  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
-  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #   unhealthyPodEvictionPolicy: AlwaysAllow
-  #
-  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
-  #
-  # podDisruptionBudget: {}
-  #
-  podDisruptionBudget: {}
-
-  # Sets the per-pod terminationGracePeriodSeconds setting.
-  terminationGracePeriodSeconds: 30
-
-  # A list of `Volumes` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumes: []
-
-  # A list of `VolumeMounts` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumeMounts: []
-
-  # Configure this to a higher priority class in order to make sure your Istio gateway pods
-  # will not be killed because of low priority class.
-  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-  # for more detail.
-  priorityClassName: ""
diff --git a/resources/v1.24.2/charts/istiod/Chart.yaml b/resources/v1.24.2/charts/istiod/Chart.yaml
deleted file mode 100644
index ba5513a08..000000000
--- a/resources/v1.24.2/charts/istiod/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.2
-description: Helm chart for istio control plane
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- istiod
-- istio-discovery
-name: istiod
-sources:
-- https://github.com/istio/istio
-version: 1.24.2
diff --git a/resources/v1.24.2/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.24.2/charts/istiod/files/gateway-injection-template.yaml
deleted file mode 100644
index 97ffb71f2..000000000
--- a/resources/v1.24.2/charts/istiod/files/gateway-injection-template.yaml
+++ /dev/null
@@ -1,250 +0,0 @@
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if eq (len $containers) 1 }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{ end }}
-  }
-spec:
-  securityContext:
-  {{- if .Values.gateways.securityContext }}
-    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
-  {{- else }}
-    sysctls:
-    - name: net.ipv4.ip_unprivileged_port_start
-      value: "0"
-  {{- end }}
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - router
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- end }}
-    securityContext:
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-    env:
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-  volumes:
-  - emptyDir: {}
-    name: workload-socket
-  - emptyDir: {}
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else}}
-  - emptyDir: {}
-    name: workload-certs
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.2/charts/istiod/files/grpc-agent.yaml b/resources/v1.24.2/charts/istiod/files/grpc-agent.yaml
deleted file mode 100644
index 7290fcdca..000000000
--- a/resources/v1.24.2/charts/istiod/files/grpc-agent.yaml
+++ /dev/null
@@ -1,310 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-    sidecar.istio.io/rewriteAppHTTPProbers: "false",
-  }
-spec:
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15020
-      protocol: TCP
-      name: mesh-metrics
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-          - --url=http://localhost:15020/healthz/ready
-    env:
-    - name: ISTIO_META_GENERATOR
-      value: grpc
-    - name: OUTPUT_CERTS
-      value: /var/lib/istio/data
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    # grpc uses xds:/// to resolve – no need to resolve VIP
-    - name: ISTIO_META_DNS_CAPTURE
-      value: "false"
-    - name: DISABLE_ENVOY
-      value: "true"
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15020
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # UDS channel between istioagent and gRPC client for XDS/SDS
-    - mountPath: /etc/istio/proxy
-      name: istio-xds
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-{{- range $index, $container := .Spec.Containers  }}
-{{ if not (eq $container.Name "istio-proxy") }}
-  - name: {{ $container.Name }}
-    env:
-      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
-        value: "true"
-      - name: "GRPC_XDS_BOOTSTRAP"
-        value: "/etc/istio/proxy/grpc-bootstrap.json"
-    volumeMounts:
-      - mountPath: /var/lib/istio/data
-        name: istio-data
-      # UDS channel between istioagent and gRPC client for XDS/SDS
-      - mountPath: /etc/istio/proxy
-        name: istio-xds
-      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-        readOnly: true
-      {{- else }}
-      - name: workload-certs
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-      {{- end }}
-{{- end }}
-{{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-xds
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.2/charts/istiod/files/injection-template.yaml b/resources/v1.24.2/charts/istiod/files/injection-template.yaml
deleted file mode 100644
index 0ef948e6a..000000000
--- a/resources/v1.24.2/charts/istiod/files/injection-template.yaml
+++ /dev/null
@@ -1,510 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
-    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
-    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
-    {{- end }}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-{{- if .Values.pilot.cni.enabled }}
-    {{- if eq .Values.pilot.cni.provider "multus" }}
-    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
-    {{- end }}
-    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}traffic.sidecar.istio.io/includeInboundPorts: "{{.}}",{{ end }}
-    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
-    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
-    {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
-    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
-    {{- end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
-{{- end }}
-  }
-spec:
-  {{- $holdProxy := and
-      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
-      (not $nativeSidecar) }}
-  initContainers:
-  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
-  {{ if .Values.pilot.cni.enabled -}}
-  - name: istio-validation
-  {{ else -}}
-  - name: istio-init
-  {{ end -}}
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    args:
-    - istio-iptables
-    - "-p"
-    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
-    - "-z"
-    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
-    - "-u"
-    - {{ .ProxyUID | default "1337" | quote }}
-    - "-m"
-    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
-    - "-i"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
-    - "-x"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
-    - "-b"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
-    - "-d"
-  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
-    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
-  {{- else }}
-    - "15090,15021"
-  {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
-    - "-q"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
-    {{ end -}}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
-    - "-o"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
-    {{ end -}}
-     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
-    - "-c"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
-    {{ end -}}
-    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
-    {{ if .Values.global.logAsJson -}}
-    - "--log_as_json"
-    {{ end -}}
-    {{ if .Values.pilot.cni.enabled -}}
-    - "--run-validation"
-    - "--skip-rule-apply"
-    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
-    - "--force-apply"
-    {{ end -}}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-  {{- if .ProxyConfig.ProxyMetadata }}
-    env:
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-  {{- end }}
-    resources:
-  {{ template "resources" . }}
-    securityContext:
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      privileged: {{ .Values.global.proxy.privileged }}
-      capabilities:
-    {{- if not .Values.pilot.cni.enabled }}
-        add:
-        - NET_ADMIN
-        - NET_RAW
-    {{- end }}
-        drop:
-        - ALL
-    {{- if not .Values.pilot.cni.enabled }}
-      readOnlyRootFilesystem: false
-      runAsGroup: 0
-      runAsNonRoot: false
-      runAsUser: 0
-    {{- else }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsNonRoot: true
-    {{- end }}
-  {{ end -}}
-  {{ if not $nativeSidecar }}
-  containers:
-  {{ end }}
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.outlierLogPath }}
-    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-  {{- end}}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- else if $holdProxy }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-  {{- else if $nativeSidecar }}
-    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
-    lifecycle:
-      preStop:
-        exec:
-          command:
-          - pilot-agent
-          - request
-          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
-          - POST
-          - drain
-  {{- end }}
-    env:
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - name: ISTIO_BOOTSTRAP_OVERRIDE
-      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
-    {{- end }}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-  {{ if .Values.global.proxy.startupProbe.enabled }}
-    startupProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: 0
-      periodSeconds: 1
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
-  {{ end }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    {{ end -}}
-    securityContext:
-      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
-      allowPrivilegeEscalation: true
-      capabilities:
-        add:
-        - NET_ADMIN
-        drop:
-        - ALL
-      privileged: true
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else }}
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      capabilities:
-        {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-        add:
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
-        - NET_ADMIN
-        {{- end }}
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
-        - NET_BIND_SERVICE
-        {{- end }}
-        {{- end }}
-        drop:
-        - ALL
-      privileged: {{ .Values.global.proxy.privileged }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else -}}
-      runAsNonRoot: true
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      {{- end }}
-      {{- end }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - mountPath: /etc/istio/custom-bootstrap
-      name: custom-bootstrap-volume
-    {{- end }}
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
-      name: lightstep-certs
-      readOnly: true
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  - emptyDir:
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-  - name: lightstep-certs
-    secret:
-      optional: true
-      secretName: lightstep.cacert
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.2/charts/istiod/files/kube-gateway.yaml b/resources/v1.24.2/charts/istiod/files/kube-gateway.yaml
deleted file mode 100644
index dbe158de1..000000000
--- a/resources/v1.24.2/charts/istiod/files/kube-gateway.yaml
+++ /dev/null
@@ -1,345 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-gateway-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": {{.Name}}
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-gateway-controller"
-          ) | nindent 8 }}
-    spec:
-      securityContext:
-      {{- if .Values.gateways.securityContext }}
-        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
-      {{- else }}
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- if .Values.gateways.seccompProfile }}
-        seccompProfile:
-      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
-      {{- end }}
-      {{- end }}
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-      {{- else }}
-        image: "{{ .ProxyImage }}"
-      {{- end }}
-        {{- if .Values.global.proxy.resources }}
-        resources:
-          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsUser: {{ .ProxyUID | default "1337" }}
-          runAsGroup: {{ .ProxyGID | default "1337" }}
-          runAsNonRoot: true
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        args:
-        - proxy
-        - router
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-      {{- if .Values.global.sts.servicePort }}
-        - --stsPort={{ .Values.global.sts.servicePort }}
-      {{- end }}
-      {{- if .Values.global.logAsJson }}
-        - --log_as_json
-      {{- end }}
-      {{- if .Values.global.proxy.lifecycle }}
-        lifecycle:
-          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
-      {{- end }}
-        env:
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        - name: ISTIO_META_POD_PORTS
-          value: "[]"
-        - name: ISTIO_META_APP_CONTAINERS
-          value: ""
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: "{{ .ProxyConfig.InterceptionMode.String }}"
-        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
-        - name: ISTIO_META_NETWORK
-          value: {{.|quote}}
-        {{- end }}
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName|quote}}
-        - name: ISTIO_META_OWNER
-          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
-        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-          value: {{.|quote}}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        volumeMounts:
-        - name: workload-socket
-          mountPath: /var/run/secrets/workload-spiffe-uds
-        - name: credential-socket
-          mountPath: /var/run/secrets/credential-uds
-        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-        - name: gke-workload-certificate
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-          readOnly: true
-        {{- else }}
-        - name: workload-certs
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-        {{- end }}
-        {{- if eq .Values.global.pilotCertProvider "istiod" }}
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        {{- end }}
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        # SDS channel between istioagent and Envoy
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - name: istio-podinfo
-          mountPath: /etc/istio/pod
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir: {}
-        name: credential-socket
-      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        csi:
-          driver: workloadcertificates.security.cloud.google.com
-      {{- else}}
-      - emptyDir: {}
-        name: workload-certs
-      {{- end }}
-      # SDS channel between istioagent and Envoy
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - name: istio-data
-        emptyDir: {}
-      - name: istio-podinfo
-        downwardAPI:
-          items:
-            - path: "labels"
-              fieldRef:
-                fieldPath: metadata.labels
-            - path: "annotations"
-              fieldRef:
-                fieldPath: metadata.annotations
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: {{ .Values.global.sds.token.aud }}
-      {{- if eq .Values.global.pilotCertProvider "istiod" }}
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: {{.UID}}
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": {{.Name}}
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.24.2/charts/istiod/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.2/charts/istiod/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.2/charts/istiod/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.2/charts/istiod/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.2/charts/istiod/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.2/charts/istiod/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.2/charts/istiod/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.2/charts/istiod/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.2/charts/istiod/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.2/charts/istiod/files/profile-demo.yaml b/resources/v1.24.2/charts/istiod/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.2/charts/istiod/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.2/charts/istiod/files/profile-platform-k3s.yaml b/resources/v1.24.2/charts/istiod/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.2/charts/istiod/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.2/charts/istiod/files/waypoint.yaml b/resources/v1.24.2/charts/istiod/files/waypoint.yaml
deleted file mode 100644
index bbe47674b..000000000
--- a/resources/v1.24.2/charts/istiod/files/waypoint.yaml
+++ /dev/null
@@ -1,333 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-mesh-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": "{{.Name}}"
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "istio.io/dataplane-mode" "none"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-mesh-controller"
-          ) | nindent 8}}
-    spec:
-      {{- if .Values.global.waypoint.affinity }}
-      affinity:
-      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.topologySpreadConstraints }}
-      topologySpreadConstraints:
-      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.nodeSelector }}
-      nodeSelector:
-      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.tolerations }}
-      tolerations:
-      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: 2
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-        {{- else }}
-        image: "{{ .ProxyImage }}"
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        args:
-        - proxy
-        - waypoint
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --serviceCluster
-        - {{.ServiceAccount}}.$(POD_NAMESPACE)
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-        {{- if .Values.global.logAsJson }}
-        - --log_as_json
-        {{- end }}
-        env:
-        - name: ISTIO_META_SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        {{- if .ProxyConfig.ProxyMetadata }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
-        {{- if $network }}
-        - name: ISTIO_META_NETWORK
-          value: "{{ $network }}"
-        {{- end }}
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: REDIRECT
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName}}
-        - name: ISTIO_META_OWNER
-          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- if .Values.global.waypoint.resources }}
-        resources:
-        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        securityContext:
-          privileged: false
-        {{- if not (eq .Values.global.platform "openshift") }}
-          runAsGroup: 1337
-          runAsUser: 1337
-        {{- end }}
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-            - ALL
-{{- if .Values.gateways.seccompProfile }}
-          seccompProfile:
-{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
-{{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/workload-spiffe-uds
-          name: workload-socket
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /etc/istio/pod
-          name: istio-podinfo
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - emptyDir:
-          medium: Memory
-        name: go-proxy-envoy
-      - emptyDir: {}
-        name: istio-data
-      - emptyDir: {}
-        name: go-proxy-data
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.labels
-            path: labels
-          - fieldRef:
-              fieldPath: metadata.annotations
-            path: annotations
-        name: istio-podinfo
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              audience: istio-ca
-              expirationSeconds: 43200
-              path: istio-token
-      - configMap:
-          name: istio-ca-root-cert
-        name: istiod-ca-cert
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap
-      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
-      (omit .InfrastructureAnnotations
-        "kubectl.kubernetes.io/last-applied-configuration"
-        "gateway.istio.io/name-override"
-        "gateway.istio.io/service-account"
-        "gateway.istio.io/controller-version"
-      ) | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": "{{.Name}}"
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.24.2/charts/istiod/templates/clusterrole.yaml b/resources/v1.24.2/charts/istiod/templates/clusterrole.yaml
deleted file mode 100644
index 0c340b5b3..000000000
--- a/resources/v1.24.2/charts/istiod/templates/clusterrole.yaml
+++ /dev/null
@@ -1,187 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  # sidecar injection controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-
-  # configuration validation webhook controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-
-  # istio configuration
-  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
-  # please proceed with caution
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["get", "watch", "list"]
-    resources: ["*"]
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["update", "patch"]
-    resources:
-    - authorizationpolicies/status
-    - destinationrules/status
-    - envoyfilters/status
-    - gateways/status
-    - peerauthentications/status
-    - proxyconfigs/status
-    - requestauthentications/status
-    - serviceentries/status
-    - sidecars/status
-    - telemetries/status
-    - virtualservices/status
-    - wasmplugins/status
-    - workloadentries/status
-    - workloadgroups/status
-{{- end }}
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries/status",  "serviceentries/status" ]
-  - apiGroups: ["security.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "authorizationpolicies/status" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services/status" ]
-
-  # auto-detect installed CRD definitions
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-
-  # discovery and routing
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-
-{{- if .Values.taint.enabled }}
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["patch"]
-{{- end }}
-
-  # ingress controller
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-{{- end}}
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses", "ingressclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-
-  # required for CA's namespace controller
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-
-  # Istiod and bootstrap.
-{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
-{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "certificatesigningrequests"
-      - "certificatesigningrequests/approval"
-      - "certificatesigningrequests/status"
-    verbs: ["update", "create", "get", "delete", "watch"]
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "signers"
-    resourceNames:
-{{- range .Values.global.certSigners }}
-    - {{ . | quote }}
-{{- end }}
-    verbs: ["approve"]
-{{- end}}
-
-  # Used by Istiod to verify the JWT tokens
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-
-  # Used by Istiod to verify gateway SDS
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-
-  # Use for Kubernetes Service APIs
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources:
-    - backendtlspolicies/status
-    - gatewayclasses/status
-    - gateways/status
-    - grpcroutes/status
-    - httproutes/status
-    - referencegrants/status
-    - tcproutes/status
-    - tlsroutes/status
-    - udproutes/status
-    verbs: ["update", "patch"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["gatewayclasses"]
-    verbs: ["create", "update", "patch", "delete"]
-
-  # Needed for multicluster secret reading, possibly ingress certs in the future
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "watch", "list"]
-
-  # Used for MCS serviceexport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: [ "get", "watch", "list", "create", "delete"]
-
-  # Used for MCS serviceimport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "watch", "list"]
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: ["apps"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "deployments" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "serviceaccounts"]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.2/charts/istiod/templates/configmap-values.yaml b/resources/v1.24.2/charts/istiod/templates/configmap-values.yaml
deleted file mode 100644
index a7e60369d..000000000
--- a/resources/v1.24.2/charts/istiod/templates/configmap-values.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  original-values: |-
-{{ .Values._original | toPrettyJson | indent 4 }}
-{{- $_ := unset $.Values "_original" }}
-  merged-values: |-
-{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.24.2/charts/istiod/templates/configmap.yaml b/resources/v1.24.2/charts/istiod/templates/configmap.yaml
deleted file mode 100644
index 57702ea53..000000000
--- a/resources/v1.24.2/charts/istiod/templates/configmap.yaml
+++ /dev/null
@@ -1,109 +0,0 @@
-{{- define "mesh" }}
-    # The trust domain corresponds to the trust root of a system.
-    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
-    trustDomain: "cluster.local"
-
-    # The namespace to treat as the administrative root namespace for Istio configuration.
-    # When processing a leaf namespace Istio will search for declarations in that namespace first
-    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
-    # is processed as if it were declared in the leaf namespace.
-    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
-
-  {{ $prom := include "default-prometheus" . | eq "true" }}
-  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
-  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
-  {{- if or $prom $sdMetrics $sdLogs }}
-    defaultProviders:
-    {{- if or $prom $sdMetrics }}
-      metrics:
-      {{ if $prom }}- prometheus{{ end }}
-      {{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
-    {{- end }}
-    {{- if and $sdMetrics $sdLogs }}
-      accessLogging:
-      - stackdriver
-    {{- end }}
-  {{- end }}
-
-    defaultConfig:
-      {{- if .Values.global.meshID }}
-      meshId: "{{ .Values.global.meshID }}"
-      {{- end }}
-      {{- with (.Values.global.proxy.variant | default .Values.global.variant) }}
-      image:
-        imageType: {{. | quote}}
-      {{- end }}
-      {{- if not (eq .Values.global.proxy.tracer "none") }}
-      tracing:
-      {{- if eq .Values.global.proxy.tracer "lightstep" }}
-        lightstep:
-          # Address of the LightStep Satellite pool
-          address: {{ .Values.global.tracer.lightstep.address }}
-          # Access Token used to communicate with the Satellite pool
-          accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
-      {{- else if eq .Values.global.proxy.tracer "zipkin" }}
-        zipkin:
-          # Address of the Zipkin collector
-          address: {{ ((.Values.global.tracer).zipkin).address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
-      {{- else if eq .Values.global.proxy.tracer "datadog" }}
-        datadog:
-          # Address of the Datadog Agent
-          address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
-      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
-        stackdriver:
-          # enables trace output to stdout.
-          debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}
-          # The global default max number of attributes per span.
-          maxNumberOfAttributes: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAttributes | default "200" }}
-          # The global default max number of annotation events per span.
-          maxNumberOfAnnotations: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAnnotations | default "200" }}
-          # The global default max number of message events per span.
-          maxNumberOfMessageEvents: {{ (($.Values.global.tracer).stackdriver).maxNumberOfMessageEvents | default "200" }}
-      {{- else if eq .Values.global.proxy.tracer "openCensusAgent" }}
-      {{/* Fill in openCensusAgent configuration from meshConfig so it isn't overwritten below */}}
-{{ toYaml $.Values.meshConfig.defaultConfig.tracing | indent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- if .Values.global.remotePilotAddress }}
-      discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
-      {{- else }}
-      discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
-      {{- end }}
-{{- end }}
-
-{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
-{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
-{{- $originalMesh := include "mesh" . | fromYaml }}
-{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
-
-{{- if .Values.configMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-
-  # Configuration file for the mesh networks to be used by the Split Horizon EDS.
-  meshNetworks: |-
-  {{- if .Values.global.meshNetworks }}
-    networks:
-{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
-  {{- else }}
-    networks: {}
-  {{- end }}
-
-  mesh: |-
-{{- if .Values.meshConfig }}
-{{ $mesh | toYaml | indent 4 }}
-{{- else }}
-{{- include "mesh" . }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.2/charts/istiod/templates/deployment.yaml b/resources/v1.24.2/charts/istiod/templates/deployment.yaml
deleted file mode 100644
index cd48ab757..000000000
--- a/resources/v1.24.2/charts/istiod/templates/deployment.yaml
+++ /dev/null
@@ -1,290 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- range $key, $val := .Values.deploymentLabels }}
-    {{ $key }}: "{{ $val }}"
-{{- end }}
-spec:
-{{- if not .Values.autoscaleEnabled }}
-{{- if .Values.replicaCount }}
-  replicas: {{ .Values.replicaCount }}
-{{- end }}
-{{- end }}
-  strategy:
-    rollingUpdate:
-      maxSurge: {{ .Values.rollingMaxSurge }}
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  selector:
-    matchLabels:
-      {{- if ne .Values.revision "" }}
-      app: istiod
-      istio.io/rev: {{ .Values.revision | default "default" | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
-  template:
-    metadata:
-      labels:
-        app: istiod
-        istio.io/rev: {{ .Values.revision | default "default" | quote }}
-        sidecar.istio.io/inject: "false"
-        operator.istio.io/component: "Pilot"
-        {{- if ne .Values.revision "" }}
-        istio: istiod
-        {{- else }}
-        istio: pilot
-        {{- end }}
-        {{- range $key, $val := .Values.podLabels }}
-        {{ $key }}: "{{ $val }}"
-        {{- end }}
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: "istiod"
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        prometheus.io/port: "15014"
-        prometheus.io/scrape: "true"
-        sidecar.istio.io/inject: "false"
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{- if .Values.nodeSelector }}
-      nodeSelector:
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- with .Values.affinity }}
-      affinity:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      tolerations:
-        - key: cni.istio.io/not-ready
-          operator: "Exists"
-{{- with .Values.tolerations }}
-{{- toYaml . | nindent 8 }}
-{{- end }}
-{{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- if .Values.global.priorityClassName }}
-      priorityClassName: "{{ .Values.global.priorityClassName }}"
-{{- end }}
-{{- with .Values.initContainers }}
-      initContainers:
-        {{- tpl (toYaml .) $ | nindent 8 }}
-{{- end }}
-      containers:
-        - name: discovery
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
-{{- end }}
-{{- if .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
-{{- end }}
-          args:
-          - "discovery"
-          - --monitoringAddr=:15014
-{{- if .Values.global.logging.level }}
-          - --log_output_level={{ .Values.global.logging.level }}
-{{- end}}
-{{- if .Values.global.logAsJson }}
-          - --log_as_json
-{{- end }}
-          - --domain
-          - {{ .Values.global.proxy.clusterDomain }}
-{{- if .Values.taint.namespace }}
-          - --cniNamespace={{ .Values.taint.namespace }}
-{{- end }}
-          - --keepaliveMaxServerConnectionAge
-          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
-{{- if .Values.extraContainerArgs }}
-          {{- with .Values.extraContainerArgs }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-{{- end }}
-          ports:
-          - containerPort: 8080
-            protocol: TCP
-            name: http-debug
-          - containerPort: 15010
-            protocol: TCP
-            name: grpc-xds
-          - containerPort: 15012
-            protocol: TCP
-            name: tls-xds
-          - containerPort: 15017
-            protocol: TCP
-            name: https-webhooks
-          - containerPort: 15014
-            protocol: TCP
-            name: http-monitoring
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 8080
-            initialDelaySeconds: 1
-            periodSeconds: 3
-            timeoutSeconds: 5
-          env:
-          - name: REVISION
-            value: "{{ .Values.revision | default `default` }}"
-          - name: PILOT_CERT_PROVIDER
-            value: {{ .Values.global.pilotCertProvider }}
-          - name: POD_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.name
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.namespace
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: spec.serviceAccountName
-          - name: KUBECONFIG
-            value: /var/run/secrets/remote/config
-          # If you explicitly told us where ztunnel lives, use that.
-          # Otherwise, assume it lives in our namespace
-          # Also, check for an explicit ENV override (legacy approach) and prefer that
-          # if present
-          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
-          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
-          - name: CA_TRUSTED_NODE_ACCOUNTS
-            value: "{{ $ztTrustedNS }}/ztunnel"
-          {{- end }}
-          {{- if .Values.env }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: "{{ $val }}"
-          {{- end }}
-          {{- end }}
-{{- if .Values.traceSampling }}
-          - name: PILOT_TRACE_SAMPLING
-            value: "{{ .Values.traceSampling }}"
-{{- end }}
-# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
-# don't set it here to avoid duplication.
-# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
-{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
-          - name: EXTERNAL_ISTIOD
-            value: "{{ .Values.global.externalIstiod }}"
-{{- end }}
-          - name: PILOT_ENABLE_ANALYSIS
-            value: "{{ .Values.global.istiod.enableAnalysis }}"
-          - name: CLUSTER_ID
-            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
-          - name: GOMEMLIMIT
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.memory
-          - name: GOMAXPROCS
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.cpu
-                divisor: "1"
-          - name: PLATFORM
-            value: "{{ coalesce .Values.global.platform .Values.platform }}"
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-              - ALL
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          volumeMounts:
-          - name: istio-token
-            mountPath: /var/run/secrets/tokens
-            readOnly: true
-          - name: local-certs
-            mountPath: /var/run/secrets/istio-dns
-          - name: cacerts
-            mountPath: /etc/cacerts
-            readOnly: true
-          - name: istio-kubeconfig
-            mountPath: /var/run/secrets/remote
-            readOnly: true
-          {{- if .Values.jwksResolverExtraRootCA }}
-          - name: extracacerts
-            mountPath: /cacerts
-          {{- end }}
-          - name: istio-csr-dns-cert
-            mountPath: /var/run/secrets/istiod/tls
-            readOnly: true
-          - name: istio-csr-ca-configmap
-            mountPath: /var/run/secrets/istiod/ca
-            readOnly: true
-          {{- with .Values.volumeMounts }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-      volumes:
-      # Technically not needed on this pod - but it helps debugging/testing SDS
-      # Should be removed after everything works.
-      - emptyDir:
-          medium: Memory
-        name: local-certs
-      - name: istio-token
-        projected:
-          sources:
-            - serviceAccountToken:
-                audience: {{ .Values.global.sds.token.aud }}
-                expirationSeconds: 43200
-                path: istio-token
-      # Optional: user-generated root
-      - name: cacerts
-        secret:
-          secretName: cacerts
-          optional: true
-      - name: istio-kubeconfig
-        secret:
-          secretName: istio-kubeconfig
-          optional: true
-      # Optional: istio-csr dns pilot certs
-      - name: istio-csr-dns-cert
-        secret:
-          secretName: istiod-tls
-          optional: true
-      - name: istio-csr-ca-configmap
-        configMap:
-          name: istio-ca-root-cert
-          defaultMode: 420
-          optional: true
-  {{- if .Values.jwksResolverExtraRootCA }}
-      - name: extracacerts
-        configMap:
-          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  {{- end }}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
-
----
-{{- end }}
diff --git a/resources/v1.24.2/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.24.2/charts/istiod/templates/istiod-injector-configmap.yaml
deleted file mode 100644
index 560c284ff..000000000
--- a/resources/v1.24.2/charts/istiod/templates/istiod-injector-configmap.yaml
+++ /dev/null
@@ -1,81 +0,0 @@
-{{- if not .Values.global.omitSidecarInjectorConfigMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
-  values: |-
-{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
-{{ $pilotVals := pick .Values "cni" -}}
-{{ $vals = set $vals "pilot" $pilotVals -}}
-{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
-{{ $vals = set $vals "gateways" $gatewayVals -}}
-{{ $vals | toPrettyJson | indent 4 }}
-
-  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
-  # and istiod webhook functionality.
-  #
-  # New fields should not use Values - it is a 'primary' config object, users should be able
-  # to fine tune it or use it with kube-inject.
-  config: |-
-    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
-    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
-    defaultTemplates:
-{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
-    - {{ . }}
-{{- end }}
-    {{- else }}
-    defaultTemplates: [sidecar]
-    {{- end }}
-    policy: {{ .Values.global.proxy.autoInject }}
-    alwaysInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
-    neverInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
-    injectedAnnotations:
-      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
-      "{{ $key }}": {{ $val | quote }}
-      {{- end }}
-    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
-         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
-         This should make it obvious that their installation is broken.
-     */}}
-    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
-    templates:
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
-      sidecar: |
-{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
-      gateway: |
-{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
-      grpc-simple: |
-{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
-      grpc-agent: |
-{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
-      waypoint: |
-{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
-      kube-gateway: |
-{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
-{{- end }}
-{{- with .Values.sidecarInjectorWebhook.templates }}
-{{ toYaml . | trim | indent 6 }}
-{{- end }}
-
-{{- end }}
diff --git a/resources/v1.24.2/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.24.2/charts/istiod/templates/reader-clusterrole.yaml
deleted file mode 100644
index dbaa80503..000000000
--- a/resources/v1.24.2/charts/istiod/templates/reader-clusterrole.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - "config.istio.io"
-      - "security.istio.io"
-      - "networking.istio.io"
-      - "authentication.istio.io"
-      - "rbac.istio.io"
-      - "telemetry.istio.io"
-      - "extensions.istio.io"
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
-    resources: ["gateways"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: ["get", "list", "watch", "create", "delete"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["apps"]
-    resources: ["replicasets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-{{- if .Values.istiodRemote.enabled }}
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-{{- end}}
diff --git a/resources/v1.24.2/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.24.2/charts/istiod/templates/remote-istiod-service.yaml
deleted file mode 100644
index 220277dc0..000000000
--- a/resources/v1.24.2/charts/istiod/templates/remote-istiod-service.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 443
-    targetPort: 15017
-    name: tcp-webhook
-    protocol: TCP
-  {{- if and .Values.global.remotePilotAddress (not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress)) }}
-  # if the remotePilotAddress is not an IP addr, we use ExternalName
-  type: ExternalName
-  externalName: {{ .Values.global.remotePilotAddress }}
-  {{- end }}
-{{- if .Values.global.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.global.ipFamilies }}
-  ipFamilies:
-{{- range .Values.global.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.2/charts/istiod/templates/revision-tags.yaml b/resources/v1.24.2/charts/istiod/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.24.2/charts/istiod/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.2/charts/istiod/templates/zzz_profile.yaml b/resources/v1.24.2/charts/istiod/templates/zzz_profile.yaml
deleted file mode 100644
index 52f665fbd..000000000
--- a/resources/v1.24.2/charts/istiod/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $x := set $.Values "_original" (deepCopy $.Values) }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.2/charts/istiod/values.yaml b/resources/v1.24.2/charts/istiod/values.yaml
deleted file mode 100644
index c9396ee38..000000000
--- a/resources/v1.24.2/charts/istiod/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.24.2
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.24.2/charts/revisiontags/Chart.yaml b/resources/v1.24.2/charts/revisiontags/Chart.yaml
deleted file mode 100644
index 16e742d38..000000000
--- a/resources/v1.24.2/charts/revisiontags/Chart.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.2
-description: Helm chart for istio revision tags
-name: revisiontags
-sources:
-- https://github.com/istio-ecosystem/sail-operator
-version: 0.1.0
-
diff --git a/resources/v1.24.2/charts/revisiontags/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.2/charts/revisiontags/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.2/charts/revisiontags/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.2/charts/revisiontags/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.2/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.2/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.2/charts/revisiontags/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.2/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.2/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.2/charts/revisiontags/files/profile-demo.yaml b/resources/v1.24.2/charts/revisiontags/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.2/charts/revisiontags/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.2/charts/revisiontags/files/profile-platform-k3s.yaml b/resources/v1.24.2/charts/revisiontags/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.2/charts/revisiontags/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.2/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.24.2/charts/revisiontags/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.24.2/charts/revisiontags/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.2/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.24.2/charts/revisiontags/templates/zzz_profile.yaml
deleted file mode 100644
index 52f665fbd..000000000
--- a/resources/v1.24.2/charts/revisiontags/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $x := set $.Values "_original" (deepCopy $.Values) }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.2/charts/revisiontags/values.yaml b/resources/v1.24.2/charts/revisiontags/values.yaml
deleted file mode 100644
index c9396ee38..000000000
--- a/resources/v1.24.2/charts/revisiontags/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.24.2
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.24.2/charts/ztunnel/Chart.yaml b/resources/v1.24.2/charts/ztunnel/Chart.yaml
deleted file mode 100644
index 7cc3ef8ca..000000000
--- a/resources/v1.24.2/charts/ztunnel/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.2
-description: Helm chart for istio ztunnel components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-ztunnel
-- istio
-name: ztunnel
-sources:
-- https://github.com/istio/istio
-version: 1.24.2
diff --git a/resources/v1.24.2/charts/ztunnel/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.2/charts/ztunnel/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.2/charts/ztunnel/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.2/charts/ztunnel/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.2/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.2/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.2/charts/ztunnel/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.2/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.2/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.2/charts/ztunnel/files/profile-demo.yaml b/resources/v1.24.2/charts/ztunnel/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.2/charts/ztunnel/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.2/charts/ztunnel/files/profile-platform-k3s.yaml b/resources/v1.24.2/charts/ztunnel/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.2/charts/ztunnel/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.2/charts/ztunnel/templates/daemonset.yaml b/resources/v1.24.2/charts/ztunnel/templates/daemonset.yaml
deleted file mode 100644
index c6e2daf48..000000000
--- a/resources/v1.24.2/charts/ztunnel/templates/daemonset.yaml
+++ /dev/null
@@ -1,197 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-spec:
-  updateStrategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app: ztunnel
-  template:
-    metadata:
-      labels:
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app: ztunnel
-        app.kubernetes.io/name: ztunnel
-        {{- include "istio.labels" . | nindent 8}}
-{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-{{- if .Values.revision }}
-        istio.io/rev: {{ .Values.revision }}
-{{- end }}
-{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-{{- if .Values.nodeSelector }}
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- if .Values.affinity }}
-      affinity:
-{{ toYaml .Values.affinity | trim | indent 8 }}
-{{- end }}
-      serviceAccountName: ztunnel
-      tolerations:
-        - effect: NoSchedule
-          operator: Exists
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      containers:
-      - name: istio-proxy
-{{- if contains "/" .Values.image }}
-        image: "{{ .Values.image }}"
-{{- else }}
-        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
-{{- end }}
-        ports:
-        - containerPort: 15020
-          name: ztunnel-stats
-          protocol: TCP
-        resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 10 }}
-{{- end }}
-{{- with .Values.imagePullPolicy }}
-        imagePullPolicy: {{ . }}
-{{- end }}
-        securityContext:
-          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
-          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
-          allowPrivilegeEscalation: true
-          privileged: false
-          capabilities:
-            drop:
-            - ALL
-            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
-            - NET_ADMIN # Required for TPROXY and setsockopt
-            - SYS_ADMIN # Required for `setns` - doing things in other netns
-            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
-          readOnlyRootFilesystem: true
-          runAsGroup: 1337
-          runAsNonRoot: false
-          runAsUser: 0
-{{- if .Values.seLinuxOptions }}
-          seLinuxOptions:
-{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
-{{- end }}
-        readinessProbe:
-          httpGet:
-            port: 15021
-            path: /healthz/ready
-        args:
-        - proxy
-        - ztunnel
-        env:
-        - name: CA_ADDRESS
-        {{- if .Values.caAddress }}
-          value: {{ .Values.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: XDS_ADDRESS
-        {{- if .Values.xdsAddress }}
-          value: {{ .Values.xdsAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        {{- if .Values.logAsJson }}
-        - name: LOG_FORMAT
-          value: json
-        {{- end}}
-        - name: RUST_LOG
-          value: {{ .Values.logLevel | quote }}
-        - name: RUST_BACKTRACE
-          value: "1"
-        - name: ISTIO_META_CLUSTER_ID
-          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
-        - name: INPOD_ENABLED
-          value: "true"
-        - name: TERMINATION_GRACE_PERIOD_SECONDS
-          value: "{{ .Values.terminationGracePeriodSeconds }}"
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
-        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        {{- with .Values.env }}
-        {{- range $key, $val := . }}
-        - name: {{ $key }}
-          value: "{{ $val }}"
-        {{- end }}
-        {{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /var/run/ztunnel
-          name: cni-ztunnel-sock-dir
-        - mountPath: /tmp
-          name: tmp
-        {{- with .Values.volumeMounts }}
-          {{- toYaml . | nindent 8 }}
-        {{- end }}
-      priorityClassName: system-node-critical
-      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
-      volumes:
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: istio-ca
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      - name: cni-ztunnel-sock-dir
-        hostPath:
-          path: /var/run/ztunnel
-          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
-      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
-      - name: tmp
-        emptyDir: {}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
diff --git a/resources/v1.24.2/charts/ztunnel/templates/rbac.yaml b/resources/v1.24.2/charts/ztunnel/templates/rbac.yaml
deleted file mode 100644
index 44275dacd..000000000
--- a/resources/v1.24.2/charts/ztunnel/templates/rbac.yaml
+++ /dev/null
@@ -1,72 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-  {{- with .Values.imagePullSecrets }}
-imagePullSecrets:
-  {{- range . }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
----
-{{- if (eq .Values.platform "openshift") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: ztunnel
-  labels:
-    app: ztunnel
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-rules:
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: ztunnel
-  labels:
-    app: ztunnel
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ztunnel
-subjects:
-- kind: ServiceAccount
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-{{- end }}
----
diff --git a/resources/v1.24.2/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.24.2/charts/ztunnel/templates/zzz_profile.yaml
deleted file mode 100644
index 72d3adc53..000000000
--- a/resources/v1.24.2/charts/ztunnel/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.2/charts/ztunnel/values.yaml b/resources/v1.24.2/charts/ztunnel/values.yaml
deleted file mode 100644
index 900ef17d9..000000000
--- a/resources/v1.24.2/charts/ztunnel/values.yaml
+++ /dev/null
@@ -1,98 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
-  hub: gcr.io/istio-release
-  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
-  tag: 1.24.2
-  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
-  variant: ""
-
-  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
-  # If Image contains a "/", it will replace the entire `image` in the pod.
-  image: ztunnel
-
-  # Labels to apply to all top level resources
-  labels: {}
-  # Annotations to apply to all top level resources
-  annotations: {}
-
-  # Additional volumeMounts to the ztunnel container
-  volumeMounts: []
-
-  # Additional volumes to the ztunnel pod
-  volumes: []
-
-  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-
-  # Additional labels to apply on the pod level
-  podLabels: {}
-
-  # Pod resource configuration
-  resources:
-    requests:
-      cpu: 200m
-      # Ztunnel memory scales with the size of the cluster and traffic load
-      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
-      memory: 512Mi
-
-  # List of secret names to add to the service account as image pull secrets
-  imagePullSecrets: []
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
-
-  # Override for the pod imagePullPolicy
-  imagePullPolicy: ""
-
-  # Settings for multicluster
-  multiCluster:
-    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
-    # with Istiod configuration.
-    clusterName: ""
-
-  # meshConfig defines runtime configuration of components.
-  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
-  # components.
-  # TODO: https://github.com/istio/istio/issues/43248
-  meshConfig:
-    defaultConfig:
-      proxyMetadata: {}
-
-  # This value defines:
-  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
-  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
-  # Default K8S value is 30 seconds
-  terminationGracePeriodSeconds: 30
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
-  revision: ""
-
-  # The customized CA address to retrieve certificates for the pods in the cluster.
-  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-  caAddress: ""
-
-  # The customized XDS address to retrieve configuration.
-  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
-  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
-  xdsAddress: ""
-
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
-  istioNamespace: istio-system
-
-  # Configuration log level of ztunnel binary, default is info.
-  # Valid values are: trace, debug, info, warn, error
-  logLevel: info
-
-  # To output all logs in json format
-  logAsJson: false
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seLinuxOptions: {}
-  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
-  #seLinuxOptions:
-  #  type: spc_t
diff --git a/resources/v1.24.2/cni-1.24.2.tgz.etag b/resources/v1.24.2/cni-1.24.2.tgz.etag
deleted file mode 100644
index f8aa707e7..000000000
--- a/resources/v1.24.2/cni-1.24.2.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-941a92b849ba831781bd1cea9b5357f0
diff --git a/resources/v1.24.2/commit b/resources/v1.24.2/commit
deleted file mode 100644
index e4a973f91..000000000
--- a/resources/v1.24.2/commit
+++ /dev/null
@@ -1 +0,0 @@
-1.24.2
diff --git a/resources/v1.24.2/gateway-1.24.2.tgz.etag b/resources/v1.24.2/gateway-1.24.2.tgz.etag
deleted file mode 100644
index bbac8a0dc..000000000
--- a/resources/v1.24.2/gateway-1.24.2.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-89dbdd01dfbf7773d0d9219c1916bca9
diff --git a/resources/v1.24.2/istiod-1.24.2.tgz.etag b/resources/v1.24.2/istiod-1.24.2.tgz.etag
deleted file mode 100644
index d9760cab1..000000000
--- a/resources/v1.24.2/istiod-1.24.2.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-049c4e130b89e0a5ed792fafdbad37e0
diff --git a/resources/v1.24.2/profiles/default.yaml b/resources/v1.24.2/profiles/default.yaml
deleted file mode 100644
index e9e0a3931..000000000
--- a/resources/v1.24.2/profiles/default.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  # Most default values come from the helm chart's values.yaml
-  # Below are the things that differ
-  values:
-    defaultRevision: ""
-    global:
-      istioNamespace: istio-system
-      configValidation: true
diff --git a/resources/v1.24.2/ztunnel-1.24.2.tgz.etag b/resources/v1.24.2/ztunnel-1.24.2.tgz.etag
deleted file mode 100644
index 4b6bd19b6..000000000
--- a/resources/v1.24.2/ztunnel-1.24.2.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-546ed4021ee0dfe8d1d8903085f49db4
diff --git a/resources/v1.24.3/base-1.24.3.tgz.etag b/resources/v1.24.3/base-1.24.3.tgz.etag
deleted file mode 100644
index 0daed4adb..000000000
--- a/resources/v1.24.3/base-1.24.3.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-24dd00360062367ee1393a8cfbfe4d09
diff --git a/resources/v1.24.3/charts/base/Chart.yaml b/resources/v1.24.3/charts/base/Chart.yaml
deleted file mode 100644
index a2dee3ddb..000000000
--- a/resources/v1.24.3/charts/base/Chart.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.3
-description: Helm chart for deploying Istio cluster resources and CRDs
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-name: base
-sources:
-- https://github.com/istio/istio
-version: 1.24.3
diff --git a/resources/v1.24.3/charts/base/files/profile-ambient.yaml b/resources/v1.24.3/charts/base/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.3/charts/base/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.3/charts/base/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.3/charts/base/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.3/charts/base/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.3/charts/base/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.3/charts/base/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.3/charts/base/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.3/charts/base/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.3/charts/base/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.3/charts/base/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.3/charts/base/files/profile-demo.yaml b/resources/v1.24.3/charts/base/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.3/charts/base/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.3/charts/base/files/profile-platform-k3s.yaml b/resources/v1.24.3/charts/base/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.3/charts/base/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.3/charts/base/templates/zzz_profile.yaml b/resources/v1.24.3/charts/base/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.3/charts/base/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.3/charts/base/values.yaml b/resources/v1.24.3/charts/base/values.yaml
deleted file mode 100644
index 98c9c3645..000000000
--- a/resources/v1.24.3/charts/base/values.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  global:
-
-    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-
-    # Used to locate istiod.
-    istioNamespace: istio-system
-
-    # Platform where Istio is deployed. Possible values are: "openshift", "gcp".
-    # An empty value means it is a vanilla Kubernetes distribution, therefore no special
-    # treatment will be considered.
-    platform: ""
-  base:
-    # A list of CRDs to exclude. Requires `enableCRDTemplates` to be true.
-    # Example: `excludedCRDs: ["envoyfilters.networking.istio.io"]`.
-    # Note: when installing with `istioctl`, `enableIstioConfigCRDs=false` must also be set.
-    excludedCRDs: []
-    # Helm (as of V3) does not support upgrading CRDs, because it is not universally
-    # safe for them to support this.
-    # Istio as a project enforces certain backwards-compat guarantees that allow us
-    # to safely upgrade CRDs in spite of this, so we default to self-managing CRDs
-    # as standard K8S resources in Helm, and disable Helm's CRD management. See also:
-    # https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#method-2-separate-charts
-    enableCRDTemplates: true
-
-    # Validation webhook configuration url
-    # For example: https://$remotePilotAddress:15017/validate
-    validationURL: ""
-    # Validation webhook caBundle value. Useful when running pilot with a well known cert
-    validationCABundle: ""
-
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  defaultRevision: "default"
-  experimental:
-    stableValidationPolicy: false
diff --git a/resources/v1.24.3/charts/cni/Chart.yaml b/resources/v1.24.3/charts/cni/Chart.yaml
deleted file mode 100644
index a6b09248b..000000000
--- a/resources/v1.24.3/charts/cni/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.3
-description: Helm chart for istio-cni components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-cni
-- istio
-name: cni
-sources:
-- https://github.com/istio/istio
-version: 1.24.3
diff --git a/resources/v1.24.3/charts/cni/files/profile-ambient.yaml b/resources/v1.24.3/charts/cni/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.3/charts/cni/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.3/charts/cni/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.3/charts/cni/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.3/charts/cni/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.3/charts/cni/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.3/charts/cni/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.3/charts/cni/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.3/charts/cni/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.3/charts/cni/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.3/charts/cni/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.3/charts/cni/files/profile-demo.yaml b/resources/v1.24.3/charts/cni/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.3/charts/cni/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.3/charts/cni/files/profile-platform-k3s.yaml b/resources/v1.24.3/charts/cni/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.3/charts/cni/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.3/charts/cni/templates/clusterrole.yaml b/resources/v1.24.3/charts/cni/templates/clusterrole.yaml
deleted file mode 100644
index f4d4b7754..000000000
--- a/resources/v1.24.3/charts/cni/templates/clusterrole.yaml
+++ /dev/null
@@ -1,77 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: ["security.openshift.io"] 
-  resources: ["securitycontextconstraints"] 
-  resourceNames: ["privileged"] 
-  verbs: ["use"]
-- apiGroups: [""]
-  resources: ["pods","nodes","namespaces"]
-  verbs: ["get", "list", "watch"]
-{{- if (eq ((coalesce .Values.platform .Values.global.platform) | default "") "openshift") }}
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
-{{- end }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-repair-role
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "patch"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["watch", "get", "list"]
-{{- if .Values.repair.repairPods }}
-{{- /*  No privileges needed*/}}
-{{- else if .Values.repair.deletePods }}
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["delete"]
-{{- else if .Values.repair.labelPods }}
-  - apiGroups: [""]
-    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-    resources: ["pods/status"]
-    verbs: ["patch", "update"]
-{{- end }}
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: [""]
-  {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-  resources: ["pods/status"]
-  verbs: ["patch", "update"]
-{{- end }}
diff --git a/resources/v1.24.3/charts/cni/templates/configmap-cni.yaml b/resources/v1.24.3/charts/cni/templates/configmap-cni.yaml
deleted file mode 100644
index 52d612441..000000000
--- a/resources/v1.24.3/charts/cni/templates/configmap-cni.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: {{ template "name" . }}-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  CURRENT_AGENT_VERSION: {{ .Values.tag | default .Values.global.tag | quote }}
-  AMBIENT_ENABLED: {{ .Values.ambient.enabled | quote }}
-  AMBIENT_DNS_CAPTURE: {{ .Values.ambient.dnsCapture | default "false" | quote  }}
-  AMBIENT_IPV6: {{ .Values.ambient.ipv6 | default "false" | quote }}
-  {{- if .Values.cniConfFileName }} # K8S < 1.24 doesn't like empty values
-  CNI_CONF_NAME: {{ .Values.cniConfFileName }} # Name of the CNI config file to create. Only override if you know the exact path your CNI requires..
-  {{- end }}
-  CHAINED_CNI_PLUGIN: {{ .Values.chained | quote }}
-  EXCLUDED_NAMESPACES: "{{ range $idx, $ns := .Values.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
-  REPAIR_ENABLED: {{ .Values.chained | quote }}
-  REPAIR_LABEL_PODS: {{ .Values.repair.labelPods | quote }}
-  REPAIR_DELETE_PODS: {{ .Values.repair.deletePods | quote }}
-  REPAIR_REPAIR_PODS: {{ .Values.repair.repairPods | quote }}
-  REPAIR_INIT_CONTAINER_NAME: {{ .Values.repair.initContainerName | quote }}
-  REPAIR_BROKEN_POD_LABEL_KEY: {{ .Values.repair.brokenPodLabelKey | quote }}
-  REPAIR_BROKEN_POD_LABEL_VALUE: {{ .Values.repair.brokenPodLabelValue | quote }}
-  {{- with .Values.env }}
-  {{- range $key, $val := . }}
-  {{ $key }}: "{{ $val }}"
-  {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.3/charts/cni/templates/daemonset.yaml b/resources/v1.24.3/charts/cni/templates/daemonset.yaml
deleted file mode 100644
index d287dba40..000000000
--- a/resources/v1.24.3/charts/cni/templates/daemonset.yaml
+++ /dev/null
@@ -1,232 +0,0 @@
-# This manifest installs the Istio install-cni container, as well
-# as the Istio CNI plugin and config on
-# each master and worker node in a Kubernetes cluster.
-{{- $defaultBinDir :=
-    (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
-      "/home/kubernetes/bin"
-      "/opt/cni/bin"
-}}
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  name: {{ template "name" . }}-node
-  namespace: {{ .Release.Namespace }}
-  labels:
-    k8s-app: {{ template "name" . }}-node
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  selector:
-    matchLabels:
-      k8s-app: {{ template "name" . }}-node
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  template:
-    metadata:
-      labels:
-        k8s-app: {{ template "name" . }}-node
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: {{ template "name" . }}
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-        # Add Prometheus Scrape annotations
-        prometheus.io/scrape: 'true'
-        prometheus.io/port: "15014"
-        prometheus.io/path: '/metrics'
-        # Add AppArmor annotation
-        # This is required to avoid conflicts with AppArmor profiles which block certain
-        # privileged pod capabilities.
-        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
-        # securityContext which is otherwise preferred.
-        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
-        # Custom annotations
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{if .Values.ambient.enabled }}
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-{{ end }}
-      nodeSelector:
-        kubernetes.io/os: linux
-      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      tolerations:
-        # Make sure istio-cni-node gets scheduled on all nodes.
-        - effect: NoSchedule
-          operator: Exists
-        # Mark the pod as a critical add-on for rescheduling.
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      priorityClassName: system-node-critical
-      serviceAccountName: {{ template "name" . }}
-      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
-      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
-      terminationGracePeriodSeconds: 5
-      containers:
-        # This container installs the Istio CNI binaries
-        # and CNI network config file on each node.
-        - name: install-cni
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
-{{- end }}
-{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
-{{- end }}
-          ports:
-          - containerPort: 15014
-            name: metrics
-            protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8000
-          securityContext:
-            privileged: false
-            runAsGroup: 0
-            runAsUser: 0
-            runAsNonRoot: false
-            # Both ambient and sidecar repair mode require elevated node privileges to function.
-            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
-            # add capabilities based on feature.
-            capabilities:
-              drop:
-              - ALL
-              add:
-              # CAP_NET_ADMIN is required to allow ipset and route table access
-              - NET_ADMIN
-              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
-              - NET_RAW
-              # CAP_SYS_PTRACE is required for repair mode to describe the pod's network namespace
-              # in ambient and repair mode.
-              - SYS_PTRACE
-              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
-              # network namespaces in `/proc` to obtain descriptors for entering pod network
-              # namespaces. There does not appear to be a more granular capability for this.
-              - SYS_ADMIN
-              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
-              # the typical ability to read/write to folders owned by others.
-              # This can cause problems if the hostPath mounts we use, which we require write access into,
-              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
-              - DAC_OVERRIDE
-{{- if .Values.seLinuxOptions }}
-{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
-            seLinuxOptions:
-{{ toYaml . | trim | indent 14 }}
-{{- end }}
-{{- end }}
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          command: ["install-cni"]
-          args:
-            {{- if or .Values.logging.level .Values.global.logging.level }}
-            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
-            {{- end}}
-            {{- if .Values.global.logAsJson }}
-            - --log_as_json
-            {{- end}}
-          envFrom:
-            - configMapRef:
-                name: {{ template "name" . }}-config
-          env:
-            - name: REPAIR_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: REPAIR_RUN_AS_DAEMON
-              value: "true"
-            - name: REPAIR_SIDECAR_ANNOTATION
-              value: "sidecar.istio.io/status"
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  apiVersion: v1
-                  fieldPath: spec.nodeName
-            - name: GOMEMLIMIT
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.memory
-            - name: GOMAXPROCS
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.cpu
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          volumeMounts:
-            - mountPath: /host/opt/cni/bin
-              name: cni-bin-dir
-            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-            - mountPath: /host/proc
-              name: cni-host-procfs
-              readOnly: true
-            {{- end }}
-            - mountPath: /host/etc/cni/net.d
-              name: cni-net-dir
-            - mountPath: /var/run/istio-cni
-              name: cni-socket-dir
-            {{- if .Values.ambient.enabled }}
-            - mountPath: /host/var/run/netns
-              mountPropagation: HostToContainer
-              name: cni-netns-dir
-            - mountPath: /var/run/ztunnel
-              name: cni-ztunnel-sock-dir
-            {{ end }}
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-      volumes:
-        # Used to install CNI.
-        - name: cni-bin-dir
-          hostPath:
-            path: {{ .Values.cniBinDir | default $defaultBinDir }}
-        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-        - name: cni-host-procfs
-          hostPath:
-            path: /proc
-            type: Directory
-        {{- end }}
-        {{- if .Values.ambient.enabled }}
-        - name: cni-ztunnel-sock-dir
-          hostPath:
-            path: /var/run/ztunnel
-            type: DirectoryOrCreate
-        {{- end }}
-        - name: cni-net-dir
-          hostPath:
-            path: {{ default "/etc/cni/net.d" .Values.cniConfDir }}
-        # Used for UDS sockets for logging, ambient eventing
-        - name: cni-socket-dir
-          hostPath:
-            path: /var/run/istio-cni
-        - name: cni-netns-dir
-          hostPath:
-            path: {{ .Values.cniNetnsDir | default "/var/run/netns" }}
-            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
-            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
-            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.24.3/charts/cni/templates/zzz_profile.yaml b/resources/v1.24.3/charts/cni/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.3/charts/cni/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.3/charts/cni/values.yaml b/resources/v1.24.3/charts/cni/values.yaml
deleted file mode 100644
index 5f35575ab..000000000
--- a/resources/v1.24.3/charts/cni/values.yaml
+++ /dev/null
@@ -1,149 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  hub: ""
-  tag: ""
-  variant: ""
-  image: install-cni
-  pullPolicy: ""
-
-  # Same as `global.logging.level`, but will override it if set
-  logging:
-    level: ""
-
-  # Configuration file to insert istio-cni plugin configuration
-  # by default this will be the first file found in the cni-conf-dir
-  # Example
-  # cniConfFileName: 10-calico.conflist
-
-  # CNI bin and conf dir override settings
-  # defaults:
-  cniBinDir: "" # Auto-detected based on version; defaults to /opt/cni/bin.
-  cniConfDir: /etc/cni/net.d
-  cniConfFileName: ""
-  # This directory must exist on the node, if it does not, consult your container runtime
-  # documentation for the appropriate path.
-  cniNetnsDir: # Defaults to '/var/run/netns', in minikube/docker/others can be '/var/run/docker/netns'.
-
-
-  excludeNamespaces:
-    - kube-system
-
-  # Allows user to set custom affinity for the DaemonSet
-  affinity: {}
-
-  # Custom annotations on pod level, if you need them
-  podAnnotations: {}
-
-  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
-  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
-  chained: true
-
-  # Custom configuration happens based on the CNI provider.
-  # Possible values: "default", "multus"
-  provider: "default"
-
-  # Configure ambient settings
-  ambient:
-    # If enabled, ambient redirection will be enabled
-    enabled: false
-    # Set ambient config dir path: defaults to /etc/ambient-config
-    configDir: ""
-    # If enabled, and ambient is enabled, DNS redirection will be enabled
-    dnsCapture: false
-    # If enabled, and ambient is enabled, enables ipv6 support
-    ipv6: true
-
-
-  repair:
-    enabled: true
-    hub: ""
-    tag: ""
-
-    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
-    # This defines the action the controller will take when a pod is detected as broken.
-
-    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
-    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
-    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
-    labelPods: false
-    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
-    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
-    deletePods: false
-    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
-    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
-    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
-    repairPods: true
-
-    initContainerName: "istio-validation"
-
-    brokenPodLabelKey: "cni.istio.io/uninitialized"
-    brokenPodLabelValue: "true"
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
-  seLinuxOptions: {}
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 100Mi
-
-  resourceQuotas:
-    enabled: false
-    pods: 5000
-
-  # The number of pods that can be unavailable during rolling update (see
-  # `updateStrategy.rollingUpdate.maxUnavailable` here:
-  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
-  # May be specified as a number of pods or as a percent of the total number
-  # of pods at the start of the update.
-  rollingMaxUnavailable: 1
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  global:
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-
-    # Default tag for Istio images.
-    tag: 1.24.3
-
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # change cni scope level to control logging out of istio-cni-node DaemonSet
-    logging:
-      level: info
-
-    logAsJson: false
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Default resources allocated
-    defaultResources:
-      requests:
-        cpu: 100m
-        memory: 100Mi
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
diff --git a/resources/v1.24.3/charts/gateway/Chart.yaml b/resources/v1.24.3/charts/gateway/Chart.yaml
deleted file mode 100644
index 0238a7893..000000000
--- a/resources/v1.24.3/charts/gateway/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.3
-description: Helm chart for deploying Istio gateways
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- gateways
-name: gateway
-sources:
-- https://github.com/istio/istio
-type: application
-version: 1.24.3
diff --git a/resources/v1.24.3/charts/gateway/files/profile-ambient.yaml b/resources/v1.24.3/charts/gateway/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.3/charts/gateway/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.3/charts/gateway/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.3/charts/gateway/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.3/charts/gateway/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.3/charts/gateway/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.3/charts/gateway/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.3/charts/gateway/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.3/charts/gateway/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.3/charts/gateway/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.3/charts/gateway/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.3/charts/gateway/files/profile-demo.yaml b/resources/v1.24.3/charts/gateway/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.3/charts/gateway/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.3/charts/gateway/files/profile-platform-k3s.yaml b/resources/v1.24.3/charts/gateway/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.3/charts/gateway/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.3/charts/gateway/templates/deployment.yaml b/resources/v1.24.3/charts/gateway/templates/deployment.yaml
deleted file mode 100644
index 9db59d8b9..000000000
--- a/resources/v1.24.3/charts/gateway/templates/deployment.yaml
+++ /dev/null
@@ -1,128 +0,0 @@
-apiVersion: apps/v1
-kind: {{ .Values.kind | default "Deployment" }}
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  {{- with .Values.replicaCount }}
-  replicas: {{ . }}
-  {{- end }}
-  {{- end }}
-  {{- with .Values.strategy }}
-  strategy:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.minReadySeconds }}
-  minReadySeconds: {{ . }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "gateway.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
-        {{- include "gateway.selectorLabels" . | nindent 8 }}
-        app.kubernetes.io/name: {{ include "gateway.name" . }}
-        {{- include "istio.labels" .  | nindent 8}}
-        {{- range $key, $val := .Values.labels }}
-        {{- if and (ne $key "app") (ne $key "istio") }}
-        {{ $key | quote }}: {{ $val | quote }}
-        {{- end }}
-        {{- end }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
-      securityContext:
-      {{- if .Values.securityContext }}
-        {{- toYaml .Values.securityContext | nindent 8 }}
-      {{- else }}
-        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- end }}
-      {{- with .Values.volumes }}
-      volumes:
-        {{ toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: istio-proxy
-          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
-          image: auto
-          {{- with .Values.imagePullPolicy }}
-          imagePullPolicy: {{ . }}
-          {{- end }}
-          securityContext:
-          {{- if .Values.containerSecurityContext }}
-            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          {{- else }}
-            capabilities:
-              drop:
-              - ALL
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            {{- if not (eq (.Values.platform | default "") "openshift") }}
-            runAsUser: 1337
-            runAsGroup: 1337
-            {{- end }}
-            runAsNonRoot: true
-          {{- end }}
-          env:
-          {{- with .Values.networkGateway }}
-          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-            value: "{{.}}"
-          {{- end }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: {{ $val | quote }}
-          {{- end }}
-          ports:
-          - containerPort: 15090
-            protocol: TCP
-            name: http-envoy-prom
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          {{- with .Values.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.readinessProbe }}
-          readinessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
-      {{- with .Values.priorityClassName }}
-      priorityClassName: {{ . }}
-      {{- end }}
diff --git a/resources/v1.24.3/charts/gateway/templates/service.yaml b/resources/v1.24.3/charts/gateway/templates/service.yaml
deleted file mode 100644
index 25ce3bcb0..000000000
--- a/resources/v1.24.3/charts/gateway/templates/service.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-{{- if not (eq .Values.service.type "None") }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-    {{- with .Values.networkGateway }}
-    topology.istio.io/network: "{{.}}"
-    {{- end }}
-  annotations:
-    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
-spec:
-{{- with .Values.service.loadBalancerIP }}
-  loadBalancerIP: "{{ . }}"
-{{- end }}
-{{- if eq .Values.service.type "LoadBalancer" }}
-  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
-  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
-  {{- end }}
-{{- end }}
-{{- if .Values.service.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.service.ipFamilies }}
-  ipFamilies:
-{{- range .Values.service.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
-{{- with .Values.service.loadBalancerSourceRanges }}
-  loadBalancerSourceRanges:
-{{ toYaml . | indent 4 }}
-{{- end }}
-{{- with .Values.service.externalTrafficPolicy }}
-  externalTrafficPolicy: "{{ . }}"
-{{- end }}
-  type: {{ .Values.service.type }}
-  ports:
-{{- if .Values.networkGateway }}
-  - name: status-port
-    port: 15021
-    targetPort: 15021
-  - name: tls
-    port: 15443
-    targetPort: 15443
-  - name: tls-istiod
-    port: 15012
-    targetPort: 15012
-  - name: tls-webhook
-    port: 15017
-    targetPort: 15017
-{{- else }}
-{{ .Values.service.ports | toYaml | indent 4 }}
-{{- end }}
-{{- if .Values.service.externalIPs }}
-  externalIPs: {{- range .Values.service.externalIPs }}
-    - {{.}}
-  {{- end }}
-{{- end }}
-  selector:
-    {{- include "gateway.selectorLabels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.24.3/charts/gateway/templates/zzz_profile.yaml b/resources/v1.24.3/charts/gateway/templates/zzz_profile.yaml
deleted file mode 100644
index 72d3adc53..000000000
--- a/resources/v1.24.3/charts/gateway/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.3/charts/gateway/values.schema.json b/resources/v1.24.3/charts/gateway/values.schema.json
deleted file mode 100644
index 3fdaa2730..000000000
--- a/resources/v1.24.3/charts/gateway/values.schema.json
+++ /dev/null
@@ -1,330 +0,0 @@
-{
-  "$schema": "http://json-schema.org/schema#",
-  "$defs": {
-    "values": {
-      "type": "object",
-      "properties": {
-        "global": {
-          "type": "object"
-        },
-        "affinity": {
-          "type": "object"
-        },
-        "securityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "containerSecurityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "kind": {
-          "type": "string",
-          "enum": [
-            "Deployment",
-            "DaemonSet"
-          ]
-        },
-        "annotations": {
-          "additionalProperties": {
-            "type": [
-              "string",
-              "integer"
-            ]
-          },
-          "type": "object"
-        },
-        "autoscaling": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            },
-            "maxReplicas": {
-              "type": "integer"
-            },
-            "minReplicas": {
-              "type": "integer"
-            },
-            "targetCPUUtilizationPercentage": {
-              "type": "integer"
-            }
-          }
-        },
-        "env": {
-          "type": "object"
-        },
-        "strategy": {
-          "type": "object"
-        },
-        "minReadySeconds": {
-          "type": [
-            "null",
-            "integer"
-          ]
-        },
-        "readinessProbe": {
-          "type": [
-            "null",
-            "object"
-          ]
-        },
-        "labels": {
-          "type": "object"
-        },
-        "name": {
-          "type": "string"
-        },
-        "nodeSelector": {
-          "type": "object"
-        },
-        "podAnnotations": {
-          "type": "object",
-          "properties": {
-            "inject.istio.io/templates": {
-              "type": "string"
-            },
-            "prometheus.io/path": {
-              "type": "string"
-            },
-            "prometheus.io/port": {
-              "type": "string"
-            },
-            "prometheus.io/scrape": {
-              "type": "string"
-            }
-          }
-        },
-        "replicaCount": {
-          "type": [
-            "integer",
-            "null"
-          ]
-        },
-        "resources": {
-          "type": "object",
-          "properties": {
-            "limits": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            },
-            "requests": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            }
-          }
-        },
-        "revision": {
-          "type": "string"
-        },
-        "compatibilityVersion": {
-          "type": "string"
-        },
-        "runAsRoot": {
-          "type": "boolean"
-        },
-        "unprivilegedPort": {
-          "type": [
-            "string",
-            "boolean"
-          ],
-          "enum": [
-            true,
-            false,
-            "auto"
-          ]
-        },
-        "service": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "externalTrafficPolicy": {
-              "type": "string"
-            },
-            "loadBalancerIP": {
-              "type": "string"
-            },
-            "loadBalancerSourceRanges": {
-              "type": "array"
-            },
-            "ipFamilies": {
-              "items": {
-                "type": "string",
-                "enum": [
-                  "IPv4",
-                  "IPv6"
-                ]
-              }
-            },
-            "ipFamilyPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "SingleStack",
-                "PreferDualStack",
-                "RequireDualStack"
-              ]
-            },
-            "ports": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string"
-                  },
-                  "port": {
-                    "type": "integer"
-                  },
-                  "protocol": {
-                    "type": "string"
-                  },
-                  "targetPort": {
-                    "type": "integer"
-                  }
-                }
-              }
-            },
-            "type": {
-              "type": "string"
-            }
-          }
-        },
-        "serviceAccount": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "name": {
-              "type": "string"
-            },
-            "create": {
-              "type": "boolean"
-            }
-          }
-        },
-        "rbac": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            }
-          }
-        },
-        "tolerations": {
-          "type": "array"
-        },
-        "topologySpreadConstraints": {
-          "type": "array"
-        },
-        "networkGateway": {
-          "type": "string"
-        },
-        "imagePullPolicy": {
-          "type": "string",
-          "enum": [
-            "",
-            "Always",
-            "IfNotPresent",
-            "Never"
-          ]
-        },
-        "imagePullSecrets": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "name": {
-                "type": "string"
-              }
-            }
-          }
-        },
-        "podDisruptionBudget": {
-          "type": "object",
-          "properties": {
-            "minAvailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "maxUnavailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "unhealthyPodEvictionPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "IfHealthyBudget",
-                "AlwaysAllow"
-              ]
-            }
-          }
-        },
-        "terminationGracePeriodSeconds": {
-          "type": "number"
-        },
-        "volumes": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "volumeMounts": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "priorityClassName": {
-          "type": "string"
-        },
-        "_internal_defaults_do_not_set": {
-          "type": "object"
-        }
-      },
-      "additionalProperties": false
-    }
-  },
-  "defaults": {
-    "$ref": "#/$defs/values"
-  },
-  "$ref": "#/$defs/values"
-}
diff --git a/resources/v1.24.3/charts/gateway/values.yaml b/resources/v1.24.3/charts/gateway/values.yaml
deleted file mode 100644
index b02240df1..000000000
--- a/resources/v1.24.3/charts/gateway/values.yaml
+++ /dev/null
@@ -1,166 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Name allows overriding the release name. Generally this should not be set
-  name: ""
-  # revision declares which revision this gateway is a part of
-  revision: ""
-
-  # Controls the spec.replicas setting for the Gateway deployment if set.
-  # Otherwise defaults to Kubernetes Deployment default (1).
-  replicaCount:
-
-  kind: Deployment
-
-  rbac:
-    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
-    # when using http://gateway-api.org/.
-    enabled: true
-
-  serviceAccount:
-    # If set, a service account will be created. Otherwise, the default is used
-    create: true
-    # Annotations to add to the service account
-    annotations: {}
-    # The name of the service account to use.
-    # If not set, the release name is used
-    name: ""
-
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/stats/prometheus"
-    inject.istio.io/templates: "gateway"
-    sidecar.istio.io/inject: "true"
-
-  # Define the security context for the pod.
-  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-  securityContext: {}
-  containerSecurityContext: {}
-
-  service:
-    # Type of service. Set to "None" to disable the service entirely
-    type: LoadBalancer
-    ports:
-    - name: status-port
-      port: 15021
-      protocol: TCP
-      targetPort: 15021
-    - name: http2
-      port: 80
-      protocol: TCP
-      targetPort: 80
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
-    annotations: {}
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    externalTrafficPolicy: ""
-    externalIPs: []
-    ipFamilyPolicy: ""
-    ipFamilies: []
-    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
-    # allocateLoadBalancerNodePorts: false
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: 2000m
-      memory: 1024Mi
-
-  autoscaling:
-    enabled: true
-    minReplicas: 1
-    maxReplicas: 5
-    targetCPUUtilizationPercentage: 80
-    targetMemoryUtilizationPercentage: {}
-    autoscaleBehavior: {}
-
-  # Pod environment variables
-  env: {}
-
-  # Deployment Update strategy
-  strategy: {}
-  
-  # Sets the Deployment minReadySeconds value
-  minReadySeconds:
-  
-  # Optionally configure a custom readinessProbe. By default the control plane
-  # automatically injects the readinessProbe. If you wish to override that
-  # behavior, you may define your own readinessProbe here.
-  readinessProbe: {}
-
-  # Labels to apply to all resources
-  labels: {}
-
-  # Annotations to apply to all resources
-  annotations: {}
-
-  nodeSelector: {}
-
-  tolerations: []
-
-  topologySpreadConstraints: []
-
-  affinity: {}
-
-  # If specified, the gateway will act as a network gateway for the given network.
-  networkGateway: ""
-
-  # Specify image pull policy if default behavior isn't desired.
-  # Default behavior: latest images will be Always else IfNotPresent
-  imagePullPolicy: ""
-
-  imagePullSecrets: []
-
-  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
-  #
-  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
-  # which means that no PodDisruptionBudget resource will be created.
-  #
-  # To enable the PodDisruptionBudget, configure it by specifying the
-  # `minAvailable` or `maxUnavailable`. For example, to set the
-  # minimum number of available replicas to 1, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #
-  # Or, to allow a maximum of 1 unavailable replica, you can set:
-  #
-  # podDisruptionBudget:
-  #   maxUnavailable: 1
-  #
-  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
-  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #   unhealthyPodEvictionPolicy: AlwaysAllow
-  #
-  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
-  #
-  # podDisruptionBudget: {}
-  #
-  podDisruptionBudget: {}
-
-  # Sets the per-pod terminationGracePeriodSeconds setting.
-  terminationGracePeriodSeconds: 30
-
-  # A list of `Volumes` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumes: []
-
-  # A list of `VolumeMounts` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumeMounts: []
-
-  # Configure this to a higher priority class in order to make sure your Istio gateway pods
-  # will not be killed because of low priority class.
-  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-  # for more detail.
-  priorityClassName: ""
diff --git a/resources/v1.24.3/charts/istiod/Chart.yaml b/resources/v1.24.3/charts/istiod/Chart.yaml
deleted file mode 100644
index aee79d4b3..000000000
--- a/resources/v1.24.3/charts/istiod/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.3
-description: Helm chart for istio control plane
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- istiod
-- istio-discovery
-name: istiod
-sources:
-- https://github.com/istio/istio
-version: 1.24.3
diff --git a/resources/v1.24.3/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.24.3/charts/istiod/files/gateway-injection-template.yaml
deleted file mode 100644
index 97ffb71f2..000000000
--- a/resources/v1.24.3/charts/istiod/files/gateway-injection-template.yaml
+++ /dev/null
@@ -1,250 +0,0 @@
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if eq (len $containers) 1 }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{ end }}
-  }
-spec:
-  securityContext:
-  {{- if .Values.gateways.securityContext }}
-    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
-  {{- else }}
-    sysctls:
-    - name: net.ipv4.ip_unprivileged_port_start
-      value: "0"
-  {{- end }}
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - router
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- end }}
-    securityContext:
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-    env:
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-  volumes:
-  - emptyDir: {}
-    name: workload-socket
-  - emptyDir: {}
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else}}
-  - emptyDir: {}
-    name: workload-certs
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.3/charts/istiod/files/grpc-agent.yaml b/resources/v1.24.3/charts/istiod/files/grpc-agent.yaml
deleted file mode 100644
index 7290fcdca..000000000
--- a/resources/v1.24.3/charts/istiod/files/grpc-agent.yaml
+++ /dev/null
@@ -1,310 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-    sidecar.istio.io/rewriteAppHTTPProbers: "false",
-  }
-spec:
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15020
-      protocol: TCP
-      name: mesh-metrics
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-          - --url=http://localhost:15020/healthz/ready
-    env:
-    - name: ISTIO_META_GENERATOR
-      value: grpc
-    - name: OUTPUT_CERTS
-      value: /var/lib/istio/data
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    # grpc uses xds:/// to resolve – no need to resolve VIP
-    - name: ISTIO_META_DNS_CAPTURE
-      value: "false"
-    - name: DISABLE_ENVOY
-      value: "true"
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15020
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # UDS channel between istioagent and gRPC client for XDS/SDS
-    - mountPath: /etc/istio/proxy
-      name: istio-xds
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-{{- range $index, $container := .Spec.Containers  }}
-{{ if not (eq $container.Name "istio-proxy") }}
-  - name: {{ $container.Name }}
-    env:
-      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
-        value: "true"
-      - name: "GRPC_XDS_BOOTSTRAP"
-        value: "/etc/istio/proxy/grpc-bootstrap.json"
-    volumeMounts:
-      - mountPath: /var/lib/istio/data
-        name: istio-data
-      # UDS channel between istioagent and gRPC client for XDS/SDS
-      - mountPath: /etc/istio/proxy
-        name: istio-xds
-      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-        readOnly: true
-      {{- else }}
-      - name: workload-certs
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-      {{- end }}
-{{- end }}
-{{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-xds
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.3/charts/istiod/files/injection-template.yaml b/resources/v1.24.3/charts/istiod/files/injection-template.yaml
deleted file mode 100644
index 0ef948e6a..000000000
--- a/resources/v1.24.3/charts/istiod/files/injection-template.yaml
+++ /dev/null
@@ -1,510 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
-    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
-    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
-    {{- end }}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-{{- if .Values.pilot.cni.enabled }}
-    {{- if eq .Values.pilot.cni.provider "multus" }}
-    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
-    {{- end }}
-    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}traffic.sidecar.istio.io/includeInboundPorts: "{{.}}",{{ end }}
-    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
-    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
-    {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
-    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
-    {{- end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
-{{- end }}
-  }
-spec:
-  {{- $holdProxy := and
-      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
-      (not $nativeSidecar) }}
-  initContainers:
-  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
-  {{ if .Values.pilot.cni.enabled -}}
-  - name: istio-validation
-  {{ else -}}
-  - name: istio-init
-  {{ end -}}
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    args:
-    - istio-iptables
-    - "-p"
-    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
-    - "-z"
-    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
-    - "-u"
-    - {{ .ProxyUID | default "1337" | quote }}
-    - "-m"
-    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
-    - "-i"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
-    - "-x"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
-    - "-b"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
-    - "-d"
-  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
-    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
-  {{- else }}
-    - "15090,15021"
-  {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
-    - "-q"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
-    {{ end -}}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
-    - "-o"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
-    {{ end -}}
-     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
-    - "-c"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
-    {{ end -}}
-    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
-    {{ if .Values.global.logAsJson -}}
-    - "--log_as_json"
-    {{ end -}}
-    {{ if .Values.pilot.cni.enabled -}}
-    - "--run-validation"
-    - "--skip-rule-apply"
-    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
-    - "--force-apply"
-    {{ end -}}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-  {{- if .ProxyConfig.ProxyMetadata }}
-    env:
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-  {{- end }}
-    resources:
-  {{ template "resources" . }}
-    securityContext:
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      privileged: {{ .Values.global.proxy.privileged }}
-      capabilities:
-    {{- if not .Values.pilot.cni.enabled }}
-        add:
-        - NET_ADMIN
-        - NET_RAW
-    {{- end }}
-        drop:
-        - ALL
-    {{- if not .Values.pilot.cni.enabled }}
-      readOnlyRootFilesystem: false
-      runAsGroup: 0
-      runAsNonRoot: false
-      runAsUser: 0
-    {{- else }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsNonRoot: true
-    {{- end }}
-  {{ end -}}
-  {{ if not $nativeSidecar }}
-  containers:
-  {{ end }}
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.outlierLogPath }}
-    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-  {{- end}}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- else if $holdProxy }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-  {{- else if $nativeSidecar }}
-    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
-    lifecycle:
-      preStop:
-        exec:
-          command:
-          - pilot-agent
-          - request
-          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
-          - POST
-          - drain
-  {{- end }}
-    env:
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - name: ISTIO_BOOTSTRAP_OVERRIDE
-      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
-    {{- end }}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-  {{ if .Values.global.proxy.startupProbe.enabled }}
-    startupProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: 0
-      periodSeconds: 1
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
-  {{ end }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    {{ end -}}
-    securityContext:
-      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
-      allowPrivilegeEscalation: true
-      capabilities:
-        add:
-        - NET_ADMIN
-        drop:
-        - ALL
-      privileged: true
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else }}
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      capabilities:
-        {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-        add:
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
-        - NET_ADMIN
-        {{- end }}
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
-        - NET_BIND_SERVICE
-        {{- end }}
-        {{- end }}
-        drop:
-        - ALL
-      privileged: {{ .Values.global.proxy.privileged }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else -}}
-      runAsNonRoot: true
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      {{- end }}
-      {{- end }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - mountPath: /etc/istio/custom-bootstrap
-      name: custom-bootstrap-volume
-    {{- end }}
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
-      name: lightstep-certs
-      readOnly: true
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  - emptyDir:
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-  - name: lightstep-certs
-    secret:
-      optional: true
-      secretName: lightstep.cacert
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.3/charts/istiod/files/kube-gateway.yaml b/resources/v1.24.3/charts/istiod/files/kube-gateway.yaml
deleted file mode 100644
index dbe158de1..000000000
--- a/resources/v1.24.3/charts/istiod/files/kube-gateway.yaml
+++ /dev/null
@@ -1,345 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-gateway-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": {{.Name}}
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-gateway-controller"
-          ) | nindent 8 }}
-    spec:
-      securityContext:
-      {{- if .Values.gateways.securityContext }}
-        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
-      {{- else }}
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- if .Values.gateways.seccompProfile }}
-        seccompProfile:
-      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
-      {{- end }}
-      {{- end }}
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-      {{- else }}
-        image: "{{ .ProxyImage }}"
-      {{- end }}
-        {{- if .Values.global.proxy.resources }}
-        resources:
-          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsUser: {{ .ProxyUID | default "1337" }}
-          runAsGroup: {{ .ProxyGID | default "1337" }}
-          runAsNonRoot: true
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        args:
-        - proxy
-        - router
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-      {{- if .Values.global.sts.servicePort }}
-        - --stsPort={{ .Values.global.sts.servicePort }}
-      {{- end }}
-      {{- if .Values.global.logAsJson }}
-        - --log_as_json
-      {{- end }}
-      {{- if .Values.global.proxy.lifecycle }}
-        lifecycle:
-          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
-      {{- end }}
-        env:
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        - name: ISTIO_META_POD_PORTS
-          value: "[]"
-        - name: ISTIO_META_APP_CONTAINERS
-          value: ""
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: "{{ .ProxyConfig.InterceptionMode.String }}"
-        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
-        - name: ISTIO_META_NETWORK
-          value: {{.|quote}}
-        {{- end }}
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName|quote}}
-        - name: ISTIO_META_OWNER
-          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
-        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-          value: {{.|quote}}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        volumeMounts:
-        - name: workload-socket
-          mountPath: /var/run/secrets/workload-spiffe-uds
-        - name: credential-socket
-          mountPath: /var/run/secrets/credential-uds
-        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-        - name: gke-workload-certificate
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-          readOnly: true
-        {{- else }}
-        - name: workload-certs
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-        {{- end }}
-        {{- if eq .Values.global.pilotCertProvider "istiod" }}
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        {{- end }}
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        # SDS channel between istioagent and Envoy
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - name: istio-podinfo
-          mountPath: /etc/istio/pod
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir: {}
-        name: credential-socket
-      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        csi:
-          driver: workloadcertificates.security.cloud.google.com
-      {{- else}}
-      - emptyDir: {}
-        name: workload-certs
-      {{- end }}
-      # SDS channel between istioagent and Envoy
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - name: istio-data
-        emptyDir: {}
-      - name: istio-podinfo
-        downwardAPI:
-          items:
-            - path: "labels"
-              fieldRef:
-                fieldPath: metadata.labels
-            - path: "annotations"
-              fieldRef:
-                fieldPath: metadata.annotations
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: {{ .Values.global.sds.token.aud }}
-      {{- if eq .Values.global.pilotCertProvider "istiod" }}
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: {{.UID}}
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": {{.Name}}
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.24.3/charts/istiod/files/profile-ambient.yaml b/resources/v1.24.3/charts/istiod/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.3/charts/istiod/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.3/charts/istiod/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.3/charts/istiod/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.3/charts/istiod/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.3/charts/istiod/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.3/charts/istiod/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.3/charts/istiod/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.3/charts/istiod/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.3/charts/istiod/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.3/charts/istiod/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.3/charts/istiod/files/profile-demo.yaml b/resources/v1.24.3/charts/istiod/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.3/charts/istiod/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.3/charts/istiod/files/profile-platform-k3s.yaml b/resources/v1.24.3/charts/istiod/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.3/charts/istiod/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.3/charts/istiod/files/waypoint.yaml b/resources/v1.24.3/charts/istiod/files/waypoint.yaml
deleted file mode 100644
index 07a420878..000000000
--- a/resources/v1.24.3/charts/istiod/files/waypoint.yaml
+++ /dev/null
@@ -1,336 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-mesh-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": "{{.Name}}"
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "istio.io/dataplane-mode" "none"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-mesh-controller"
-          ) | nindent 8}}
-    spec:
-      {{- if .Values.global.waypoint.affinity }}
-      affinity:
-      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.topologySpreadConstraints }}
-      topologySpreadConstraints:
-      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.nodeSelector }}
-      nodeSelector:
-      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.tolerations }}
-      tolerations:
-      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: 2
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-        {{- else }}
-        image: "{{ .ProxyImage }}"
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        args:
-        - proxy
-        - waypoint
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --serviceCluster
-        - {{.ServiceAccount}}.$(POD_NAMESPACE)
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-        {{- if .Values.global.logAsJson }}
-        - --log_as_json
-        {{- end }}
-        {{- if .Values.global.proxy.outlierLogPath }}
-        - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-        {{- end}}
-        env:
-        - name: ISTIO_META_SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        {{- if .ProxyConfig.ProxyMetadata }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
-        {{- if $network }}
-        - name: ISTIO_META_NETWORK
-          value: "{{ $network }}"
-        {{- end }}
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: REDIRECT
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName}}
-        - name: ISTIO_META_OWNER
-          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- if .Values.global.waypoint.resources }}
-        resources:
-        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        securityContext:
-          privileged: false
-        {{- if not (eq .Values.global.platform "openshift") }}
-          runAsGroup: 1337
-          runAsUser: 1337
-        {{- end }}
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-            - ALL
-{{- if .Values.gateways.seccompProfile }}
-          seccompProfile:
-{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
-{{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/workload-spiffe-uds
-          name: workload-socket
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /etc/istio/pod
-          name: istio-podinfo
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - emptyDir:
-          medium: Memory
-        name: go-proxy-envoy
-      - emptyDir: {}
-        name: istio-data
-      - emptyDir: {}
-        name: go-proxy-data
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.labels
-            path: labels
-          - fieldRef:
-              fieldPath: metadata.annotations
-            path: annotations
-        name: istio-podinfo
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              audience: istio-ca
-              expirationSeconds: 43200
-              path: istio-token
-      - configMap:
-          name: istio-ca-root-cert
-        name: istiod-ca-cert
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap
-      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
-      (omit .InfrastructureAnnotations
-        "kubectl.kubernetes.io/last-applied-configuration"
-        "gateway.istio.io/name-override"
-        "gateway.istio.io/service-account"
-        "gateway.istio.io/controller-version"
-      ) | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": "{{.Name}}"
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.24.3/charts/istiod/templates/autoscale.yaml b/resources/v1.24.3/charts/istiod/templates/autoscale.yaml
deleted file mode 100644
index 09cd6258c..000000000
--- a/resources/v1.24.3/charts/istiod/templates/autoscale.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if and .Values.autoscaleEnabled .Values.autoscaleMin .Values.autoscaleMax }}
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  maxReplicas: {{ .Values.autoscaleMax }}
-  minReplicas: {{ .Values.autoscaleMin }}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  metrics:
-  - type: Resource
-    resource:
-      name: cpu
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.cpu.targetAverageUtilization }}
-  {{- if .Values.memory.targetAverageUtilization }}
-  - type: Resource
-    resource:
-      name: memory
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.memory.targetAverageUtilization }}
-  {{- end }}
-  {{- if .Values.autoscaleBehavior }}
-  behavior: {{ toYaml .Values.autoscaleBehavior | nindent 4 }}
-  {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/clusterrole.yaml b/resources/v1.24.3/charts/istiod/templates/clusterrole.yaml
deleted file mode 100644
index 0c340b5b3..000000000
--- a/resources/v1.24.3/charts/istiod/templates/clusterrole.yaml
+++ /dev/null
@@ -1,187 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  # sidecar injection controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-
-  # configuration validation webhook controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-
-  # istio configuration
-  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
-  # please proceed with caution
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["get", "watch", "list"]
-    resources: ["*"]
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["update", "patch"]
-    resources:
-    - authorizationpolicies/status
-    - destinationrules/status
-    - envoyfilters/status
-    - gateways/status
-    - peerauthentications/status
-    - proxyconfigs/status
-    - requestauthentications/status
-    - serviceentries/status
-    - sidecars/status
-    - telemetries/status
-    - virtualservices/status
-    - wasmplugins/status
-    - workloadentries/status
-    - workloadgroups/status
-{{- end }}
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries/status",  "serviceentries/status" ]
-  - apiGroups: ["security.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "authorizationpolicies/status" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services/status" ]
-
-  # auto-detect installed CRD definitions
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-
-  # discovery and routing
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-
-{{- if .Values.taint.enabled }}
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["patch"]
-{{- end }}
-
-  # ingress controller
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-{{- end}}
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses", "ingressclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-
-  # required for CA's namespace controller
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-
-  # Istiod and bootstrap.
-{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
-{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "certificatesigningrequests"
-      - "certificatesigningrequests/approval"
-      - "certificatesigningrequests/status"
-    verbs: ["update", "create", "get", "delete", "watch"]
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "signers"
-    resourceNames:
-{{- range .Values.global.certSigners }}
-    - {{ . | quote }}
-{{- end }}
-    verbs: ["approve"]
-{{- end}}
-
-  # Used by Istiod to verify the JWT tokens
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-
-  # Used by Istiod to verify gateway SDS
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-
-  # Use for Kubernetes Service APIs
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources:
-    - backendtlspolicies/status
-    - gatewayclasses/status
-    - gateways/status
-    - grpcroutes/status
-    - httproutes/status
-    - referencegrants/status
-    - tcproutes/status
-    - tlsroutes/status
-    - udproutes/status
-    verbs: ["update", "patch"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["gatewayclasses"]
-    verbs: ["create", "update", "patch", "delete"]
-
-  # Needed for multicluster secret reading, possibly ingress certs in the future
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "watch", "list"]
-
-  # Used for MCS serviceexport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: [ "get", "watch", "list", "create", "delete"]
-
-  # Used for MCS serviceimport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "watch", "list"]
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: ["apps"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "deployments" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "serviceaccounts"]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.24.3/charts/istiod/templates/clusterrolebinding.yaml
deleted file mode 100644
index 10781b407..000000000
--- a/resources/v1.24.3/charts/istiod/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-- kind: ServiceAccount
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.24.3/charts/istiod/templates/configmap-jwks.yaml
deleted file mode 100644
index 3505d2822..000000000
--- a/resources/v1.24.3/charts/istiod/templates/configmap-jwks.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.jwksResolverExtraRootCA }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  extra.pem: {{ .Values.jwksResolverExtraRootCA | quote }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/configmap-values.yaml b/resources/v1.24.3/charts/istiod/templates/configmap-values.yaml
deleted file mode 100644
index a7e60369d..000000000
--- a/resources/v1.24.3/charts/istiod/templates/configmap-values.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  original-values: |-
-{{ .Values._original | toPrettyJson | indent 4 }}
-{{- $_ := unset $.Values "_original" }}
-  merged-values: |-
-{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.24.3/charts/istiod/templates/configmap.yaml b/resources/v1.24.3/charts/istiod/templates/configmap.yaml
deleted file mode 100644
index 57702ea53..000000000
--- a/resources/v1.24.3/charts/istiod/templates/configmap.yaml
+++ /dev/null
@@ -1,109 +0,0 @@
-{{- define "mesh" }}
-    # The trust domain corresponds to the trust root of a system.
-    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
-    trustDomain: "cluster.local"
-
-    # The namespace to treat as the administrative root namespace for Istio configuration.
-    # When processing a leaf namespace Istio will search for declarations in that namespace first
-    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
-    # is processed as if it were declared in the leaf namespace.
-    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
-
-  {{ $prom := include "default-prometheus" . | eq "true" }}
-  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
-  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
-  {{- if or $prom $sdMetrics $sdLogs }}
-    defaultProviders:
-    {{- if or $prom $sdMetrics }}
-      metrics:
-      {{ if $prom }}- prometheus{{ end }}
-      {{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
-    {{- end }}
-    {{- if and $sdMetrics $sdLogs }}
-      accessLogging:
-      - stackdriver
-    {{- end }}
-  {{- end }}
-
-    defaultConfig:
-      {{- if .Values.global.meshID }}
-      meshId: "{{ .Values.global.meshID }}"
-      {{- end }}
-      {{- with (.Values.global.proxy.variant | default .Values.global.variant) }}
-      image:
-        imageType: {{. | quote}}
-      {{- end }}
-      {{- if not (eq .Values.global.proxy.tracer "none") }}
-      tracing:
-      {{- if eq .Values.global.proxy.tracer "lightstep" }}
-        lightstep:
-          # Address of the LightStep Satellite pool
-          address: {{ .Values.global.tracer.lightstep.address }}
-          # Access Token used to communicate with the Satellite pool
-          accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
-      {{- else if eq .Values.global.proxy.tracer "zipkin" }}
-        zipkin:
-          # Address of the Zipkin collector
-          address: {{ ((.Values.global.tracer).zipkin).address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
-      {{- else if eq .Values.global.proxy.tracer "datadog" }}
-        datadog:
-          # Address of the Datadog Agent
-          address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
-      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
-        stackdriver:
-          # enables trace output to stdout.
-          debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}
-          # The global default max number of attributes per span.
-          maxNumberOfAttributes: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAttributes | default "200" }}
-          # The global default max number of annotation events per span.
-          maxNumberOfAnnotations: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAnnotations | default "200" }}
-          # The global default max number of message events per span.
-          maxNumberOfMessageEvents: {{ (($.Values.global.tracer).stackdriver).maxNumberOfMessageEvents | default "200" }}
-      {{- else if eq .Values.global.proxy.tracer "openCensusAgent" }}
-      {{/* Fill in openCensusAgent configuration from meshConfig so it isn't overwritten below */}}
-{{ toYaml $.Values.meshConfig.defaultConfig.tracing | indent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- if .Values.global.remotePilotAddress }}
-      discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
-      {{- else }}
-      discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
-      {{- end }}
-{{- end }}
-
-{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
-{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
-{{- $originalMesh := include "mesh" . | fromYaml }}
-{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
-
-{{- if .Values.configMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-
-  # Configuration file for the mesh networks to be used by the Split Horizon EDS.
-  meshNetworks: |-
-  {{- if .Values.global.meshNetworks }}
-    networks:
-{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
-  {{- else }}
-    networks: {}
-  {{- end }}
-
-  mesh: |-
-{{- if .Values.meshConfig }}
-{{ $mesh | toYaml | indent 4 }}
-{{- else }}
-{{- include "mesh" . }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/deployment.yaml b/resources/v1.24.3/charts/istiod/templates/deployment.yaml
deleted file mode 100644
index cd48ab757..000000000
--- a/resources/v1.24.3/charts/istiod/templates/deployment.yaml
+++ /dev/null
@@ -1,290 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- range $key, $val := .Values.deploymentLabels }}
-    {{ $key }}: "{{ $val }}"
-{{- end }}
-spec:
-{{- if not .Values.autoscaleEnabled }}
-{{- if .Values.replicaCount }}
-  replicas: {{ .Values.replicaCount }}
-{{- end }}
-{{- end }}
-  strategy:
-    rollingUpdate:
-      maxSurge: {{ .Values.rollingMaxSurge }}
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  selector:
-    matchLabels:
-      {{- if ne .Values.revision "" }}
-      app: istiod
-      istio.io/rev: {{ .Values.revision | default "default" | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
-  template:
-    metadata:
-      labels:
-        app: istiod
-        istio.io/rev: {{ .Values.revision | default "default" | quote }}
-        sidecar.istio.io/inject: "false"
-        operator.istio.io/component: "Pilot"
-        {{- if ne .Values.revision "" }}
-        istio: istiod
-        {{- else }}
-        istio: pilot
-        {{- end }}
-        {{- range $key, $val := .Values.podLabels }}
-        {{ $key }}: "{{ $val }}"
-        {{- end }}
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: "istiod"
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        prometheus.io/port: "15014"
-        prometheus.io/scrape: "true"
-        sidecar.istio.io/inject: "false"
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{- if .Values.nodeSelector }}
-      nodeSelector:
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- with .Values.affinity }}
-      affinity:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      tolerations:
-        - key: cni.istio.io/not-ready
-          operator: "Exists"
-{{- with .Values.tolerations }}
-{{- toYaml . | nindent 8 }}
-{{- end }}
-{{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- if .Values.global.priorityClassName }}
-      priorityClassName: "{{ .Values.global.priorityClassName }}"
-{{- end }}
-{{- with .Values.initContainers }}
-      initContainers:
-        {{- tpl (toYaml .) $ | nindent 8 }}
-{{- end }}
-      containers:
-        - name: discovery
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
-{{- end }}
-{{- if .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
-{{- end }}
-          args:
-          - "discovery"
-          - --monitoringAddr=:15014
-{{- if .Values.global.logging.level }}
-          - --log_output_level={{ .Values.global.logging.level }}
-{{- end}}
-{{- if .Values.global.logAsJson }}
-          - --log_as_json
-{{- end }}
-          - --domain
-          - {{ .Values.global.proxy.clusterDomain }}
-{{- if .Values.taint.namespace }}
-          - --cniNamespace={{ .Values.taint.namespace }}
-{{- end }}
-          - --keepaliveMaxServerConnectionAge
-          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
-{{- if .Values.extraContainerArgs }}
-          {{- with .Values.extraContainerArgs }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-{{- end }}
-          ports:
-          - containerPort: 8080
-            protocol: TCP
-            name: http-debug
-          - containerPort: 15010
-            protocol: TCP
-            name: grpc-xds
-          - containerPort: 15012
-            protocol: TCP
-            name: tls-xds
-          - containerPort: 15017
-            protocol: TCP
-            name: https-webhooks
-          - containerPort: 15014
-            protocol: TCP
-            name: http-monitoring
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 8080
-            initialDelaySeconds: 1
-            periodSeconds: 3
-            timeoutSeconds: 5
-          env:
-          - name: REVISION
-            value: "{{ .Values.revision | default `default` }}"
-          - name: PILOT_CERT_PROVIDER
-            value: {{ .Values.global.pilotCertProvider }}
-          - name: POD_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.name
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.namespace
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: spec.serviceAccountName
-          - name: KUBECONFIG
-            value: /var/run/secrets/remote/config
-          # If you explicitly told us where ztunnel lives, use that.
-          # Otherwise, assume it lives in our namespace
-          # Also, check for an explicit ENV override (legacy approach) and prefer that
-          # if present
-          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
-          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
-          - name: CA_TRUSTED_NODE_ACCOUNTS
-            value: "{{ $ztTrustedNS }}/ztunnel"
-          {{- end }}
-          {{- if .Values.env }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: "{{ $val }}"
-          {{- end }}
-          {{- end }}
-{{- if .Values.traceSampling }}
-          - name: PILOT_TRACE_SAMPLING
-            value: "{{ .Values.traceSampling }}"
-{{- end }}
-# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
-# don't set it here to avoid duplication.
-# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
-{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
-          - name: EXTERNAL_ISTIOD
-            value: "{{ .Values.global.externalIstiod }}"
-{{- end }}
-          - name: PILOT_ENABLE_ANALYSIS
-            value: "{{ .Values.global.istiod.enableAnalysis }}"
-          - name: CLUSTER_ID
-            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
-          - name: GOMEMLIMIT
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.memory
-          - name: GOMAXPROCS
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.cpu
-                divisor: "1"
-          - name: PLATFORM
-            value: "{{ coalesce .Values.global.platform .Values.platform }}"
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-              - ALL
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          volumeMounts:
-          - name: istio-token
-            mountPath: /var/run/secrets/tokens
-            readOnly: true
-          - name: local-certs
-            mountPath: /var/run/secrets/istio-dns
-          - name: cacerts
-            mountPath: /etc/cacerts
-            readOnly: true
-          - name: istio-kubeconfig
-            mountPath: /var/run/secrets/remote
-            readOnly: true
-          {{- if .Values.jwksResolverExtraRootCA }}
-          - name: extracacerts
-            mountPath: /cacerts
-          {{- end }}
-          - name: istio-csr-dns-cert
-            mountPath: /var/run/secrets/istiod/tls
-            readOnly: true
-          - name: istio-csr-ca-configmap
-            mountPath: /var/run/secrets/istiod/ca
-            readOnly: true
-          {{- with .Values.volumeMounts }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-      volumes:
-      # Technically not needed on this pod - but it helps debugging/testing SDS
-      # Should be removed after everything works.
-      - emptyDir:
-          medium: Memory
-        name: local-certs
-      - name: istio-token
-        projected:
-          sources:
-            - serviceAccountToken:
-                audience: {{ .Values.global.sds.token.aud }}
-                expirationSeconds: 43200
-                path: istio-token
-      # Optional: user-generated root
-      - name: cacerts
-        secret:
-          secretName: cacerts
-          optional: true
-      - name: istio-kubeconfig
-        secret:
-          secretName: istio-kubeconfig
-          optional: true
-      # Optional: istio-csr dns pilot certs
-      - name: istio-csr-dns-cert
-        secret:
-          secretName: istiod-tls
-          optional: true
-      - name: istio-csr-ca-configmap
-        configMap:
-          name: istio-ca-root-cert
-          defaultMode: 420
-          optional: true
-  {{- if .Values.jwksResolverExtraRootCA }}
-      - name: extracacerts
-        configMap:
-          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  {{- end }}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
-
----
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.24.3/charts/istiod/templates/istiod-injector-configmap.yaml
deleted file mode 100644
index 560c284ff..000000000
--- a/resources/v1.24.3/charts/istiod/templates/istiod-injector-configmap.yaml
+++ /dev/null
@@ -1,81 +0,0 @@
-{{- if not .Values.global.omitSidecarInjectorConfigMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
-  values: |-
-{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
-{{ $pilotVals := pick .Values "cni" -}}
-{{ $vals = set $vals "pilot" $pilotVals -}}
-{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
-{{ $vals = set $vals "gateways" $gatewayVals -}}
-{{ $vals | toPrettyJson | indent 4 }}
-
-  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
-  # and istiod webhook functionality.
-  #
-  # New fields should not use Values - it is a 'primary' config object, users should be able
-  # to fine tune it or use it with kube-inject.
-  config: |-
-    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
-    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
-    defaultTemplates:
-{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
-    - {{ . }}
-{{- end }}
-    {{- else }}
-    defaultTemplates: [sidecar]
-    {{- end }}
-    policy: {{ .Values.global.proxy.autoInject }}
-    alwaysInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
-    neverInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
-    injectedAnnotations:
-      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
-      "{{ $key }}": {{ $val | quote }}
-      {{- end }}
-    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
-         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
-         This should make it obvious that their installation is broken.
-     */}}
-    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
-    templates:
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
-      sidecar: |
-{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
-      gateway: |
-{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
-      grpc-simple: |
-{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
-      grpc-agent: |
-{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
-      waypoint: |
-{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
-      kube-gateway: |
-{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
-{{- end }}
-{{- with .Values.sidecarInjectorWebhook.templates }}
-{{ toYaml . | trim | indent 6 }}
-{{- end }}
-
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.24.3/charts/istiod/templates/mutatingwebhook.yaml
deleted file mode 100644
index 22160f70a..000000000
--- a/resources/v1.24.3/charts/istiod/templates/mutatingwebhook.yaml
+++ /dev/null
@@ -1,164 +0,0 @@
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- /* Core defines the common configuration used by all webhook segments */}}
-{{/* Copy just what we need to avoid expensive deepCopy */}}
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "caBundle" .Values.istiodRemote.injectionCABundle
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-    {{- if .caBundle }}
-    caBundle: "{{ .caBundle }}"
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  reinvocationPolicy: "{{ .reinvocationPolicy }}"
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
-{{- if not .Values.global.operatorManageWebhooks }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq .Release.Namespace "istio-system"}}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- else }}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
-
-{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
-{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-
-
-{{- /* Webhooks for default revision */}}
-{{- if (eq .Values.revision "") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.24.3/charts/istiod/templates/poddisruptionbudget.yaml
deleted file mode 100644
index 1eacf16e6..000000000
--- a/resources/v1.24.3/charts/istiod/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    istio: pilot
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app: istiod
-      {{- if ne .Values.revision "" }}
-      istio.io/rev: {{ .Values.revision | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.24.3/charts/istiod/templates/reader-clusterrole.yaml
deleted file mode 100644
index dbaa80503..000000000
--- a/resources/v1.24.3/charts/istiod/templates/reader-clusterrole.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - "config.istio.io"
-      - "security.istio.io"
-      - "networking.istio.io"
-      - "authentication.istio.io"
-      - "rbac.istio.io"
-      - "telemetry.istio.io"
-      - "extensions.istio.io"
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
-    resources: ["gateways"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: ["get", "list", "watch", "create", "delete"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["apps"]
-    resources: ["replicasets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-{{- if .Values.istiodRemote.enabled }}
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-{{- end}}
diff --git a/resources/v1.24.3/charts/istiod/templates/remote-istiod-endpoints.yaml b/resources/v1.24.3/charts/istiod/templates/remote-istiod-endpoints.yaml
deleted file mode 100644
index a6de571da..000000000
--- a/resources/v1.24.3/charts/istiod/templates/remote-istiod-endpoints.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-# if the remotePilotAddress is an IP addr
-{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-subsets:
-- addresses:
-  - ip: {{ .Values.global.remotePilotAddress }}
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 15017
-    name: tcp-webhook
-    protocol: TCP
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.24.3/charts/istiod/templates/remote-istiod-service.yaml
deleted file mode 100644
index 220277dc0..000000000
--- a/resources/v1.24.3/charts/istiod/templates/remote-istiod-service.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 443
-    targetPort: 15017
-    name: tcp-webhook
-    protocol: TCP
-  {{- if and .Values.global.remotePilotAddress (not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress)) }}
-  # if the remotePilotAddress is not an IP addr, we use ExternalName
-  type: ExternalName
-  externalName: {{ .Values.global.remotePilotAddress }}
-  {{- end }}
-{{- if .Values.global.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.global.ipFamilies }}
-  ipFamilies:
-{{- range .Values.global.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/revision-tags.yaml b/resources/v1.24.3/charts/istiod/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.24.3/charts/istiod/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/role.yaml b/resources/v1.24.3/charts/istiod/templates/role.yaml
deleted file mode 100644
index 10d89e8d1..000000000
--- a/resources/v1.24.3/charts/istiod/templates/role.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-# permissions to verify the webhook is ready and rejecting
-# invalid config. We use --server-dry-run so no config is persisted.
-- apiGroups: ["networking.istio.io"]
-  verbs: ["create"]
-  resources: ["gateways"]
-
-# For storing CA secret
-- apiGroups: [""]
-  resources: ["secrets"]
-  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
-  verbs: ["create", "get", "watch", "list", "update", "delete"]
-
-# For status controller, so it can delete the distribution report configmap
-- apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["delete"]
-
-# For gateway deployment controller
-- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
-  verbs: ["get", "update", "patch", "create"]
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/rolebinding.yaml b/resources/v1.24.3/charts/istiod/templates/rolebinding.yaml
deleted file mode 100644
index a42f4ec44..000000000
--- a/resources/v1.24.3/charts/istiod/templates/rolebinding.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/service.yaml b/resources/v1.24.3/charts/istiod/templates/service.yaml
deleted file mode 100644
index 30d5b8912..000000000
--- a/resources/v1.24.3/charts/istiod/templates/service.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  {{- if .Values.serviceAnnotations }}
-  annotations:
-{{ toYaml .Values.serviceAnnotations | indent 4 }}
-  {{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: istiod
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-    - port: 15010
-      name: grpc-xds # plaintext
-      protocol: TCP
-    - port: 15012
-      name: https-dns # mTLS with k8s-signed cert
-      protocol: TCP
-    - port: 443
-      name: https-webhook # validation and injection
-      targetPort: 15017
-      protocol: TCP
-    - port: 15014
-      name: http-monitoring # prometheus stats
-      protocol: TCP
-  selector:
-    app: istiod
-    {{- if ne .Values.revision "" }}
-    istio.io/rev: {{ .Values.revision | quote }}
-    {{- else }}
-    # Label used by the 'default' service. For versioned deployments we match with app and version.
-    # This avoids default deployment picking the canary
-    istio: pilot
-    {{- end }}
-  {{- if .Values.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.ipFamilyPolicy }}
-  {{- end }}
-  {{- if .Values.ipFamilies }}
-  ipFamilies:
-  {{- range .Values.ipFamilies }}
-  - {{ . }}
-  {{- end }}
-  {{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.24.3/charts/istiod/templates/validatingadmissionpolicy.yaml
deleted file mode 100644
index d36eef68e..000000000
--- a/resources/v1.24.3/charts/istiod/templates/validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.experimental.stableValidationPolicy }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-policy-binding{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-spec:
-  policyName: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  validationActions: [Deny]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.24.3/charts/istiod/templates/validatingwebhookconfiguration.yaml
deleted file mode 100644
index fb28836a0..000000000
--- a/resources/v1.24.3/charts/istiod/templates/validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,68 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.global.configValidation }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  # Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
-  # are rejecting invalid configs on a per-revision basis.
-  - name: rev.validation.istio.io
-    clientConfig:
-      # Should change from base but cannot for API compat
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.3/charts/istiod/templates/zzz_profile.yaml b/resources/v1.24.3/charts/istiod/templates/zzz_profile.yaml
deleted file mode 100644
index 52f665fbd..000000000
--- a/resources/v1.24.3/charts/istiod/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $x := set $.Values "_original" (deepCopy $.Values) }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.3/charts/istiod/values.yaml b/resources/v1.24.3/charts/istiod/values.yaml
deleted file mode 100644
index bff973578..000000000
--- a/resources/v1.24.3/charts/istiod/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.24.3
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.24.3/charts/revisiontags/Chart.yaml b/resources/v1.24.3/charts/revisiontags/Chart.yaml
deleted file mode 100644
index 7f5fdb565..000000000
--- a/resources/v1.24.3/charts/revisiontags/Chart.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.3
-description: Helm chart for istio revision tags
-name: revisiontags
-sources:
-- https://github.com/istio-ecosystem/sail-operator
-version: 0.1.0
-
diff --git a/resources/v1.24.3/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.24.3/charts/revisiontags/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.3/charts/revisiontags/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.3/charts/revisiontags/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.3/charts/revisiontags/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.3/charts/revisiontags/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.3/charts/revisiontags/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.3/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.3/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.3/charts/revisiontags/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.3/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.3/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.3/charts/revisiontags/files/profile-demo.yaml b/resources/v1.24.3/charts/revisiontags/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.3/charts/revisiontags/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.3/charts/revisiontags/files/profile-platform-k3s.yaml b/resources/v1.24.3/charts/revisiontags/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.3/charts/revisiontags/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.3/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.24.3/charts/revisiontags/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.24.3/charts/revisiontags/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.3/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.24.3/charts/revisiontags/templates/zzz_profile.yaml
deleted file mode 100644
index 52f665fbd..000000000
--- a/resources/v1.24.3/charts/revisiontags/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $x := set $.Values "_original" (deepCopy $.Values) }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.3/charts/revisiontags/values.yaml b/resources/v1.24.3/charts/revisiontags/values.yaml
deleted file mode 100644
index bff973578..000000000
--- a/resources/v1.24.3/charts/revisiontags/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.24.3
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.24.3/charts/ztunnel/Chart.yaml b/resources/v1.24.3/charts/ztunnel/Chart.yaml
deleted file mode 100644
index b33e2f350..000000000
--- a/resources/v1.24.3/charts/ztunnel/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.3
-description: Helm chart for istio ztunnel components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-ztunnel
-- istio
-name: ztunnel
-sources:
-- https://github.com/istio/istio
-version: 1.24.3
diff --git a/resources/v1.24.3/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.24.3/charts/ztunnel/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.3/charts/ztunnel/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.3/charts/ztunnel/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.3/charts/ztunnel/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.3/charts/ztunnel/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.3/charts/ztunnel/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.3/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.3/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.3/charts/ztunnel/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.3/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.3/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.3/charts/ztunnel/files/profile-demo.yaml b/resources/v1.24.3/charts/ztunnel/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.3/charts/ztunnel/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.3/charts/ztunnel/files/profile-platform-k3s.yaml b/resources/v1.24.3/charts/ztunnel/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.3/charts/ztunnel/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.3/charts/ztunnel/templates/daemonset.yaml b/resources/v1.24.3/charts/ztunnel/templates/daemonset.yaml
deleted file mode 100644
index c6e2daf48..000000000
--- a/resources/v1.24.3/charts/ztunnel/templates/daemonset.yaml
+++ /dev/null
@@ -1,197 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-spec:
-  updateStrategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app: ztunnel
-  template:
-    metadata:
-      labels:
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app: ztunnel
-        app.kubernetes.io/name: ztunnel
-        {{- include "istio.labels" . | nindent 8}}
-{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-{{- if .Values.revision }}
-        istio.io/rev: {{ .Values.revision }}
-{{- end }}
-{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-{{- if .Values.nodeSelector }}
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- if .Values.affinity }}
-      affinity:
-{{ toYaml .Values.affinity | trim | indent 8 }}
-{{- end }}
-      serviceAccountName: ztunnel
-      tolerations:
-        - effect: NoSchedule
-          operator: Exists
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      containers:
-      - name: istio-proxy
-{{- if contains "/" .Values.image }}
-        image: "{{ .Values.image }}"
-{{- else }}
-        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
-{{- end }}
-        ports:
-        - containerPort: 15020
-          name: ztunnel-stats
-          protocol: TCP
-        resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 10 }}
-{{- end }}
-{{- with .Values.imagePullPolicy }}
-        imagePullPolicy: {{ . }}
-{{- end }}
-        securityContext:
-          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
-          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
-          allowPrivilegeEscalation: true
-          privileged: false
-          capabilities:
-            drop:
-            - ALL
-            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
-            - NET_ADMIN # Required for TPROXY and setsockopt
-            - SYS_ADMIN # Required for `setns` - doing things in other netns
-            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
-          readOnlyRootFilesystem: true
-          runAsGroup: 1337
-          runAsNonRoot: false
-          runAsUser: 0
-{{- if .Values.seLinuxOptions }}
-          seLinuxOptions:
-{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
-{{- end }}
-        readinessProbe:
-          httpGet:
-            port: 15021
-            path: /healthz/ready
-        args:
-        - proxy
-        - ztunnel
-        env:
-        - name: CA_ADDRESS
-        {{- if .Values.caAddress }}
-          value: {{ .Values.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: XDS_ADDRESS
-        {{- if .Values.xdsAddress }}
-          value: {{ .Values.xdsAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        {{- if .Values.logAsJson }}
-        - name: LOG_FORMAT
-          value: json
-        {{- end}}
-        - name: RUST_LOG
-          value: {{ .Values.logLevel | quote }}
-        - name: RUST_BACKTRACE
-          value: "1"
-        - name: ISTIO_META_CLUSTER_ID
-          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
-        - name: INPOD_ENABLED
-          value: "true"
-        - name: TERMINATION_GRACE_PERIOD_SECONDS
-          value: "{{ .Values.terminationGracePeriodSeconds }}"
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
-        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        {{- with .Values.env }}
-        {{- range $key, $val := . }}
-        - name: {{ $key }}
-          value: "{{ $val }}"
-        {{- end }}
-        {{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /var/run/ztunnel
-          name: cni-ztunnel-sock-dir
-        - mountPath: /tmp
-          name: tmp
-        {{- with .Values.volumeMounts }}
-          {{- toYaml . | nindent 8 }}
-        {{- end }}
-      priorityClassName: system-node-critical
-      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
-      volumes:
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: istio-ca
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      - name: cni-ztunnel-sock-dir
-        hostPath:
-          path: /var/run/ztunnel
-          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
-      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
-      - name: tmp
-        emptyDir: {}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
diff --git a/resources/v1.24.3/charts/ztunnel/templates/rbac.yaml b/resources/v1.24.3/charts/ztunnel/templates/rbac.yaml
deleted file mode 100644
index 65bbea52b..000000000
--- a/resources/v1.24.3/charts/ztunnel/templates/rbac.yaml
+++ /dev/null
@@ -1,72 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-  {{- with .Values.imagePullSecrets }}
-imagePullSecrets:
-  {{- range . }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
----
-{{- if (eq (.Values.platform | default "") "openshift") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: ztunnel
-  labels:
-    app: ztunnel
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-rules:
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: ztunnel
-  labels:
-    app: ztunnel
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ztunnel
-subjects:
-- kind: ServiceAccount
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-{{- end }}
----
diff --git a/resources/v1.24.3/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.24.3/charts/ztunnel/templates/zzz_profile.yaml
deleted file mode 100644
index 72d3adc53..000000000
--- a/resources/v1.24.3/charts/ztunnel/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.3/charts/ztunnel/values.yaml b/resources/v1.24.3/charts/ztunnel/values.yaml
deleted file mode 100644
index 105136330..000000000
--- a/resources/v1.24.3/charts/ztunnel/values.yaml
+++ /dev/null
@@ -1,98 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
-  hub: gcr.io/istio-release
-  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
-  tag: 1.24.3
-  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
-  variant: ""
-
-  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
-  # If Image contains a "/", it will replace the entire `image` in the pod.
-  image: ztunnel
-
-  # Labels to apply to all top level resources
-  labels: {}
-  # Annotations to apply to all top level resources
-  annotations: {}
-
-  # Additional volumeMounts to the ztunnel container
-  volumeMounts: []
-
-  # Additional volumes to the ztunnel pod
-  volumes: []
-
-  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-
-  # Additional labels to apply on the pod level
-  podLabels: {}
-
-  # Pod resource configuration
-  resources:
-    requests:
-      cpu: 200m
-      # Ztunnel memory scales with the size of the cluster and traffic load
-      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
-      memory: 512Mi
-
-  # List of secret names to add to the service account as image pull secrets
-  imagePullSecrets: []
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
-
-  # Override for the pod imagePullPolicy
-  imagePullPolicy: ""
-
-  # Settings for multicluster
-  multiCluster:
-    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
-    # with Istiod configuration.
-    clusterName: ""
-
-  # meshConfig defines runtime configuration of components.
-  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
-  # components.
-  # TODO: https://github.com/istio/istio/issues/43248
-  meshConfig:
-    defaultConfig:
-      proxyMetadata: {}
-
-  # This value defines:
-  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
-  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
-  # Default K8S value is 30 seconds
-  terminationGracePeriodSeconds: 30
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
-  revision: ""
-
-  # The customized CA address to retrieve certificates for the pods in the cluster.
-  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-  caAddress: ""
-
-  # The customized XDS address to retrieve configuration.
-  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
-  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
-  xdsAddress: ""
-
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
-  istioNamespace: istio-system
-
-  # Configuration log level of ztunnel binary, default is info.
-  # Valid values are: trace, debug, info, warn, error
-  logLevel: info
-
-  # To output all logs in json format
-  logAsJson: false
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seLinuxOptions: {}
-  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
-  #seLinuxOptions:
-  #  type: spc_t
diff --git a/resources/v1.24.3/cni-1.24.3.tgz.etag b/resources/v1.24.3/cni-1.24.3.tgz.etag
deleted file mode 100644
index ae3033787..000000000
--- a/resources/v1.24.3/cni-1.24.3.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-a489a7834c40b7cbcfe21af4c767ed38
diff --git a/resources/v1.24.3/commit b/resources/v1.24.3/commit
deleted file mode 100644
index ae96cc731..000000000
--- a/resources/v1.24.3/commit
+++ /dev/null
@@ -1 +0,0 @@
-1.24.3
diff --git a/resources/v1.24.3/gateway-1.24.3.tgz.etag b/resources/v1.24.3/gateway-1.24.3.tgz.etag
deleted file mode 100644
index 587ac23ed..000000000
--- a/resources/v1.24.3/gateway-1.24.3.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-754218656f8dd7975948b2d95c13e63f
diff --git a/resources/v1.24.3/istiod-1.24.3.tgz.etag b/resources/v1.24.3/istiod-1.24.3.tgz.etag
deleted file mode 100644
index a013cb693..000000000
--- a/resources/v1.24.3/istiod-1.24.3.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-3d4582573d40147b20f5e0fa959533cb
diff --git a/resources/v1.24.3/profiles/default.yaml b/resources/v1.24.3/profiles/default.yaml
deleted file mode 100644
index e9e0a3931..000000000
--- a/resources/v1.24.3/profiles/default.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  # Most default values come from the helm chart's values.yaml
-  # Below are the things that differ
-  values:
-    defaultRevision: ""
-    global:
-      istioNamespace: istio-system
-      configValidation: true
diff --git a/resources/v1.24.3/ztunnel-1.24.3.tgz.etag b/resources/v1.24.3/ztunnel-1.24.3.tgz.etag
deleted file mode 100644
index 717b4e467..000000000
--- a/resources/v1.24.3/ztunnel-1.24.3.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-8d6cdf89c324d79a8dbd2dd5f1a375ab
diff --git a/resources/v1.24.4/base-1.24.4.tgz.etag b/resources/v1.24.4/base-1.24.4.tgz.etag
deleted file mode 100644
index 5e250b481..000000000
--- a/resources/v1.24.4/base-1.24.4.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-705d2e562493080097715443eff34d31
diff --git a/resources/v1.24.4/charts/base/Chart.yaml b/resources/v1.24.4/charts/base/Chart.yaml
deleted file mode 100644
index 341cf8e57..000000000
--- a/resources/v1.24.4/charts/base/Chart.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.4
-description: Helm chart for deploying Istio cluster resources and CRDs
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-name: base
-sources:
-- https://github.com/istio/istio
-version: 1.24.4
diff --git a/resources/v1.24.4/charts/base/files/profile-ambient.yaml b/resources/v1.24.4/charts/base/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.4/charts/base/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.4/charts/base/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.4/charts/base/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.4/charts/base/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.4/charts/base/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.4/charts/base/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.4/charts/base/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.4/charts/base/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.4/charts/base/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.4/charts/base/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.4/charts/base/files/profile-demo.yaml b/resources/v1.24.4/charts/base/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.4/charts/base/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.4/charts/base/files/profile-platform-k3s.yaml b/resources/v1.24.4/charts/base/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.4/charts/base/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.4/charts/base/templates/zzz_profile.yaml b/resources/v1.24.4/charts/base/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.4/charts/base/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.4/charts/base/values.yaml b/resources/v1.24.4/charts/base/values.yaml
deleted file mode 100644
index 98c9c3645..000000000
--- a/resources/v1.24.4/charts/base/values.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  global:
-
-    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-
-    # Used to locate istiod.
-    istioNamespace: istio-system
-
-    # Platform where Istio is deployed. Possible values are: "openshift", "gcp".
-    # An empty value means it is a vanilla Kubernetes distribution, therefore no special
-    # treatment will be considered.
-    platform: ""
-  base:
-    # A list of CRDs to exclude. Requires `enableCRDTemplates` to be true.
-    # Example: `excludedCRDs: ["envoyfilters.networking.istio.io"]`.
-    # Note: when installing with `istioctl`, `enableIstioConfigCRDs=false` must also be set.
-    excludedCRDs: []
-    # Helm (as of V3) does not support upgrading CRDs, because it is not universally
-    # safe for them to support this.
-    # Istio as a project enforces certain backwards-compat guarantees that allow us
-    # to safely upgrade CRDs in spite of this, so we default to self-managing CRDs
-    # as standard K8S resources in Helm, and disable Helm's CRD management. See also:
-    # https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#method-2-separate-charts
-    enableCRDTemplates: true
-
-    # Validation webhook configuration url
-    # For example: https://$remotePilotAddress:15017/validate
-    validationURL: ""
-    # Validation webhook caBundle value. Useful when running pilot with a well known cert
-    validationCABundle: ""
-
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  defaultRevision: "default"
-  experimental:
-    stableValidationPolicy: false
diff --git a/resources/v1.24.4/charts/cni/Chart.yaml b/resources/v1.24.4/charts/cni/Chart.yaml
deleted file mode 100644
index 95f596960..000000000
--- a/resources/v1.24.4/charts/cni/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.4
-description: Helm chart for istio-cni components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-cni
-- istio
-name: cni
-sources:
-- https://github.com/istio/istio
-version: 1.24.4
diff --git a/resources/v1.24.4/charts/cni/files/profile-ambient.yaml b/resources/v1.24.4/charts/cni/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.4/charts/cni/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.4/charts/cni/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.4/charts/cni/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.4/charts/cni/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.4/charts/cni/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.4/charts/cni/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.4/charts/cni/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.4/charts/cni/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.4/charts/cni/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.4/charts/cni/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.4/charts/cni/files/profile-demo.yaml b/resources/v1.24.4/charts/cni/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.4/charts/cni/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.4/charts/cni/files/profile-platform-k3s.yaml b/resources/v1.24.4/charts/cni/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.4/charts/cni/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.4/charts/cni/templates/clusterrole.yaml b/resources/v1.24.4/charts/cni/templates/clusterrole.yaml
deleted file mode 100644
index f4d4b7754..000000000
--- a/resources/v1.24.4/charts/cni/templates/clusterrole.yaml
+++ /dev/null
@@ -1,77 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: ["security.openshift.io"] 
-  resources: ["securitycontextconstraints"] 
-  resourceNames: ["privileged"] 
-  verbs: ["use"]
-- apiGroups: [""]
-  resources: ["pods","nodes","namespaces"]
-  verbs: ["get", "list", "watch"]
-{{- if (eq ((coalesce .Values.platform .Values.global.platform) | default "") "openshift") }}
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
-{{- end }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-repair-role
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "patch"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["watch", "get", "list"]
-{{- if .Values.repair.repairPods }}
-{{- /*  No privileges needed*/}}
-{{- else if .Values.repair.deletePods }}
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["delete"]
-{{- else if .Values.repair.labelPods }}
-  - apiGroups: [""]
-    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-    resources: ["pods/status"]
-    verbs: ["patch", "update"]
-{{- end }}
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: [""]
-  {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-  resources: ["pods/status"]
-  verbs: ["patch", "update"]
-{{- end }}
diff --git a/resources/v1.24.4/charts/cni/templates/configmap-cni.yaml b/resources/v1.24.4/charts/cni/templates/configmap-cni.yaml
deleted file mode 100644
index 52d612441..000000000
--- a/resources/v1.24.4/charts/cni/templates/configmap-cni.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: {{ template "name" . }}-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  CURRENT_AGENT_VERSION: {{ .Values.tag | default .Values.global.tag | quote }}
-  AMBIENT_ENABLED: {{ .Values.ambient.enabled | quote }}
-  AMBIENT_DNS_CAPTURE: {{ .Values.ambient.dnsCapture | default "false" | quote  }}
-  AMBIENT_IPV6: {{ .Values.ambient.ipv6 | default "false" | quote }}
-  {{- if .Values.cniConfFileName }} # K8S < 1.24 doesn't like empty values
-  CNI_CONF_NAME: {{ .Values.cniConfFileName }} # Name of the CNI config file to create. Only override if you know the exact path your CNI requires..
-  {{- end }}
-  CHAINED_CNI_PLUGIN: {{ .Values.chained | quote }}
-  EXCLUDED_NAMESPACES: "{{ range $idx, $ns := .Values.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
-  REPAIR_ENABLED: {{ .Values.chained | quote }}
-  REPAIR_LABEL_PODS: {{ .Values.repair.labelPods | quote }}
-  REPAIR_DELETE_PODS: {{ .Values.repair.deletePods | quote }}
-  REPAIR_REPAIR_PODS: {{ .Values.repair.repairPods | quote }}
-  REPAIR_INIT_CONTAINER_NAME: {{ .Values.repair.initContainerName | quote }}
-  REPAIR_BROKEN_POD_LABEL_KEY: {{ .Values.repair.brokenPodLabelKey | quote }}
-  REPAIR_BROKEN_POD_LABEL_VALUE: {{ .Values.repair.brokenPodLabelValue | quote }}
-  {{- with .Values.env }}
-  {{- range $key, $val := . }}
-  {{ $key }}: "{{ $val }}"
-  {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.4/charts/cni/templates/daemonset.yaml b/resources/v1.24.4/charts/cni/templates/daemonset.yaml
deleted file mode 100644
index d287dba40..000000000
--- a/resources/v1.24.4/charts/cni/templates/daemonset.yaml
+++ /dev/null
@@ -1,232 +0,0 @@
-# This manifest installs the Istio install-cni container, as well
-# as the Istio CNI plugin and config on
-# each master and worker node in a Kubernetes cluster.
-{{- $defaultBinDir :=
-    (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
-      "/home/kubernetes/bin"
-      "/opt/cni/bin"
-}}
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  name: {{ template "name" . }}-node
-  namespace: {{ .Release.Namespace }}
-  labels:
-    k8s-app: {{ template "name" . }}-node
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  selector:
-    matchLabels:
-      k8s-app: {{ template "name" . }}-node
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  template:
-    metadata:
-      labels:
-        k8s-app: {{ template "name" . }}-node
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: {{ template "name" . }}
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-        # Add Prometheus Scrape annotations
-        prometheus.io/scrape: 'true'
-        prometheus.io/port: "15014"
-        prometheus.io/path: '/metrics'
-        # Add AppArmor annotation
-        # This is required to avoid conflicts with AppArmor profiles which block certain
-        # privileged pod capabilities.
-        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
-        # securityContext which is otherwise preferred.
-        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
-        # Custom annotations
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{if .Values.ambient.enabled }}
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-{{ end }}
-      nodeSelector:
-        kubernetes.io/os: linux
-      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      tolerations:
-        # Make sure istio-cni-node gets scheduled on all nodes.
-        - effect: NoSchedule
-          operator: Exists
-        # Mark the pod as a critical add-on for rescheduling.
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      priorityClassName: system-node-critical
-      serviceAccountName: {{ template "name" . }}
-      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
-      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
-      terminationGracePeriodSeconds: 5
-      containers:
-        # This container installs the Istio CNI binaries
-        # and CNI network config file on each node.
-        - name: install-cni
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
-{{- end }}
-{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
-{{- end }}
-          ports:
-          - containerPort: 15014
-            name: metrics
-            protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8000
-          securityContext:
-            privileged: false
-            runAsGroup: 0
-            runAsUser: 0
-            runAsNonRoot: false
-            # Both ambient and sidecar repair mode require elevated node privileges to function.
-            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
-            # add capabilities based on feature.
-            capabilities:
-              drop:
-              - ALL
-              add:
-              # CAP_NET_ADMIN is required to allow ipset and route table access
-              - NET_ADMIN
-              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
-              - NET_RAW
-              # CAP_SYS_PTRACE is required for repair mode to describe the pod's network namespace
-              # in ambient and repair mode.
-              - SYS_PTRACE
-              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
-              # network namespaces in `/proc` to obtain descriptors for entering pod network
-              # namespaces. There does not appear to be a more granular capability for this.
-              - SYS_ADMIN
-              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
-              # the typical ability to read/write to folders owned by others.
-              # This can cause problems if the hostPath mounts we use, which we require write access into,
-              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
-              - DAC_OVERRIDE
-{{- if .Values.seLinuxOptions }}
-{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
-            seLinuxOptions:
-{{ toYaml . | trim | indent 14 }}
-{{- end }}
-{{- end }}
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          command: ["install-cni"]
-          args:
-            {{- if or .Values.logging.level .Values.global.logging.level }}
-            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
-            {{- end}}
-            {{- if .Values.global.logAsJson }}
-            - --log_as_json
-            {{- end}}
-          envFrom:
-            - configMapRef:
-                name: {{ template "name" . }}-config
-          env:
-            - name: REPAIR_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: REPAIR_RUN_AS_DAEMON
-              value: "true"
-            - name: REPAIR_SIDECAR_ANNOTATION
-              value: "sidecar.istio.io/status"
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  apiVersion: v1
-                  fieldPath: spec.nodeName
-            - name: GOMEMLIMIT
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.memory
-            - name: GOMAXPROCS
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.cpu
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          volumeMounts:
-            - mountPath: /host/opt/cni/bin
-              name: cni-bin-dir
-            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-            - mountPath: /host/proc
-              name: cni-host-procfs
-              readOnly: true
-            {{- end }}
-            - mountPath: /host/etc/cni/net.d
-              name: cni-net-dir
-            - mountPath: /var/run/istio-cni
-              name: cni-socket-dir
-            {{- if .Values.ambient.enabled }}
-            - mountPath: /host/var/run/netns
-              mountPropagation: HostToContainer
-              name: cni-netns-dir
-            - mountPath: /var/run/ztunnel
-              name: cni-ztunnel-sock-dir
-            {{ end }}
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-      volumes:
-        # Used to install CNI.
-        - name: cni-bin-dir
-          hostPath:
-            path: {{ .Values.cniBinDir | default $defaultBinDir }}
-        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-        - name: cni-host-procfs
-          hostPath:
-            path: /proc
-            type: Directory
-        {{- end }}
-        {{- if .Values.ambient.enabled }}
-        - name: cni-ztunnel-sock-dir
-          hostPath:
-            path: /var/run/ztunnel
-            type: DirectoryOrCreate
-        {{- end }}
-        - name: cni-net-dir
-          hostPath:
-            path: {{ default "/etc/cni/net.d" .Values.cniConfDir }}
-        # Used for UDS sockets for logging, ambient eventing
-        - name: cni-socket-dir
-          hostPath:
-            path: /var/run/istio-cni
-        - name: cni-netns-dir
-          hostPath:
-            path: {{ .Values.cniNetnsDir | default "/var/run/netns" }}
-            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
-            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
-            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.24.4/charts/cni/templates/zzz_profile.yaml b/resources/v1.24.4/charts/cni/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.4/charts/cni/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.4/charts/cni/values.yaml b/resources/v1.24.4/charts/cni/values.yaml
deleted file mode 100644
index 9c562d641..000000000
--- a/resources/v1.24.4/charts/cni/values.yaml
+++ /dev/null
@@ -1,149 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  hub: ""
-  tag: ""
-  variant: ""
-  image: install-cni
-  pullPolicy: ""
-
-  # Same as `global.logging.level`, but will override it if set
-  logging:
-    level: ""
-
-  # Configuration file to insert istio-cni plugin configuration
-  # by default this will be the first file found in the cni-conf-dir
-  # Example
-  # cniConfFileName: 10-calico.conflist
-
-  # CNI bin and conf dir override settings
-  # defaults:
-  cniBinDir: "" # Auto-detected based on version; defaults to /opt/cni/bin.
-  cniConfDir: /etc/cni/net.d
-  cniConfFileName: ""
-  # This directory must exist on the node, if it does not, consult your container runtime
-  # documentation for the appropriate path.
-  cniNetnsDir: # Defaults to '/var/run/netns', in minikube/docker/others can be '/var/run/docker/netns'.
-
-
-  excludeNamespaces:
-    - kube-system
-
-  # Allows user to set custom affinity for the DaemonSet
-  affinity: {}
-
-  # Custom annotations on pod level, if you need them
-  podAnnotations: {}
-
-  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
-  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
-  chained: true
-
-  # Custom configuration happens based on the CNI provider.
-  # Possible values: "default", "multus"
-  provider: "default"
-
-  # Configure ambient settings
-  ambient:
-    # If enabled, ambient redirection will be enabled
-    enabled: false
-    # Set ambient config dir path: defaults to /etc/ambient-config
-    configDir: ""
-    # If enabled, and ambient is enabled, DNS redirection will be enabled
-    dnsCapture: false
-    # If enabled, and ambient is enabled, enables ipv6 support
-    ipv6: true
-
-
-  repair:
-    enabled: true
-    hub: ""
-    tag: ""
-
-    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
-    # This defines the action the controller will take when a pod is detected as broken.
-
-    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
-    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
-    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
-    labelPods: false
-    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
-    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
-    deletePods: false
-    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
-    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
-    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
-    repairPods: true
-
-    initContainerName: "istio-validation"
-
-    brokenPodLabelKey: "cni.istio.io/uninitialized"
-    brokenPodLabelValue: "true"
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
-  seLinuxOptions: {}
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 100Mi
-
-  resourceQuotas:
-    enabled: false
-    pods: 5000
-
-  # The number of pods that can be unavailable during rolling update (see
-  # `updateStrategy.rollingUpdate.maxUnavailable` here:
-  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
-  # May be specified as a number of pods or as a percent of the total number
-  # of pods at the start of the update.
-  rollingMaxUnavailable: 1
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  global:
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-
-    # Default tag for Istio images.
-    tag: 1.24.4
-
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # change cni scope level to control logging out of istio-cni-node DaemonSet
-    logging:
-      level: info
-
-    logAsJson: false
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Default resources allocated
-    defaultResources:
-      requests:
-        cpu: 100m
-        memory: 100Mi
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
diff --git a/resources/v1.24.4/charts/gateway/Chart.yaml b/resources/v1.24.4/charts/gateway/Chart.yaml
deleted file mode 100644
index 45fb767ee..000000000
--- a/resources/v1.24.4/charts/gateway/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.4
-description: Helm chart for deploying Istio gateways
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- gateways
-name: gateway
-sources:
-- https://github.com/istio/istio
-type: application
-version: 1.24.4
diff --git a/resources/v1.24.4/charts/gateway/files/profile-ambient.yaml b/resources/v1.24.4/charts/gateway/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.4/charts/gateway/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.4/charts/gateway/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.4/charts/gateway/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.4/charts/gateway/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.4/charts/gateway/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.4/charts/gateway/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.4/charts/gateway/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.4/charts/gateway/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.4/charts/gateway/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.4/charts/gateway/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.4/charts/gateway/files/profile-demo.yaml b/resources/v1.24.4/charts/gateway/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.4/charts/gateway/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.4/charts/gateway/files/profile-platform-k3s.yaml b/resources/v1.24.4/charts/gateway/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.4/charts/gateway/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.4/charts/gateway/templates/deployment.yaml b/resources/v1.24.4/charts/gateway/templates/deployment.yaml
deleted file mode 100644
index 9db59d8b9..000000000
--- a/resources/v1.24.4/charts/gateway/templates/deployment.yaml
+++ /dev/null
@@ -1,128 +0,0 @@
-apiVersion: apps/v1
-kind: {{ .Values.kind | default "Deployment" }}
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  {{- with .Values.replicaCount }}
-  replicas: {{ . }}
-  {{- end }}
-  {{- end }}
-  {{- with .Values.strategy }}
-  strategy:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.minReadySeconds }}
-  minReadySeconds: {{ . }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "gateway.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
-        {{- include "gateway.selectorLabels" . | nindent 8 }}
-        app.kubernetes.io/name: {{ include "gateway.name" . }}
-        {{- include "istio.labels" .  | nindent 8}}
-        {{- range $key, $val := .Values.labels }}
-        {{- if and (ne $key "app") (ne $key "istio") }}
-        {{ $key | quote }}: {{ $val | quote }}
-        {{- end }}
-        {{- end }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
-      securityContext:
-      {{- if .Values.securityContext }}
-        {{- toYaml .Values.securityContext | nindent 8 }}
-      {{- else }}
-        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- end }}
-      {{- with .Values.volumes }}
-      volumes:
-        {{ toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: istio-proxy
-          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
-          image: auto
-          {{- with .Values.imagePullPolicy }}
-          imagePullPolicy: {{ . }}
-          {{- end }}
-          securityContext:
-          {{- if .Values.containerSecurityContext }}
-            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          {{- else }}
-            capabilities:
-              drop:
-              - ALL
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            {{- if not (eq (.Values.platform | default "") "openshift") }}
-            runAsUser: 1337
-            runAsGroup: 1337
-            {{- end }}
-            runAsNonRoot: true
-          {{- end }}
-          env:
-          {{- with .Values.networkGateway }}
-          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-            value: "{{.}}"
-          {{- end }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: {{ $val | quote }}
-          {{- end }}
-          ports:
-          - containerPort: 15090
-            protocol: TCP
-            name: http-envoy-prom
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          {{- with .Values.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.readinessProbe }}
-          readinessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
-      {{- with .Values.priorityClassName }}
-      priorityClassName: {{ . }}
-      {{- end }}
diff --git a/resources/v1.24.4/charts/gateway/templates/service.yaml b/resources/v1.24.4/charts/gateway/templates/service.yaml
deleted file mode 100644
index 25ce3bcb0..000000000
--- a/resources/v1.24.4/charts/gateway/templates/service.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-{{- if not (eq .Values.service.type "None") }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-    {{- with .Values.networkGateway }}
-    topology.istio.io/network: "{{.}}"
-    {{- end }}
-  annotations:
-    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
-spec:
-{{- with .Values.service.loadBalancerIP }}
-  loadBalancerIP: "{{ . }}"
-{{- end }}
-{{- if eq .Values.service.type "LoadBalancer" }}
-  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
-  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
-  {{- end }}
-{{- end }}
-{{- if .Values.service.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.service.ipFamilies }}
-  ipFamilies:
-{{- range .Values.service.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
-{{- with .Values.service.loadBalancerSourceRanges }}
-  loadBalancerSourceRanges:
-{{ toYaml . | indent 4 }}
-{{- end }}
-{{- with .Values.service.externalTrafficPolicy }}
-  externalTrafficPolicy: "{{ . }}"
-{{- end }}
-  type: {{ .Values.service.type }}
-  ports:
-{{- if .Values.networkGateway }}
-  - name: status-port
-    port: 15021
-    targetPort: 15021
-  - name: tls
-    port: 15443
-    targetPort: 15443
-  - name: tls-istiod
-    port: 15012
-    targetPort: 15012
-  - name: tls-webhook
-    port: 15017
-    targetPort: 15017
-{{- else }}
-{{ .Values.service.ports | toYaml | indent 4 }}
-{{- end }}
-{{- if .Values.service.externalIPs }}
-  externalIPs: {{- range .Values.service.externalIPs }}
-    - {{.}}
-  {{- end }}
-{{- end }}
-  selector:
-    {{- include "gateway.selectorLabels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.24.4/charts/gateway/templates/zzz_profile.yaml b/resources/v1.24.4/charts/gateway/templates/zzz_profile.yaml
deleted file mode 100644
index 72d3adc53..000000000
--- a/resources/v1.24.4/charts/gateway/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.4/charts/gateway/values.schema.json b/resources/v1.24.4/charts/gateway/values.schema.json
deleted file mode 100644
index 3fdaa2730..000000000
--- a/resources/v1.24.4/charts/gateway/values.schema.json
+++ /dev/null
@@ -1,330 +0,0 @@
-{
-  "$schema": "http://json-schema.org/schema#",
-  "$defs": {
-    "values": {
-      "type": "object",
-      "properties": {
-        "global": {
-          "type": "object"
-        },
-        "affinity": {
-          "type": "object"
-        },
-        "securityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "containerSecurityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "kind": {
-          "type": "string",
-          "enum": [
-            "Deployment",
-            "DaemonSet"
-          ]
-        },
-        "annotations": {
-          "additionalProperties": {
-            "type": [
-              "string",
-              "integer"
-            ]
-          },
-          "type": "object"
-        },
-        "autoscaling": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            },
-            "maxReplicas": {
-              "type": "integer"
-            },
-            "minReplicas": {
-              "type": "integer"
-            },
-            "targetCPUUtilizationPercentage": {
-              "type": "integer"
-            }
-          }
-        },
-        "env": {
-          "type": "object"
-        },
-        "strategy": {
-          "type": "object"
-        },
-        "minReadySeconds": {
-          "type": [
-            "null",
-            "integer"
-          ]
-        },
-        "readinessProbe": {
-          "type": [
-            "null",
-            "object"
-          ]
-        },
-        "labels": {
-          "type": "object"
-        },
-        "name": {
-          "type": "string"
-        },
-        "nodeSelector": {
-          "type": "object"
-        },
-        "podAnnotations": {
-          "type": "object",
-          "properties": {
-            "inject.istio.io/templates": {
-              "type": "string"
-            },
-            "prometheus.io/path": {
-              "type": "string"
-            },
-            "prometheus.io/port": {
-              "type": "string"
-            },
-            "prometheus.io/scrape": {
-              "type": "string"
-            }
-          }
-        },
-        "replicaCount": {
-          "type": [
-            "integer",
-            "null"
-          ]
-        },
-        "resources": {
-          "type": "object",
-          "properties": {
-            "limits": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            },
-            "requests": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            }
-          }
-        },
-        "revision": {
-          "type": "string"
-        },
-        "compatibilityVersion": {
-          "type": "string"
-        },
-        "runAsRoot": {
-          "type": "boolean"
-        },
-        "unprivilegedPort": {
-          "type": [
-            "string",
-            "boolean"
-          ],
-          "enum": [
-            true,
-            false,
-            "auto"
-          ]
-        },
-        "service": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "externalTrafficPolicy": {
-              "type": "string"
-            },
-            "loadBalancerIP": {
-              "type": "string"
-            },
-            "loadBalancerSourceRanges": {
-              "type": "array"
-            },
-            "ipFamilies": {
-              "items": {
-                "type": "string",
-                "enum": [
-                  "IPv4",
-                  "IPv6"
-                ]
-              }
-            },
-            "ipFamilyPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "SingleStack",
-                "PreferDualStack",
-                "RequireDualStack"
-              ]
-            },
-            "ports": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string"
-                  },
-                  "port": {
-                    "type": "integer"
-                  },
-                  "protocol": {
-                    "type": "string"
-                  },
-                  "targetPort": {
-                    "type": "integer"
-                  }
-                }
-              }
-            },
-            "type": {
-              "type": "string"
-            }
-          }
-        },
-        "serviceAccount": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "name": {
-              "type": "string"
-            },
-            "create": {
-              "type": "boolean"
-            }
-          }
-        },
-        "rbac": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            }
-          }
-        },
-        "tolerations": {
-          "type": "array"
-        },
-        "topologySpreadConstraints": {
-          "type": "array"
-        },
-        "networkGateway": {
-          "type": "string"
-        },
-        "imagePullPolicy": {
-          "type": "string",
-          "enum": [
-            "",
-            "Always",
-            "IfNotPresent",
-            "Never"
-          ]
-        },
-        "imagePullSecrets": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "name": {
-                "type": "string"
-              }
-            }
-          }
-        },
-        "podDisruptionBudget": {
-          "type": "object",
-          "properties": {
-            "minAvailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "maxUnavailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "unhealthyPodEvictionPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "IfHealthyBudget",
-                "AlwaysAllow"
-              ]
-            }
-          }
-        },
-        "terminationGracePeriodSeconds": {
-          "type": "number"
-        },
-        "volumes": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "volumeMounts": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "priorityClassName": {
-          "type": "string"
-        },
-        "_internal_defaults_do_not_set": {
-          "type": "object"
-        }
-      },
-      "additionalProperties": false
-    }
-  },
-  "defaults": {
-    "$ref": "#/$defs/values"
-  },
-  "$ref": "#/$defs/values"
-}
diff --git a/resources/v1.24.4/charts/gateway/values.yaml b/resources/v1.24.4/charts/gateway/values.yaml
deleted file mode 100644
index b02240df1..000000000
--- a/resources/v1.24.4/charts/gateway/values.yaml
+++ /dev/null
@@ -1,166 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Name allows overriding the release name. Generally this should not be set
-  name: ""
-  # revision declares which revision this gateway is a part of
-  revision: ""
-
-  # Controls the spec.replicas setting for the Gateway deployment if set.
-  # Otherwise defaults to Kubernetes Deployment default (1).
-  replicaCount:
-
-  kind: Deployment
-
-  rbac:
-    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
-    # when using http://gateway-api.org/.
-    enabled: true
-
-  serviceAccount:
-    # If set, a service account will be created. Otherwise, the default is used
-    create: true
-    # Annotations to add to the service account
-    annotations: {}
-    # The name of the service account to use.
-    # If not set, the release name is used
-    name: ""
-
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/stats/prometheus"
-    inject.istio.io/templates: "gateway"
-    sidecar.istio.io/inject: "true"
-
-  # Define the security context for the pod.
-  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-  securityContext: {}
-  containerSecurityContext: {}
-
-  service:
-    # Type of service. Set to "None" to disable the service entirely
-    type: LoadBalancer
-    ports:
-    - name: status-port
-      port: 15021
-      protocol: TCP
-      targetPort: 15021
-    - name: http2
-      port: 80
-      protocol: TCP
-      targetPort: 80
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
-    annotations: {}
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    externalTrafficPolicy: ""
-    externalIPs: []
-    ipFamilyPolicy: ""
-    ipFamilies: []
-    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
-    # allocateLoadBalancerNodePorts: false
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: 2000m
-      memory: 1024Mi
-
-  autoscaling:
-    enabled: true
-    minReplicas: 1
-    maxReplicas: 5
-    targetCPUUtilizationPercentage: 80
-    targetMemoryUtilizationPercentage: {}
-    autoscaleBehavior: {}
-
-  # Pod environment variables
-  env: {}
-
-  # Deployment Update strategy
-  strategy: {}
-  
-  # Sets the Deployment minReadySeconds value
-  minReadySeconds:
-  
-  # Optionally configure a custom readinessProbe. By default the control plane
-  # automatically injects the readinessProbe. If you wish to override that
-  # behavior, you may define your own readinessProbe here.
-  readinessProbe: {}
-
-  # Labels to apply to all resources
-  labels: {}
-
-  # Annotations to apply to all resources
-  annotations: {}
-
-  nodeSelector: {}
-
-  tolerations: []
-
-  topologySpreadConstraints: []
-
-  affinity: {}
-
-  # If specified, the gateway will act as a network gateway for the given network.
-  networkGateway: ""
-
-  # Specify image pull policy if default behavior isn't desired.
-  # Default behavior: latest images will be Always else IfNotPresent
-  imagePullPolicy: ""
-
-  imagePullSecrets: []
-
-  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
-  #
-  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
-  # which means that no PodDisruptionBudget resource will be created.
-  #
-  # To enable the PodDisruptionBudget, configure it by specifying the
-  # `minAvailable` or `maxUnavailable`. For example, to set the
-  # minimum number of available replicas to 1, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #
-  # Or, to allow a maximum of 1 unavailable replica, you can set:
-  #
-  # podDisruptionBudget:
-  #   maxUnavailable: 1
-  #
-  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
-  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #   unhealthyPodEvictionPolicy: AlwaysAllow
-  #
-  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
-  #
-  # podDisruptionBudget: {}
-  #
-  podDisruptionBudget: {}
-
-  # Sets the per-pod terminationGracePeriodSeconds setting.
-  terminationGracePeriodSeconds: 30
-
-  # A list of `Volumes` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumes: []
-
-  # A list of `VolumeMounts` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumeMounts: []
-
-  # Configure this to a higher priority class in order to make sure your Istio gateway pods
-  # will not be killed because of low priority class.
-  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-  # for more detail.
-  priorityClassName: ""
diff --git a/resources/v1.24.4/charts/istiod/Chart.yaml b/resources/v1.24.4/charts/istiod/Chart.yaml
deleted file mode 100644
index 59f0995db..000000000
--- a/resources/v1.24.4/charts/istiod/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.4
-description: Helm chart for istio control plane
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- istiod
-- istio-discovery
-name: istiod
-sources:
-- https://github.com/istio/istio
-version: 1.24.4
diff --git a/resources/v1.24.4/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.24.4/charts/istiod/files/gateway-injection-template.yaml
deleted file mode 100644
index dbd83cc57..000000000
--- a/resources/v1.24.4/charts/istiod/files/gateway-injection-template.yaml
+++ /dev/null
@@ -1,253 +0,0 @@
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations:
-    istio.io/rev: {{ .Revision | default "default" | quote }}
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- end }}
-spec:
-  securityContext:
-  {{- if .Values.gateways.securityContext }}
-    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
-  {{- else }}
-    sysctls:
-    - name: net.ipv4.ip_unprivileged_port_start
-      value: "0"
-  {{- end }}
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - router
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- end }}
-    securityContext:
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-    env:
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-  volumes:
-  - emptyDir: {}
-    name: workload-socket
-  - emptyDir: {}
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else}}
-  - emptyDir: {}
-    name: workload-certs
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.4/charts/istiod/files/grpc-agent.yaml b/resources/v1.24.4/charts/istiod/files/grpc-agent.yaml
deleted file mode 100644
index 7290fcdca..000000000
--- a/resources/v1.24.4/charts/istiod/files/grpc-agent.yaml
+++ /dev/null
@@ -1,310 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-    sidecar.istio.io/rewriteAppHTTPProbers: "false",
-  }
-spec:
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15020
-      protocol: TCP
-      name: mesh-metrics
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-          - --url=http://localhost:15020/healthz/ready
-    env:
-    - name: ISTIO_META_GENERATOR
-      value: grpc
-    - name: OUTPUT_CERTS
-      value: /var/lib/istio/data
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    # grpc uses xds:/// to resolve – no need to resolve VIP
-    - name: ISTIO_META_DNS_CAPTURE
-      value: "false"
-    - name: DISABLE_ENVOY
-      value: "true"
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15020
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # UDS channel between istioagent and gRPC client for XDS/SDS
-    - mountPath: /etc/istio/proxy
-      name: istio-xds
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-{{- range $index, $container := .Spec.Containers  }}
-{{ if not (eq $container.Name "istio-proxy") }}
-  - name: {{ $container.Name }}
-    env:
-      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
-        value: "true"
-      - name: "GRPC_XDS_BOOTSTRAP"
-        value: "/etc/istio/proxy/grpc-bootstrap.json"
-    volumeMounts:
-      - mountPath: /var/lib/istio/data
-        name: istio-data
-      # UDS channel between istioagent and gRPC client for XDS/SDS
-      - mountPath: /etc/istio/proxy
-        name: istio-xds
-      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-        readOnly: true
-      {{- else }}
-      - name: workload-certs
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-      {{- end }}
-{{- end }}
-{{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-xds
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.4/charts/istiod/files/injection-template.yaml b/resources/v1.24.4/charts/istiod/files/injection-template.yaml
deleted file mode 100644
index 0ef948e6a..000000000
--- a/resources/v1.24.4/charts/istiod/files/injection-template.yaml
+++ /dev/null
@@ -1,510 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
-    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
-    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
-    {{- end }}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-{{- if .Values.pilot.cni.enabled }}
-    {{- if eq .Values.pilot.cni.provider "multus" }}
-    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
-    {{- end }}
-    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}traffic.sidecar.istio.io/includeInboundPorts: "{{.}}",{{ end }}
-    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
-    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
-    {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
-    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
-    {{- end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
-{{- end }}
-  }
-spec:
-  {{- $holdProxy := and
-      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
-      (not $nativeSidecar) }}
-  initContainers:
-  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
-  {{ if .Values.pilot.cni.enabled -}}
-  - name: istio-validation
-  {{ else -}}
-  - name: istio-init
-  {{ end -}}
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    args:
-    - istio-iptables
-    - "-p"
-    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
-    - "-z"
-    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
-    - "-u"
-    - {{ .ProxyUID | default "1337" | quote }}
-    - "-m"
-    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
-    - "-i"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
-    - "-x"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
-    - "-b"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
-    - "-d"
-  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
-    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
-  {{- else }}
-    - "15090,15021"
-  {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
-    - "-q"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
-    {{ end -}}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
-    - "-o"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
-    {{ end -}}
-     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
-    - "-c"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
-    {{ end -}}
-    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
-    {{ if .Values.global.logAsJson -}}
-    - "--log_as_json"
-    {{ end -}}
-    {{ if .Values.pilot.cni.enabled -}}
-    - "--run-validation"
-    - "--skip-rule-apply"
-    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
-    - "--force-apply"
-    {{ end -}}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-  {{- if .ProxyConfig.ProxyMetadata }}
-    env:
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-  {{- end }}
-    resources:
-  {{ template "resources" . }}
-    securityContext:
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      privileged: {{ .Values.global.proxy.privileged }}
-      capabilities:
-    {{- if not .Values.pilot.cni.enabled }}
-        add:
-        - NET_ADMIN
-        - NET_RAW
-    {{- end }}
-        drop:
-        - ALL
-    {{- if not .Values.pilot.cni.enabled }}
-      readOnlyRootFilesystem: false
-      runAsGroup: 0
-      runAsNonRoot: false
-      runAsUser: 0
-    {{- else }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsNonRoot: true
-    {{- end }}
-  {{ end -}}
-  {{ if not $nativeSidecar }}
-  containers:
-  {{ end }}
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.outlierLogPath }}
-    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-  {{- end}}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- else if $holdProxy }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-  {{- else if $nativeSidecar }}
-    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
-    lifecycle:
-      preStop:
-        exec:
-          command:
-          - pilot-agent
-          - request
-          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
-          - POST
-          - drain
-  {{- end }}
-    env:
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - name: ISTIO_BOOTSTRAP_OVERRIDE
-      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
-    {{- end }}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-  {{ if .Values.global.proxy.startupProbe.enabled }}
-    startupProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: 0
-      periodSeconds: 1
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
-  {{ end }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    {{ end -}}
-    securityContext:
-      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
-      allowPrivilegeEscalation: true
-      capabilities:
-        add:
-        - NET_ADMIN
-        drop:
-        - ALL
-      privileged: true
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else }}
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      capabilities:
-        {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-        add:
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
-        - NET_ADMIN
-        {{- end }}
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
-        - NET_BIND_SERVICE
-        {{- end }}
-        {{- end }}
-        drop:
-        - ALL
-      privileged: {{ .Values.global.proxy.privileged }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else -}}
-      runAsNonRoot: true
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      {{- end }}
-      {{- end }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - mountPath: /etc/istio/custom-bootstrap
-      name: custom-bootstrap-volume
-    {{- end }}
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
-      name: lightstep-certs
-      readOnly: true
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  - emptyDir:
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-  - name: lightstep-certs
-    secret:
-      optional: true
-      secretName: lightstep.cacert
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.4/charts/istiod/files/kube-gateway.yaml b/resources/v1.24.4/charts/istiod/files/kube-gateway.yaml
deleted file mode 100644
index dbe158de1..000000000
--- a/resources/v1.24.4/charts/istiod/files/kube-gateway.yaml
+++ /dev/null
@@ -1,345 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-gateway-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": {{.Name}}
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-gateway-controller"
-          ) | nindent 8 }}
-    spec:
-      securityContext:
-      {{- if .Values.gateways.securityContext }}
-        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
-      {{- else }}
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- if .Values.gateways.seccompProfile }}
-        seccompProfile:
-      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
-      {{- end }}
-      {{- end }}
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-      {{- else }}
-        image: "{{ .ProxyImage }}"
-      {{- end }}
-        {{- if .Values.global.proxy.resources }}
-        resources:
-          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsUser: {{ .ProxyUID | default "1337" }}
-          runAsGroup: {{ .ProxyGID | default "1337" }}
-          runAsNonRoot: true
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        args:
-        - proxy
-        - router
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-      {{- if .Values.global.sts.servicePort }}
-        - --stsPort={{ .Values.global.sts.servicePort }}
-      {{- end }}
-      {{- if .Values.global.logAsJson }}
-        - --log_as_json
-      {{- end }}
-      {{- if .Values.global.proxy.lifecycle }}
-        lifecycle:
-          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
-      {{- end }}
-        env:
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        - name: ISTIO_META_POD_PORTS
-          value: "[]"
-        - name: ISTIO_META_APP_CONTAINERS
-          value: ""
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: "{{ .ProxyConfig.InterceptionMode.String }}"
-        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
-        - name: ISTIO_META_NETWORK
-          value: {{.|quote}}
-        {{- end }}
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName|quote}}
-        - name: ISTIO_META_OWNER
-          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
-        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-          value: {{.|quote}}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        volumeMounts:
-        - name: workload-socket
-          mountPath: /var/run/secrets/workload-spiffe-uds
-        - name: credential-socket
-          mountPath: /var/run/secrets/credential-uds
-        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-        - name: gke-workload-certificate
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-          readOnly: true
-        {{- else }}
-        - name: workload-certs
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-        {{- end }}
-        {{- if eq .Values.global.pilotCertProvider "istiod" }}
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        {{- end }}
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        # SDS channel between istioagent and Envoy
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - name: istio-podinfo
-          mountPath: /etc/istio/pod
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir: {}
-        name: credential-socket
-      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        csi:
-          driver: workloadcertificates.security.cloud.google.com
-      {{- else}}
-      - emptyDir: {}
-        name: workload-certs
-      {{- end }}
-      # SDS channel between istioagent and Envoy
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - name: istio-data
-        emptyDir: {}
-      - name: istio-podinfo
-        downwardAPI:
-          items:
-            - path: "labels"
-              fieldRef:
-                fieldPath: metadata.labels
-            - path: "annotations"
-              fieldRef:
-                fieldPath: metadata.annotations
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: {{ .Values.global.sds.token.aud }}
-      {{- if eq .Values.global.pilotCertProvider "istiod" }}
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: {{.UID}}
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": {{.Name}}
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.24.4/charts/istiod/files/profile-ambient.yaml b/resources/v1.24.4/charts/istiod/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.4/charts/istiod/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.4/charts/istiod/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.4/charts/istiod/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.4/charts/istiod/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.4/charts/istiod/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.4/charts/istiod/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.4/charts/istiod/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.4/charts/istiod/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.4/charts/istiod/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.4/charts/istiod/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.4/charts/istiod/files/profile-demo.yaml b/resources/v1.24.4/charts/istiod/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.4/charts/istiod/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.4/charts/istiod/files/profile-platform-k3s.yaml b/resources/v1.24.4/charts/istiod/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.4/charts/istiod/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.4/charts/istiod/files/waypoint.yaml b/resources/v1.24.4/charts/istiod/files/waypoint.yaml
deleted file mode 100644
index 07a420878..000000000
--- a/resources/v1.24.4/charts/istiod/files/waypoint.yaml
+++ /dev/null
@@ -1,336 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-mesh-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": "{{.Name}}"
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "istio.io/dataplane-mode" "none"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-mesh-controller"
-          ) | nindent 8}}
-    spec:
-      {{- if .Values.global.waypoint.affinity }}
-      affinity:
-      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.topologySpreadConstraints }}
-      topologySpreadConstraints:
-      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.nodeSelector }}
-      nodeSelector:
-      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.tolerations }}
-      tolerations:
-      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: 2
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-        {{- else }}
-        image: "{{ .ProxyImage }}"
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        args:
-        - proxy
-        - waypoint
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --serviceCluster
-        - {{.ServiceAccount}}.$(POD_NAMESPACE)
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-        {{- if .Values.global.logAsJson }}
-        - --log_as_json
-        {{- end }}
-        {{- if .Values.global.proxy.outlierLogPath }}
-        - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-        {{- end}}
-        env:
-        - name: ISTIO_META_SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        {{- if .ProxyConfig.ProxyMetadata }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
-        {{- if $network }}
-        - name: ISTIO_META_NETWORK
-          value: "{{ $network }}"
-        {{- end }}
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: REDIRECT
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName}}
-        - name: ISTIO_META_OWNER
-          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- if .Values.global.waypoint.resources }}
-        resources:
-        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        securityContext:
-          privileged: false
-        {{- if not (eq .Values.global.platform "openshift") }}
-          runAsGroup: 1337
-          runAsUser: 1337
-        {{- end }}
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-            - ALL
-{{- if .Values.gateways.seccompProfile }}
-          seccompProfile:
-{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
-{{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/workload-spiffe-uds
-          name: workload-socket
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /etc/istio/pod
-          name: istio-podinfo
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - emptyDir:
-          medium: Memory
-        name: go-proxy-envoy
-      - emptyDir: {}
-        name: istio-data
-      - emptyDir: {}
-        name: go-proxy-data
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.labels
-            path: labels
-          - fieldRef:
-              fieldPath: metadata.annotations
-            path: annotations
-        name: istio-podinfo
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              audience: istio-ca
-              expirationSeconds: 43200
-              path: istio-token
-      - configMap:
-          name: istio-ca-root-cert
-        name: istiod-ca-cert
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap
-      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
-      (omit .InfrastructureAnnotations
-        "kubectl.kubernetes.io/last-applied-configuration"
-        "gateway.istio.io/name-override"
-        "gateway.istio.io/service-account"
-        "gateway.istio.io/controller-version"
-      ) | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": "{{.Name}}"
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.24.4/charts/istiod/templates/autoscale.yaml b/resources/v1.24.4/charts/istiod/templates/autoscale.yaml
deleted file mode 100644
index 09cd6258c..000000000
--- a/resources/v1.24.4/charts/istiod/templates/autoscale.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if and .Values.autoscaleEnabled .Values.autoscaleMin .Values.autoscaleMax }}
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  maxReplicas: {{ .Values.autoscaleMax }}
-  minReplicas: {{ .Values.autoscaleMin }}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  metrics:
-  - type: Resource
-    resource:
-      name: cpu
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.cpu.targetAverageUtilization }}
-  {{- if .Values.memory.targetAverageUtilization }}
-  - type: Resource
-    resource:
-      name: memory
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.memory.targetAverageUtilization }}
-  {{- end }}
-  {{- if .Values.autoscaleBehavior }}
-  behavior: {{ toYaml .Values.autoscaleBehavior | nindent 4 }}
-  {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/clusterrole.yaml b/resources/v1.24.4/charts/istiod/templates/clusterrole.yaml
deleted file mode 100644
index 0c340b5b3..000000000
--- a/resources/v1.24.4/charts/istiod/templates/clusterrole.yaml
+++ /dev/null
@@ -1,187 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  # sidecar injection controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-
-  # configuration validation webhook controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-
-  # istio configuration
-  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
-  # please proceed with caution
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["get", "watch", "list"]
-    resources: ["*"]
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["update", "patch"]
-    resources:
-    - authorizationpolicies/status
-    - destinationrules/status
-    - envoyfilters/status
-    - gateways/status
-    - peerauthentications/status
-    - proxyconfigs/status
-    - requestauthentications/status
-    - serviceentries/status
-    - sidecars/status
-    - telemetries/status
-    - virtualservices/status
-    - wasmplugins/status
-    - workloadentries/status
-    - workloadgroups/status
-{{- end }}
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries/status",  "serviceentries/status" ]
-  - apiGroups: ["security.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "authorizationpolicies/status" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services/status" ]
-
-  # auto-detect installed CRD definitions
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-
-  # discovery and routing
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-
-{{- if .Values.taint.enabled }}
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["patch"]
-{{- end }}
-
-  # ingress controller
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-{{- end}}
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses", "ingressclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-
-  # required for CA's namespace controller
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-
-  # Istiod and bootstrap.
-{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
-{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "certificatesigningrequests"
-      - "certificatesigningrequests/approval"
-      - "certificatesigningrequests/status"
-    verbs: ["update", "create", "get", "delete", "watch"]
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "signers"
-    resourceNames:
-{{- range .Values.global.certSigners }}
-    - {{ . | quote }}
-{{- end }}
-    verbs: ["approve"]
-{{- end}}
-
-  # Used by Istiod to verify the JWT tokens
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-
-  # Used by Istiod to verify gateway SDS
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-
-  # Use for Kubernetes Service APIs
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources:
-    - backendtlspolicies/status
-    - gatewayclasses/status
-    - gateways/status
-    - grpcroutes/status
-    - httproutes/status
-    - referencegrants/status
-    - tcproutes/status
-    - tlsroutes/status
-    - udproutes/status
-    verbs: ["update", "patch"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["gatewayclasses"]
-    verbs: ["create", "update", "patch", "delete"]
-
-  # Needed for multicluster secret reading, possibly ingress certs in the future
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "watch", "list"]
-
-  # Used for MCS serviceexport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: [ "get", "watch", "list", "create", "delete"]
-
-  # Used for MCS serviceimport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "watch", "list"]
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: ["apps"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "deployments" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "serviceaccounts"]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.24.4/charts/istiod/templates/clusterrolebinding.yaml
deleted file mode 100644
index 10781b407..000000000
--- a/resources/v1.24.4/charts/istiod/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-- kind: ServiceAccount
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.24.4/charts/istiod/templates/configmap-jwks.yaml
deleted file mode 100644
index 3505d2822..000000000
--- a/resources/v1.24.4/charts/istiod/templates/configmap-jwks.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.jwksResolverExtraRootCA }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  extra.pem: {{ .Values.jwksResolverExtraRootCA | quote }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/configmap-values.yaml b/resources/v1.24.4/charts/istiod/templates/configmap-values.yaml
deleted file mode 100644
index a7e60369d..000000000
--- a/resources/v1.24.4/charts/istiod/templates/configmap-values.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  original-values: |-
-{{ .Values._original | toPrettyJson | indent 4 }}
-{{- $_ := unset $.Values "_original" }}
-  merged-values: |-
-{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.24.4/charts/istiod/templates/configmap.yaml b/resources/v1.24.4/charts/istiod/templates/configmap.yaml
deleted file mode 100644
index 57702ea53..000000000
--- a/resources/v1.24.4/charts/istiod/templates/configmap.yaml
+++ /dev/null
@@ -1,109 +0,0 @@
-{{- define "mesh" }}
-    # The trust domain corresponds to the trust root of a system.
-    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
-    trustDomain: "cluster.local"
-
-    # The namespace to treat as the administrative root namespace for Istio configuration.
-    # When processing a leaf namespace Istio will search for declarations in that namespace first
-    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
-    # is processed as if it were declared in the leaf namespace.
-    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
-
-  {{ $prom := include "default-prometheus" . | eq "true" }}
-  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
-  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
-  {{- if or $prom $sdMetrics $sdLogs }}
-    defaultProviders:
-    {{- if or $prom $sdMetrics }}
-      metrics:
-      {{ if $prom }}- prometheus{{ end }}
-      {{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
-    {{- end }}
-    {{- if and $sdMetrics $sdLogs }}
-      accessLogging:
-      - stackdriver
-    {{- end }}
-  {{- end }}
-
-    defaultConfig:
-      {{- if .Values.global.meshID }}
-      meshId: "{{ .Values.global.meshID }}"
-      {{- end }}
-      {{- with (.Values.global.proxy.variant | default .Values.global.variant) }}
-      image:
-        imageType: {{. | quote}}
-      {{- end }}
-      {{- if not (eq .Values.global.proxy.tracer "none") }}
-      tracing:
-      {{- if eq .Values.global.proxy.tracer "lightstep" }}
-        lightstep:
-          # Address of the LightStep Satellite pool
-          address: {{ .Values.global.tracer.lightstep.address }}
-          # Access Token used to communicate with the Satellite pool
-          accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
-      {{- else if eq .Values.global.proxy.tracer "zipkin" }}
-        zipkin:
-          # Address of the Zipkin collector
-          address: {{ ((.Values.global.tracer).zipkin).address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
-      {{- else if eq .Values.global.proxy.tracer "datadog" }}
-        datadog:
-          # Address of the Datadog Agent
-          address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
-      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
-        stackdriver:
-          # enables trace output to stdout.
-          debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}
-          # The global default max number of attributes per span.
-          maxNumberOfAttributes: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAttributes | default "200" }}
-          # The global default max number of annotation events per span.
-          maxNumberOfAnnotations: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAnnotations | default "200" }}
-          # The global default max number of message events per span.
-          maxNumberOfMessageEvents: {{ (($.Values.global.tracer).stackdriver).maxNumberOfMessageEvents | default "200" }}
-      {{- else if eq .Values.global.proxy.tracer "openCensusAgent" }}
-      {{/* Fill in openCensusAgent configuration from meshConfig so it isn't overwritten below */}}
-{{ toYaml $.Values.meshConfig.defaultConfig.tracing | indent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- if .Values.global.remotePilotAddress }}
-      discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
-      {{- else }}
-      discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
-      {{- end }}
-{{- end }}
-
-{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
-{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
-{{- $originalMesh := include "mesh" . | fromYaml }}
-{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
-
-{{- if .Values.configMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-
-  # Configuration file for the mesh networks to be used by the Split Horizon EDS.
-  meshNetworks: |-
-  {{- if .Values.global.meshNetworks }}
-    networks:
-{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
-  {{- else }}
-    networks: {}
-  {{- end }}
-
-  mesh: |-
-{{- if .Values.meshConfig }}
-{{ $mesh | toYaml | indent 4 }}
-{{- else }}
-{{- include "mesh" . }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/deployment.yaml b/resources/v1.24.4/charts/istiod/templates/deployment.yaml
deleted file mode 100644
index cd48ab757..000000000
--- a/resources/v1.24.4/charts/istiod/templates/deployment.yaml
+++ /dev/null
@@ -1,290 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- range $key, $val := .Values.deploymentLabels }}
-    {{ $key }}: "{{ $val }}"
-{{- end }}
-spec:
-{{- if not .Values.autoscaleEnabled }}
-{{- if .Values.replicaCount }}
-  replicas: {{ .Values.replicaCount }}
-{{- end }}
-{{- end }}
-  strategy:
-    rollingUpdate:
-      maxSurge: {{ .Values.rollingMaxSurge }}
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  selector:
-    matchLabels:
-      {{- if ne .Values.revision "" }}
-      app: istiod
-      istio.io/rev: {{ .Values.revision | default "default" | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
-  template:
-    metadata:
-      labels:
-        app: istiod
-        istio.io/rev: {{ .Values.revision | default "default" | quote }}
-        sidecar.istio.io/inject: "false"
-        operator.istio.io/component: "Pilot"
-        {{- if ne .Values.revision "" }}
-        istio: istiod
-        {{- else }}
-        istio: pilot
-        {{- end }}
-        {{- range $key, $val := .Values.podLabels }}
-        {{ $key }}: "{{ $val }}"
-        {{- end }}
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: "istiod"
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        prometheus.io/port: "15014"
-        prometheus.io/scrape: "true"
-        sidecar.istio.io/inject: "false"
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{- if .Values.nodeSelector }}
-      nodeSelector:
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- with .Values.affinity }}
-      affinity:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      tolerations:
-        - key: cni.istio.io/not-ready
-          operator: "Exists"
-{{- with .Values.tolerations }}
-{{- toYaml . | nindent 8 }}
-{{- end }}
-{{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- if .Values.global.priorityClassName }}
-      priorityClassName: "{{ .Values.global.priorityClassName }}"
-{{- end }}
-{{- with .Values.initContainers }}
-      initContainers:
-        {{- tpl (toYaml .) $ | nindent 8 }}
-{{- end }}
-      containers:
-        - name: discovery
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
-{{- end }}
-{{- if .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
-{{- end }}
-          args:
-          - "discovery"
-          - --monitoringAddr=:15014
-{{- if .Values.global.logging.level }}
-          - --log_output_level={{ .Values.global.logging.level }}
-{{- end}}
-{{- if .Values.global.logAsJson }}
-          - --log_as_json
-{{- end }}
-          - --domain
-          - {{ .Values.global.proxy.clusterDomain }}
-{{- if .Values.taint.namespace }}
-          - --cniNamespace={{ .Values.taint.namespace }}
-{{- end }}
-          - --keepaliveMaxServerConnectionAge
-          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
-{{- if .Values.extraContainerArgs }}
-          {{- with .Values.extraContainerArgs }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-{{- end }}
-          ports:
-          - containerPort: 8080
-            protocol: TCP
-            name: http-debug
-          - containerPort: 15010
-            protocol: TCP
-            name: grpc-xds
-          - containerPort: 15012
-            protocol: TCP
-            name: tls-xds
-          - containerPort: 15017
-            protocol: TCP
-            name: https-webhooks
-          - containerPort: 15014
-            protocol: TCP
-            name: http-monitoring
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 8080
-            initialDelaySeconds: 1
-            periodSeconds: 3
-            timeoutSeconds: 5
-          env:
-          - name: REVISION
-            value: "{{ .Values.revision | default `default` }}"
-          - name: PILOT_CERT_PROVIDER
-            value: {{ .Values.global.pilotCertProvider }}
-          - name: POD_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.name
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.namespace
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: spec.serviceAccountName
-          - name: KUBECONFIG
-            value: /var/run/secrets/remote/config
-          # If you explicitly told us where ztunnel lives, use that.
-          # Otherwise, assume it lives in our namespace
-          # Also, check for an explicit ENV override (legacy approach) and prefer that
-          # if present
-          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
-          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
-          - name: CA_TRUSTED_NODE_ACCOUNTS
-            value: "{{ $ztTrustedNS }}/ztunnel"
-          {{- end }}
-          {{- if .Values.env }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: "{{ $val }}"
-          {{- end }}
-          {{- end }}
-{{- if .Values.traceSampling }}
-          - name: PILOT_TRACE_SAMPLING
-            value: "{{ .Values.traceSampling }}"
-{{- end }}
-# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
-# don't set it here to avoid duplication.
-# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
-{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
-          - name: EXTERNAL_ISTIOD
-            value: "{{ .Values.global.externalIstiod }}"
-{{- end }}
-          - name: PILOT_ENABLE_ANALYSIS
-            value: "{{ .Values.global.istiod.enableAnalysis }}"
-          - name: CLUSTER_ID
-            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
-          - name: GOMEMLIMIT
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.memory
-          - name: GOMAXPROCS
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.cpu
-                divisor: "1"
-          - name: PLATFORM
-            value: "{{ coalesce .Values.global.platform .Values.platform }}"
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-              - ALL
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          volumeMounts:
-          - name: istio-token
-            mountPath: /var/run/secrets/tokens
-            readOnly: true
-          - name: local-certs
-            mountPath: /var/run/secrets/istio-dns
-          - name: cacerts
-            mountPath: /etc/cacerts
-            readOnly: true
-          - name: istio-kubeconfig
-            mountPath: /var/run/secrets/remote
-            readOnly: true
-          {{- if .Values.jwksResolverExtraRootCA }}
-          - name: extracacerts
-            mountPath: /cacerts
-          {{- end }}
-          - name: istio-csr-dns-cert
-            mountPath: /var/run/secrets/istiod/tls
-            readOnly: true
-          - name: istio-csr-ca-configmap
-            mountPath: /var/run/secrets/istiod/ca
-            readOnly: true
-          {{- with .Values.volumeMounts }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-      volumes:
-      # Technically not needed on this pod - but it helps debugging/testing SDS
-      # Should be removed after everything works.
-      - emptyDir:
-          medium: Memory
-        name: local-certs
-      - name: istio-token
-        projected:
-          sources:
-            - serviceAccountToken:
-                audience: {{ .Values.global.sds.token.aud }}
-                expirationSeconds: 43200
-                path: istio-token
-      # Optional: user-generated root
-      - name: cacerts
-        secret:
-          secretName: cacerts
-          optional: true
-      - name: istio-kubeconfig
-        secret:
-          secretName: istio-kubeconfig
-          optional: true
-      # Optional: istio-csr dns pilot certs
-      - name: istio-csr-dns-cert
-        secret:
-          secretName: istiod-tls
-          optional: true
-      - name: istio-csr-ca-configmap
-        configMap:
-          name: istio-ca-root-cert
-          defaultMode: 420
-          optional: true
-  {{- if .Values.jwksResolverExtraRootCA }}
-      - name: extracacerts
-        configMap:
-          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  {{- end }}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
-
----
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.24.4/charts/istiod/templates/istiod-injector-configmap.yaml
deleted file mode 100644
index 560c284ff..000000000
--- a/resources/v1.24.4/charts/istiod/templates/istiod-injector-configmap.yaml
+++ /dev/null
@@ -1,81 +0,0 @@
-{{- if not .Values.global.omitSidecarInjectorConfigMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
-  values: |-
-{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
-{{ $pilotVals := pick .Values "cni" -}}
-{{ $vals = set $vals "pilot" $pilotVals -}}
-{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
-{{ $vals = set $vals "gateways" $gatewayVals -}}
-{{ $vals | toPrettyJson | indent 4 }}
-
-  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
-  # and istiod webhook functionality.
-  #
-  # New fields should not use Values - it is a 'primary' config object, users should be able
-  # to fine tune it or use it with kube-inject.
-  config: |-
-    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
-    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
-    defaultTemplates:
-{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
-    - {{ . }}
-{{- end }}
-    {{- else }}
-    defaultTemplates: [sidecar]
-    {{- end }}
-    policy: {{ .Values.global.proxy.autoInject }}
-    alwaysInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
-    neverInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
-    injectedAnnotations:
-      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
-      "{{ $key }}": {{ $val | quote }}
-      {{- end }}
-    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
-         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
-         This should make it obvious that their installation is broken.
-     */}}
-    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
-    templates:
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
-      sidecar: |
-{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
-      gateway: |
-{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
-      grpc-simple: |
-{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
-      grpc-agent: |
-{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
-      waypoint: |
-{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
-      kube-gateway: |
-{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
-{{- end }}
-{{- with .Values.sidecarInjectorWebhook.templates }}
-{{ toYaml . | trim | indent 6 }}
-{{- end }}
-
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.24.4/charts/istiod/templates/mutatingwebhook.yaml
deleted file mode 100644
index 22160f70a..000000000
--- a/resources/v1.24.4/charts/istiod/templates/mutatingwebhook.yaml
+++ /dev/null
@@ -1,164 +0,0 @@
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- /* Core defines the common configuration used by all webhook segments */}}
-{{/* Copy just what we need to avoid expensive deepCopy */}}
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "caBundle" .Values.istiodRemote.injectionCABundle
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-    {{- if .caBundle }}
-    caBundle: "{{ .caBundle }}"
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  reinvocationPolicy: "{{ .reinvocationPolicy }}"
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
-{{- if not .Values.global.operatorManageWebhooks }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq .Release.Namespace "istio-system"}}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- else }}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
-
-{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
-{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-
-
-{{- /* Webhooks for default revision */}}
-{{- if (eq .Values.revision "") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.24.4/charts/istiod/templates/poddisruptionbudget.yaml
deleted file mode 100644
index 1eacf16e6..000000000
--- a/resources/v1.24.4/charts/istiod/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    istio: pilot
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app: istiod
-      {{- if ne .Values.revision "" }}
-      istio.io/rev: {{ .Values.revision | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.24.4/charts/istiod/templates/reader-clusterrole.yaml
deleted file mode 100644
index dbaa80503..000000000
--- a/resources/v1.24.4/charts/istiod/templates/reader-clusterrole.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - "config.istio.io"
-      - "security.istio.io"
-      - "networking.istio.io"
-      - "authentication.istio.io"
-      - "rbac.istio.io"
-      - "telemetry.istio.io"
-      - "extensions.istio.io"
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
-    resources: ["gateways"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: ["get", "list", "watch", "create", "delete"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["apps"]
-    resources: ["replicasets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-{{- if .Values.istiodRemote.enabled }}
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-{{- end}}
diff --git a/resources/v1.24.4/charts/istiod/templates/remote-istiod-endpoints.yaml b/resources/v1.24.4/charts/istiod/templates/remote-istiod-endpoints.yaml
deleted file mode 100644
index a6de571da..000000000
--- a/resources/v1.24.4/charts/istiod/templates/remote-istiod-endpoints.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-# if the remotePilotAddress is an IP addr
-{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-subsets:
-- addresses:
-  - ip: {{ .Values.global.remotePilotAddress }}
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 15017
-    name: tcp-webhook
-    protocol: TCP
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.24.4/charts/istiod/templates/remote-istiod-service.yaml
deleted file mode 100644
index 220277dc0..000000000
--- a/resources/v1.24.4/charts/istiod/templates/remote-istiod-service.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 443
-    targetPort: 15017
-    name: tcp-webhook
-    protocol: TCP
-  {{- if and .Values.global.remotePilotAddress (not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress)) }}
-  # if the remotePilotAddress is not an IP addr, we use ExternalName
-  type: ExternalName
-  externalName: {{ .Values.global.remotePilotAddress }}
-  {{- end }}
-{{- if .Values.global.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.global.ipFamilies }}
-  ipFamilies:
-{{- range .Values.global.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/revision-tags.yaml b/resources/v1.24.4/charts/istiod/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.24.4/charts/istiod/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/role.yaml b/resources/v1.24.4/charts/istiod/templates/role.yaml
deleted file mode 100644
index 10d89e8d1..000000000
--- a/resources/v1.24.4/charts/istiod/templates/role.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-# permissions to verify the webhook is ready and rejecting
-# invalid config. We use --server-dry-run so no config is persisted.
-- apiGroups: ["networking.istio.io"]
-  verbs: ["create"]
-  resources: ["gateways"]
-
-# For storing CA secret
-- apiGroups: [""]
-  resources: ["secrets"]
-  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
-  verbs: ["create", "get", "watch", "list", "update", "delete"]
-
-# For status controller, so it can delete the distribution report configmap
-- apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["delete"]
-
-# For gateway deployment controller
-- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
-  verbs: ["get", "update", "patch", "create"]
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/rolebinding.yaml b/resources/v1.24.4/charts/istiod/templates/rolebinding.yaml
deleted file mode 100644
index a42f4ec44..000000000
--- a/resources/v1.24.4/charts/istiod/templates/rolebinding.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/service.yaml b/resources/v1.24.4/charts/istiod/templates/service.yaml
deleted file mode 100644
index 30d5b8912..000000000
--- a/resources/v1.24.4/charts/istiod/templates/service.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  {{- if .Values.serviceAnnotations }}
-  annotations:
-{{ toYaml .Values.serviceAnnotations | indent 4 }}
-  {{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: istiod
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-    - port: 15010
-      name: grpc-xds # plaintext
-      protocol: TCP
-    - port: 15012
-      name: https-dns # mTLS with k8s-signed cert
-      protocol: TCP
-    - port: 443
-      name: https-webhook # validation and injection
-      targetPort: 15017
-      protocol: TCP
-    - port: 15014
-      name: http-monitoring # prometheus stats
-      protocol: TCP
-  selector:
-    app: istiod
-    {{- if ne .Values.revision "" }}
-    istio.io/rev: {{ .Values.revision | quote }}
-    {{- else }}
-    # Label used by the 'default' service. For versioned deployments we match with app and version.
-    # This avoids default deployment picking the canary
-    istio: pilot
-    {{- end }}
-  {{- if .Values.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.ipFamilyPolicy }}
-  {{- end }}
-  {{- if .Values.ipFamilies }}
-  ipFamilies:
-  {{- range .Values.ipFamilies }}
-  - {{ . }}
-  {{- end }}
-  {{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.24.4/charts/istiod/templates/validatingadmissionpolicy.yaml
deleted file mode 100644
index d36eef68e..000000000
--- a/resources/v1.24.4/charts/istiod/templates/validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.experimental.stableValidationPolicy }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-policy-binding{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-spec:
-  policyName: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  validationActions: [Deny]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.24.4/charts/istiod/templates/validatingwebhookconfiguration.yaml
deleted file mode 100644
index fb28836a0..000000000
--- a/resources/v1.24.4/charts/istiod/templates/validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,68 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.global.configValidation }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  # Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
-  # are rejecting invalid configs on a per-revision basis.
-  - name: rev.validation.istio.io
-    clientConfig:
-      # Should change from base but cannot for API compat
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/zzz_profile.yaml b/resources/v1.24.4/charts/istiod/templates/zzz_profile.yaml
deleted file mode 100644
index 52f665fbd..000000000
--- a/resources/v1.24.4/charts/istiod/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $x := set $.Values "_original" (deepCopy $.Values) }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.4/charts/istiod/values.yaml b/resources/v1.24.4/charts/istiod/values.yaml
deleted file mode 100644
index edc2232d1..000000000
--- a/resources/v1.24.4/charts/istiod/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.24.4
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.24.4/charts/revisiontags/Chart.yaml b/resources/v1.24.4/charts/revisiontags/Chart.yaml
deleted file mode 100644
index b12486748..000000000
--- a/resources/v1.24.4/charts/revisiontags/Chart.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.4
-description: Helm chart for istio revision tags
-name: revisiontags
-sources:
-- https://github.com/istio-ecosystem/sail-operator
-version: 0.1.0
-
diff --git a/resources/v1.24.4/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.24.4/charts/revisiontags/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.4/charts/revisiontags/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.4/charts/revisiontags/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.4/charts/revisiontags/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.4/charts/revisiontags/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.4/charts/revisiontags/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.4/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.4/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.4/charts/revisiontags/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.4/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.4/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.4/charts/revisiontags/files/profile-demo.yaml b/resources/v1.24.4/charts/revisiontags/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.4/charts/revisiontags/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.4/charts/revisiontags/files/profile-platform-k3s.yaml b/resources/v1.24.4/charts/revisiontags/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.4/charts/revisiontags/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.4/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.24.4/charts/revisiontags/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.24.4/charts/revisiontags/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.4/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.24.4/charts/revisiontags/templates/zzz_profile.yaml
deleted file mode 100644
index 52f665fbd..000000000
--- a/resources/v1.24.4/charts/revisiontags/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $x := set $.Values "_original" (deepCopy $.Values) }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.4/charts/revisiontags/values.yaml b/resources/v1.24.4/charts/revisiontags/values.yaml
deleted file mode 100644
index edc2232d1..000000000
--- a/resources/v1.24.4/charts/revisiontags/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.24.4
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.24.4/charts/ztunnel/Chart.yaml b/resources/v1.24.4/charts/ztunnel/Chart.yaml
deleted file mode 100644
index f1efc492b..000000000
--- a/resources/v1.24.4/charts/ztunnel/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.4
-description: Helm chart for istio ztunnel components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-ztunnel
-- istio
-name: ztunnel
-sources:
-- https://github.com/istio/istio
-version: 1.24.4
diff --git a/resources/v1.24.4/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.24.4/charts/ztunnel/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.4/charts/ztunnel/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.4/charts/ztunnel/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.4/charts/ztunnel/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.4/charts/ztunnel/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.4/charts/ztunnel/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.4/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.4/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.4/charts/ztunnel/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.4/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.4/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.4/charts/ztunnel/files/profile-demo.yaml b/resources/v1.24.4/charts/ztunnel/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.4/charts/ztunnel/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.4/charts/ztunnel/files/profile-platform-k3s.yaml b/resources/v1.24.4/charts/ztunnel/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.4/charts/ztunnel/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.4/charts/ztunnel/templates/daemonset.yaml b/resources/v1.24.4/charts/ztunnel/templates/daemonset.yaml
deleted file mode 100644
index c6e2daf48..000000000
--- a/resources/v1.24.4/charts/ztunnel/templates/daemonset.yaml
+++ /dev/null
@@ -1,197 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-spec:
-  updateStrategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app: ztunnel
-  template:
-    metadata:
-      labels:
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app: ztunnel
-        app.kubernetes.io/name: ztunnel
-        {{- include "istio.labels" . | nindent 8}}
-{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-{{- if .Values.revision }}
-        istio.io/rev: {{ .Values.revision }}
-{{- end }}
-{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-{{- if .Values.nodeSelector }}
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- if .Values.affinity }}
-      affinity:
-{{ toYaml .Values.affinity | trim | indent 8 }}
-{{- end }}
-      serviceAccountName: ztunnel
-      tolerations:
-        - effect: NoSchedule
-          operator: Exists
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      containers:
-      - name: istio-proxy
-{{- if contains "/" .Values.image }}
-        image: "{{ .Values.image }}"
-{{- else }}
-        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
-{{- end }}
-        ports:
-        - containerPort: 15020
-          name: ztunnel-stats
-          protocol: TCP
-        resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 10 }}
-{{- end }}
-{{- with .Values.imagePullPolicy }}
-        imagePullPolicy: {{ . }}
-{{- end }}
-        securityContext:
-          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
-          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
-          allowPrivilegeEscalation: true
-          privileged: false
-          capabilities:
-            drop:
-            - ALL
-            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
-            - NET_ADMIN # Required for TPROXY and setsockopt
-            - SYS_ADMIN # Required for `setns` - doing things in other netns
-            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
-          readOnlyRootFilesystem: true
-          runAsGroup: 1337
-          runAsNonRoot: false
-          runAsUser: 0
-{{- if .Values.seLinuxOptions }}
-          seLinuxOptions:
-{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
-{{- end }}
-        readinessProbe:
-          httpGet:
-            port: 15021
-            path: /healthz/ready
-        args:
-        - proxy
-        - ztunnel
-        env:
-        - name: CA_ADDRESS
-        {{- if .Values.caAddress }}
-          value: {{ .Values.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: XDS_ADDRESS
-        {{- if .Values.xdsAddress }}
-          value: {{ .Values.xdsAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        {{- if .Values.logAsJson }}
-        - name: LOG_FORMAT
-          value: json
-        {{- end}}
-        - name: RUST_LOG
-          value: {{ .Values.logLevel | quote }}
-        - name: RUST_BACKTRACE
-          value: "1"
-        - name: ISTIO_META_CLUSTER_ID
-          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
-        - name: INPOD_ENABLED
-          value: "true"
-        - name: TERMINATION_GRACE_PERIOD_SECONDS
-          value: "{{ .Values.terminationGracePeriodSeconds }}"
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
-        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        {{- with .Values.env }}
-        {{- range $key, $val := . }}
-        - name: {{ $key }}
-          value: "{{ $val }}"
-        {{- end }}
-        {{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /var/run/ztunnel
-          name: cni-ztunnel-sock-dir
-        - mountPath: /tmp
-          name: tmp
-        {{- with .Values.volumeMounts }}
-          {{- toYaml . | nindent 8 }}
-        {{- end }}
-      priorityClassName: system-node-critical
-      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
-      volumes:
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: istio-ca
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      - name: cni-ztunnel-sock-dir
-        hostPath:
-          path: /var/run/ztunnel
-          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
-      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
-      - name: tmp
-        emptyDir: {}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
diff --git a/resources/v1.24.4/charts/ztunnel/templates/rbac.yaml b/resources/v1.24.4/charts/ztunnel/templates/rbac.yaml
deleted file mode 100644
index 65bbea52b..000000000
--- a/resources/v1.24.4/charts/ztunnel/templates/rbac.yaml
+++ /dev/null
@@ -1,72 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-  {{- with .Values.imagePullSecrets }}
-imagePullSecrets:
-  {{- range . }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
----
-{{- if (eq (.Values.platform | default "") "openshift") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: ztunnel
-  labels:
-    app: ztunnel
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-rules:
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: ztunnel
-  labels:
-    app: ztunnel
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ztunnel
-subjects:
-- kind: ServiceAccount
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-{{- end }}
----
diff --git a/resources/v1.24.4/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.24.4/charts/ztunnel/templates/zzz_profile.yaml
deleted file mode 100644
index 72d3adc53..000000000
--- a/resources/v1.24.4/charts/ztunnel/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.4/charts/ztunnel/values.yaml b/resources/v1.24.4/charts/ztunnel/values.yaml
deleted file mode 100644
index 758ff8b5d..000000000
--- a/resources/v1.24.4/charts/ztunnel/values.yaml
+++ /dev/null
@@ -1,98 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
-  hub: gcr.io/istio-release
-  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
-  tag: 1.24.4
-  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
-  variant: ""
-
-  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
-  # If Image contains a "/", it will replace the entire `image` in the pod.
-  image: ztunnel
-
-  # Labels to apply to all top level resources
-  labels: {}
-  # Annotations to apply to all top level resources
-  annotations: {}
-
-  # Additional volumeMounts to the ztunnel container
-  volumeMounts: []
-
-  # Additional volumes to the ztunnel pod
-  volumes: []
-
-  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-
-  # Additional labels to apply on the pod level
-  podLabels: {}
-
-  # Pod resource configuration
-  resources:
-    requests:
-      cpu: 200m
-      # Ztunnel memory scales with the size of the cluster and traffic load
-      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
-      memory: 512Mi
-
-  # List of secret names to add to the service account as image pull secrets
-  imagePullSecrets: []
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
-
-  # Override for the pod imagePullPolicy
-  imagePullPolicy: ""
-
-  # Settings for multicluster
-  multiCluster:
-    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
-    # with Istiod configuration.
-    clusterName: ""
-
-  # meshConfig defines runtime configuration of components.
-  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
-  # components.
-  # TODO: https://github.com/istio/istio/issues/43248
-  meshConfig:
-    defaultConfig:
-      proxyMetadata: {}
-
-  # This value defines:
-  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
-  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
-  # Default K8S value is 30 seconds
-  terminationGracePeriodSeconds: 30
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
-  revision: ""
-
-  # The customized CA address to retrieve certificates for the pods in the cluster.
-  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-  caAddress: ""
-
-  # The customized XDS address to retrieve configuration.
-  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
-  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
-  xdsAddress: ""
-
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
-  istioNamespace: istio-system
-
-  # Configuration log level of ztunnel binary, default is info.
-  # Valid values are: trace, debug, info, warn, error
-  logLevel: info
-
-  # To output all logs in json format
-  logAsJson: false
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seLinuxOptions: {}
-  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
-  #seLinuxOptions:
-  #  type: spc_t
diff --git a/resources/v1.24.4/cni-1.24.4.tgz.etag b/resources/v1.24.4/cni-1.24.4.tgz.etag
deleted file mode 100644
index 1916acb56..000000000
--- a/resources/v1.24.4/cni-1.24.4.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-93b8f9875690b49d559b62d8ce298c29
diff --git a/resources/v1.24.4/commit b/resources/v1.24.4/commit
deleted file mode 100644
index 2f4320f67..000000000
--- a/resources/v1.24.4/commit
+++ /dev/null
@@ -1 +0,0 @@
-1.24.4
diff --git a/resources/v1.24.4/gateway-1.24.4.tgz.etag b/resources/v1.24.4/gateway-1.24.4.tgz.etag
deleted file mode 100644
index bb7ec3332..000000000
--- a/resources/v1.24.4/gateway-1.24.4.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-09f70f76ece3eabf262aad55183f8a9d
diff --git a/resources/v1.24.4/istiod-1.24.4.tgz.etag b/resources/v1.24.4/istiod-1.24.4.tgz.etag
deleted file mode 100644
index 313a35818..000000000
--- a/resources/v1.24.4/istiod-1.24.4.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-e1255676ff2b1f24f797364cceb12534
diff --git a/resources/v1.24.4/profiles/default.yaml b/resources/v1.24.4/profiles/default.yaml
deleted file mode 100644
index e9e0a3931..000000000
--- a/resources/v1.24.4/profiles/default.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  # Most default values come from the helm chart's values.yaml
-  # Below are the things that differ
-  values:
-    defaultRevision: ""
-    global:
-      istioNamespace: istio-system
-      configValidation: true
diff --git a/resources/v1.24.4/ztunnel-1.24.4.tgz.etag b/resources/v1.24.4/ztunnel-1.24.4.tgz.etag
deleted file mode 100644
index 0096a20b6..000000000
--- a/resources/v1.24.4/ztunnel-1.24.4.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-eff54f1ddd3c872d5be6033e34a18f97
diff --git a/resources/v1.24.5/base-1.24.5.tgz.etag b/resources/v1.24.5/base-1.24.5.tgz.etag
deleted file mode 100644
index e5b67229c..000000000
--- a/resources/v1.24.5/base-1.24.5.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-77be6d8f0af135f55b25439682ca9787
diff --git a/resources/v1.24.5/charts/base/Chart.yaml b/resources/v1.24.5/charts/base/Chart.yaml
deleted file mode 100644
index c23f951eb..000000000
--- a/resources/v1.24.5/charts/base/Chart.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.5
-description: Helm chart for deploying Istio cluster resources and CRDs
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-name: base
-sources:
-- https://github.com/istio/istio
-version: 1.24.5
diff --git a/resources/v1.24.5/charts/base/files/profile-ambient.yaml b/resources/v1.24.5/charts/base/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.5/charts/base/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.5/charts/base/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.5/charts/base/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.5/charts/base/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.5/charts/base/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.5/charts/base/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.5/charts/base/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.5/charts/base/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.5/charts/base/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.5/charts/base/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.5/charts/base/files/profile-demo.yaml b/resources/v1.24.5/charts/base/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.5/charts/base/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.5/charts/base/files/profile-platform-k3s.yaml b/resources/v1.24.5/charts/base/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.5/charts/base/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.5/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml b/resources/v1.24.5/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
deleted file mode 100644
index 2616b09c9..000000000
--- a/resources/v1.24.5/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,53 +0,0 @@
-{{- if and .Values.experimental.stableValidationPolicy (not (eq .Values.defaultRevision "")) }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-default-policy.istio.io"
-  labels:
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision }}
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-default-policy-binding.istio.io"
-spec:
-  policyName: "stable-channel-default-policy.istio.io"
-  validationActions: [Deny]
-{{- end }}
diff --git a/resources/v1.24.5/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml b/resources/v1.24.5/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
deleted file mode 100644
index 8cb76fd77..000000000
--- a/resources/v1.24.5/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-{{- if not (eq .Values.defaultRevision "") }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istiod-default-validator
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  - name: validation.istio.io
-    clientConfig:
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        {{- if (eq .Values.defaultRevision "default") }}
-        name: istiod
-        {{- else }}
-        name: istiod-{{ .Values.defaultRevision }}
-        {{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-{{- end }}
diff --git a/resources/v1.24.5/charts/base/templates/reader-serviceaccount.yaml b/resources/v1.24.5/charts/base/templates/reader-serviceaccount.yaml
deleted file mode 100644
index ba829a6bf..000000000
--- a/resources/v1.24.5/charts/base/templates/reader-serviceaccount.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-# This singleton service account aggregates reader permissions for the revisions in a given cluster
-# ATM this is a singleton per cluster with Istio installed, and is not revisioned. It maybe should be,
-# as otherwise compromising the token for this SA would give you access to *every* installed revision.
-# Should be used for remote secret creation.
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-    {{- end }}
-    {{- end }}
-metadata:
-  name: istio-reader-service-account
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.24.5/charts/base/templates/zzz_profile.yaml b/resources/v1.24.5/charts/base/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.5/charts/base/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.5/charts/base/values.yaml b/resources/v1.24.5/charts/base/values.yaml
deleted file mode 100644
index 98c9c3645..000000000
--- a/resources/v1.24.5/charts/base/values.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  global:
-
-    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-
-    # Used to locate istiod.
-    istioNamespace: istio-system
-
-    # Platform where Istio is deployed. Possible values are: "openshift", "gcp".
-    # An empty value means it is a vanilla Kubernetes distribution, therefore no special
-    # treatment will be considered.
-    platform: ""
-  base:
-    # A list of CRDs to exclude. Requires `enableCRDTemplates` to be true.
-    # Example: `excludedCRDs: ["envoyfilters.networking.istio.io"]`.
-    # Note: when installing with `istioctl`, `enableIstioConfigCRDs=false` must also be set.
-    excludedCRDs: []
-    # Helm (as of V3) does not support upgrading CRDs, because it is not universally
-    # safe for them to support this.
-    # Istio as a project enforces certain backwards-compat guarantees that allow us
-    # to safely upgrade CRDs in spite of this, so we default to self-managing CRDs
-    # as standard K8S resources in Helm, and disable Helm's CRD management. See also:
-    # https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#method-2-separate-charts
-    enableCRDTemplates: true
-
-    # Validation webhook configuration url
-    # For example: https://$remotePilotAddress:15017/validate
-    validationURL: ""
-    # Validation webhook caBundle value. Useful when running pilot with a well known cert
-    validationCABundle: ""
-
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  defaultRevision: "default"
-  experimental:
-    stableValidationPolicy: false
diff --git a/resources/v1.24.5/charts/cni/Chart.yaml b/resources/v1.24.5/charts/cni/Chart.yaml
deleted file mode 100644
index b0e7a4be9..000000000
--- a/resources/v1.24.5/charts/cni/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.5
-description: Helm chart for istio-cni components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-cni
-- istio
-name: cni
-sources:
-- https://github.com/istio/istio
-version: 1.24.5
diff --git a/resources/v1.24.5/charts/cni/README.md b/resources/v1.24.5/charts/cni/README.md
deleted file mode 100644
index a8b78d5bd..000000000
--- a/resources/v1.24.5/charts/cni/README.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# Istio CNI Helm Chart
-
-This chart installs the Istio CNI Plugin. See the [CNI installation guide](https://istio.io/latest/docs/setup/additional-setup/cni/)
-for more information.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-cni`:
-
-```console
-helm install istio-cni istio/cni -n kube-system
-```
-
-Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
-`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
-'system-node-critical' outside of kube-system.
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istio-cni
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Ambient
-
-To enable ambient, you can use the ambient profile: `--set profile=ambient`.
-
-#### Calico
-
-For Calico, you must also modify the settings to allow source spoofing:
-
-- if deployed by operator,  `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`
-- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )
-
-### GKE notes
-
-On GKE, 'kube-system' is required.
-
-If using `helm template`, `--set cni.cniBinDir=/home/kubernetes/bin` is required - with `helm install`
-it is auto-detected.
diff --git a/resources/v1.24.5/charts/cni/files/profile-ambient.yaml b/resources/v1.24.5/charts/cni/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.5/charts/cni/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.5/charts/cni/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.5/charts/cni/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.5/charts/cni/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.5/charts/cni/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.5/charts/cni/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.5/charts/cni/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.5/charts/cni/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.5/charts/cni/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.5/charts/cni/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.5/charts/cni/files/profile-demo.yaml b/resources/v1.24.5/charts/cni/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.5/charts/cni/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.5/charts/cni/files/profile-platform-k3s.yaml b/resources/v1.24.5/charts/cni/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.5/charts/cni/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.5/charts/cni/templates/clusterrole.yaml b/resources/v1.24.5/charts/cni/templates/clusterrole.yaml
deleted file mode 100644
index f4d4b7754..000000000
--- a/resources/v1.24.5/charts/cni/templates/clusterrole.yaml
+++ /dev/null
@@ -1,77 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: ["security.openshift.io"] 
-  resources: ["securitycontextconstraints"] 
-  resourceNames: ["privileged"] 
-  verbs: ["use"]
-- apiGroups: [""]
-  resources: ["pods","nodes","namespaces"]
-  verbs: ["get", "list", "watch"]
-{{- if (eq ((coalesce .Values.platform .Values.global.platform) | default "") "openshift") }}
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
-{{- end }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-repair-role
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "patch"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["watch", "get", "list"]
-{{- if .Values.repair.repairPods }}
-{{- /*  No privileges needed*/}}
-{{- else if .Values.repair.deletePods }}
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["delete"]
-{{- else if .Values.repair.labelPods }}
-  - apiGroups: [""]
-    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-    resources: ["pods/status"]
-    verbs: ["patch", "update"]
-{{- end }}
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: [""]
-  {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-  resources: ["pods/status"]
-  verbs: ["patch", "update"]
-{{- end }}
diff --git a/resources/v1.24.5/charts/cni/templates/clusterrolebinding.yaml b/resources/v1.24.5/charts/cni/templates/clusterrolebinding.yaml
deleted file mode 100644
index 42fedab1f..000000000
--- a/resources/v1.24.5/charts/cni/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-repair-rolebinding
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-repair-role
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "name" . }}
-    namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-ambient
-{{- end }}
diff --git a/resources/v1.24.5/charts/cni/templates/configmap-cni.yaml b/resources/v1.24.5/charts/cni/templates/configmap-cni.yaml
deleted file mode 100644
index 1009d55d7..000000000
--- a/resources/v1.24.5/charts/cni/templates/configmap-cni.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: {{ template "name" . }}-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  CURRENT_AGENT_VERSION: {{ .Values.tag | default .Values.global.tag | quote }}
-  AMBIENT_ENABLED: {{ .Values.ambient.enabled | quote }}
-  AMBIENT_DNS_CAPTURE: {{ .Values.ambient.dnsCapture | default "false" | quote  }}
-  AMBIENT_IPV6: {{ .Values.ambient.ipv6 | default "false" | quote }}
-  {{- if .Values.cniConfFileName }} # K8S < 1.24 doesn't like empty values
-  CNI_CONF_NAME: {{ .Values.cniConfFileName }} # Name of the CNI config file to create. Only override if you know the exact path your CNI requires..
-  {{- end }}
-  CHAINED_CNI_PLUGIN: {{ .Values.chained | quote }}
-  EXCLUDE_NAMESPACES: "{{ range $idx, $ns := .Values.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
-  REPAIR_ENABLED: {{ .Values.repair.enabled | quote }}
-  REPAIR_LABEL_PODS: {{ .Values.repair.labelPods | quote }}
-  REPAIR_DELETE_PODS: {{ .Values.repair.deletePods | quote }}
-  REPAIR_REPAIR_PODS: {{ .Values.repair.repairPods | quote }}
-  REPAIR_INIT_CONTAINER_NAME: {{ .Values.repair.initContainerName | quote }}
-  REPAIR_BROKEN_POD_LABEL_KEY: {{ .Values.repair.brokenPodLabelKey | quote }}
-  REPAIR_BROKEN_POD_LABEL_VALUE: {{ .Values.repair.brokenPodLabelValue | quote }}
-  {{- with .Values.env }}
-  {{- range $key, $val := . }}
-  {{ $key }}: "{{ $val }}"
-  {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.5/charts/cni/templates/daemonset.yaml b/resources/v1.24.5/charts/cni/templates/daemonset.yaml
deleted file mode 100644
index 4db08e0db..000000000
--- a/resources/v1.24.5/charts/cni/templates/daemonset.yaml
+++ /dev/null
@@ -1,236 +0,0 @@
-# This manifest installs the Istio install-cni container, as well
-# as the Istio CNI plugin and config on
-# each master and worker node in a Kubernetes cluster.
-{{- $defaultBinDir :=
-    (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
-      "/home/kubernetes/bin"
-      "/opt/cni/bin"
-}}
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  # Note that this is templated but evaluates to a fixed name
-  # which the CNI plugin may fall back onto in some failsafe scenarios.
-  # if this name is changed, CNI plugin logic that checks for this name
-  # format should also be updated.
-  name: {{ template "name" . }}-node
-  namespace: {{ .Release.Namespace }}
-  labels:
-    k8s-app: {{ template "name" . }}-node
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  selector:
-    matchLabels:
-      k8s-app: {{ template "name" . }}-node
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  template:
-    metadata:
-      labels:
-        k8s-app: {{ template "name" . }}-node
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: {{ template "name" . }}
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-        # Add Prometheus Scrape annotations
-        prometheus.io/scrape: 'true'
-        prometheus.io/port: "15014"
-        prometheus.io/path: '/metrics'
-        # Add AppArmor annotation
-        # This is required to avoid conflicts with AppArmor profiles which block certain
-        # privileged pod capabilities.
-        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
-        # securityContext which is otherwise preferred.
-        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
-        # Custom annotations
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{if .Values.ambient.enabled }}
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-{{ end }}
-      nodeSelector:
-        kubernetes.io/os: linux
-      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      tolerations:
-        # Make sure istio-cni-node gets scheduled on all nodes.
-        - effect: NoSchedule
-          operator: Exists
-        # Mark the pod as a critical add-on for rescheduling.
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      priorityClassName: system-node-critical
-      serviceAccountName: {{ template "name" . }}
-      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
-      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
-      terminationGracePeriodSeconds: 5
-      containers:
-        # This container installs the Istio CNI binaries
-        # and CNI network config file on each node.
-        - name: install-cni
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
-{{- end }}
-{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
-{{- end }}
-          ports:
-          - containerPort: 15014
-            name: metrics
-            protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8000
-          securityContext:
-            privileged: false
-            runAsGroup: 0
-            runAsUser: 0
-            runAsNonRoot: false
-            # Both ambient and sidecar repair mode require elevated node privileges to function.
-            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
-            # add capabilities based on feature.
-            capabilities:
-              drop:
-              - ALL
-              add:
-              # CAP_NET_ADMIN is required to allow ipset and route table access
-              - NET_ADMIN
-              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
-              - NET_RAW
-              # CAP_SYS_PTRACE is required for repair mode to describe the pod's network namespace
-              # in ambient and repair mode.
-              - SYS_PTRACE
-              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
-              # network namespaces in `/proc` to obtain descriptors for entering pod network
-              # namespaces. There does not appear to be a more granular capability for this.
-              - SYS_ADMIN
-              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
-              # the typical ability to read/write to folders owned by others.
-              # This can cause problems if the hostPath mounts we use, which we require write access into,
-              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
-              - DAC_OVERRIDE
-{{- if .Values.seLinuxOptions }}
-{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
-            seLinuxOptions:
-{{ toYaml . | trim | indent 14 }}
-{{- end }}
-{{- end }}
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          command: ["install-cni"]
-          args:
-            {{- if or .Values.logging.level .Values.global.logging.level }}
-            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
-            {{- end}}
-            {{- if .Values.global.logAsJson }}
-            - --log_as_json
-            {{- end}}
-          envFrom:
-            - configMapRef:
-                name: {{ template "name" . }}-config
-          env:
-            - name: REPAIR_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: REPAIR_RUN_AS_DAEMON
-              value: "true"
-            - name: REPAIR_SIDECAR_ANNOTATION
-              value: "sidecar.istio.io/status"
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  apiVersion: v1
-                  fieldPath: spec.nodeName
-            - name: GOMEMLIMIT
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.memory
-            - name: GOMAXPROCS
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.cpu
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          volumeMounts:
-            - mountPath: /host/opt/cni/bin
-              name: cni-bin-dir
-            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-            - mountPath: /host/proc
-              name: cni-host-procfs
-              readOnly: true
-            {{- end }}
-            - mountPath: /host/etc/cni/net.d
-              name: cni-net-dir
-            - mountPath: /var/run/istio-cni
-              name: cni-socket-dir
-            {{- if .Values.ambient.enabled }}
-            - mountPath: /host/var/run/netns
-              mountPropagation: HostToContainer
-              name: cni-netns-dir
-            - mountPath: /var/run/ztunnel
-              name: cni-ztunnel-sock-dir
-            {{ end }}
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-      volumes:
-        # Used to install CNI.
-        - name: cni-bin-dir
-          hostPath:
-            path: {{ .Values.cniBinDir | default $defaultBinDir }}
-        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-        - name: cni-host-procfs
-          hostPath:
-            path: /proc
-            type: Directory
-        {{- end }}
-        {{- if .Values.ambient.enabled }}
-        - name: cni-ztunnel-sock-dir
-          hostPath:
-            path: /var/run/ztunnel
-            type: DirectoryOrCreate
-        {{- end }}
-        - name: cni-net-dir
-          hostPath:
-            path: {{ default "/etc/cni/net.d" .Values.cniConfDir }}
-        # Used for UDS sockets for logging, ambient eventing
-        - name: cni-socket-dir
-          hostPath:
-            path: /var/run/istio-cni
-        - name: cni-netns-dir
-          hostPath:
-            path: {{ .Values.cniNetnsDir | default "/var/run/netns" }}
-            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
-            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
-            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.24.5/charts/cni/templates/network-attachment-definition.yaml b/resources/v1.24.5/charts/cni/templates/network-attachment-definition.yaml
deleted file mode 100644
index 86a2eb7c0..000000000
--- a/resources/v1.24.5/charts/cni/templates/network-attachment-definition.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-{{- if eq .Values.provider "multus" }}
-apiVersion: k8s.cni.cncf.io/v1
-kind: NetworkAttachmentDefinition
-metadata:
-  name: {{ template "name" . }}
-  namespace: default
-  labels:
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.24.5/charts/cni/templates/resourcequota.yaml b/resources/v1.24.5/charts/cni/templates/resourcequota.yaml
deleted file mode 100644
index 9a6d61ff9..000000000
--- a/resources/v1.24.5/charts/cni/templates/resourcequota.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-{{- if .Values.resourceQuotas.enabled }}
-apiVersion: v1
-kind: ResourceQuota
-metadata:
-  name: {{ template "name" . }}-resource-quota
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  hard:
-    pods: {{ .Values.resourceQuotas.pods | quote }}
-  scopeSelector:
-    matchExpressions:
-    - operator: In
-      scopeName: PriorityClass
-      values:
-      - system-node-critical
-{{- end }}
diff --git a/resources/v1.24.5/charts/cni/templates/serviceaccount.yaml b/resources/v1.24.5/charts/cni/templates/serviceaccount.yaml
deleted file mode 100644
index 3193d7b74..000000000
--- a/resources/v1.24.5/charts/cni/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-{{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-{{- end }}
-{{- end }}
-metadata:
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.24.5/charts/cni/templates/zzz_profile.yaml b/resources/v1.24.5/charts/cni/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.5/charts/cni/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.5/charts/cni/values.yaml b/resources/v1.24.5/charts/cni/values.yaml
deleted file mode 100644
index 173bf96cf..000000000
--- a/resources/v1.24.5/charts/cni/values.yaml
+++ /dev/null
@@ -1,149 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  hub: ""
-  tag: ""
-  variant: ""
-  image: install-cni
-  pullPolicy: ""
-
-  # Same as `global.logging.level`, but will override it if set
-  logging:
-    level: ""
-
-  # Configuration file to insert istio-cni plugin configuration
-  # by default this will be the first file found in the cni-conf-dir
-  # Example
-  # cniConfFileName: 10-calico.conflist
-
-  # CNI bin and conf dir override settings
-  # defaults:
-  cniBinDir: "" # Auto-detected based on version; defaults to /opt/cni/bin.
-  cniConfDir: /etc/cni/net.d
-  cniConfFileName: ""
-  # This directory must exist on the node, if it does not, consult your container runtime
-  # documentation for the appropriate path.
-  cniNetnsDir: # Defaults to '/var/run/netns', in minikube/docker/others can be '/var/run/docker/netns'.
-
-
-  excludeNamespaces:
-    - kube-system
-
-  # Allows user to set custom affinity for the DaemonSet
-  affinity: {}
-
-  # Custom annotations on pod level, if you need them
-  podAnnotations: {}
-
-  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
-  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
-  chained: true
-
-  # Custom configuration happens based on the CNI provider.
-  # Possible values: "default", "multus"
-  provider: "default"
-
-  # Configure ambient settings
-  ambient:
-    # If enabled, ambient redirection will be enabled
-    enabled: false
-    # Set ambient config dir path: defaults to /etc/ambient-config
-    configDir: ""
-    # If enabled, and ambient is enabled, DNS redirection will be enabled
-    dnsCapture: false
-    # If enabled, and ambient is enabled, enables ipv6 support
-    ipv6: true
-
-
-  repair:
-    enabled: true
-    hub: ""
-    tag: ""
-
-    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
-    # This defines the action the controller will take when a pod is detected as broken.
-
-    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
-    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
-    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
-    labelPods: false
-    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
-    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
-    deletePods: false
-    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
-    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
-    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
-    repairPods: true
-
-    initContainerName: "istio-validation"
-
-    brokenPodLabelKey: "cni.istio.io/uninitialized"
-    brokenPodLabelValue: "true"
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
-  seLinuxOptions: {}
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 100Mi
-
-  resourceQuotas:
-    enabled: false
-    pods: 5000
-
-  # The number of pods that can be unavailable during rolling update (see
-  # `updateStrategy.rollingUpdate.maxUnavailable` here:
-  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
-  # May be specified as a number of pods or as a percent of the total number
-  # of pods at the start of the update.
-  rollingMaxUnavailable: 1
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  global:
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-
-    # Default tag for Istio images.
-    tag: 1.24.5
-
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # change cni scope level to control logging out of istio-cni-node DaemonSet
-    logging:
-      level: info
-
-    logAsJson: false
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Default resources allocated
-    defaultResources:
-      requests:
-        cpu: 100m
-        memory: 100Mi
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
diff --git a/resources/v1.24.5/charts/gateway/Chart.yaml b/resources/v1.24.5/charts/gateway/Chart.yaml
deleted file mode 100644
index fda62c7a4..000000000
--- a/resources/v1.24.5/charts/gateway/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.5
-description: Helm chart for deploying Istio gateways
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- gateways
-name: gateway
-sources:
-- https://github.com/istio/istio
-type: application
-version: 1.24.5
diff --git a/resources/v1.24.5/charts/gateway/README.md b/resources/v1.24.5/charts/gateway/README.md
deleted file mode 100644
index 5c064d165..000000000
--- a/resources/v1.24.5/charts/gateway/README.md
+++ /dev/null
@@ -1,170 +0,0 @@
-# Istio Gateway Helm Chart
-
-This chart installs an Istio gateway deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-ingressgateway`:
-
-```console
-helm install istio-ingressgateway istio/gateway
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istio-ingressgateway` deployment:
-
-```console
-helm delete istio-ingressgateway
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/gateway
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### OpenShift
-
-When deploying the gateway in an OpenShift cluster, use the `openshift` profile to override the default values, for example:
-
-```console
-helm install istio-ingressgateway istio/gateway --set profile=openshift
-```
-
-### `image: auto` Information
-
-The image used by the chart, `auto`, may be unintuitive.
-This exists because the pod spec will be automatically populated at runtime, using the same mechanism as [Sidecar Injection](istio.io/latest/docs/setup/additional-setup/sidecar-injection).
-This allows the same configurations and lifecycle to apply to gateways as sidecars.
-
-Note: this does mean that the namespace the gateway is deployed in must not have the `istio-injection=disabled` label.
-See [Controlling the injection policy](https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy) for more info.
-
-### Examples
-
-#### Egress Gateway
-
-Deploying a Gateway to be used as an [Egress Gateway](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/):
-
-```yaml
-service:
-  # Egress gateways do not need an external LoadBalancer IP
-  type: ClusterIP
-```
-
-#### Multi-network/VM Gateway
-
-Deploying a Gateway to be used as a [Multi-network Gateway](https://istio.io/latest/docs/setup/install/multicluster/) for network `network-1`:
-
-```yaml
-networkGateway: network-1
-```
-
-### Migrating from other installation methods
-
-Installations from other installation methods (such as istioctl, Istio Operator, other helm charts, etc) can be migrated to use the new Helm charts
-following the guidance below.
-If you are able to, a clean installation is simpler. However, this often requires an external IP migration which can be challenging.
-
-WARNING: when installing over an existing deployment, the two deployments will be merged together by Helm, which may lead to unexpected results.
-
-#### Legacy Gateway Helm charts
-
-Istio historically offered two different charts - `manifests/charts/gateways/istio-ingress` and `manifests/charts/gateways/istio-egress`.
-These are replaced by this chart.
-While not required, it is recommended all new users use this chart, and existing users migrate when possible.
-
-This chart has the following benefits and differences:
-* Designed with Helm best practices in mind (standardized values options, values schema, values are not all nested under `gateways.istio-ingressgateway.*`, release name and namespace taken into account, etc).
-* Utilizes Gateway injection, simplifying upgrades, allowing gateways to run in any namespace, and avoiding repeating config for sidecars and gateways.
-* Published to official Istio Helm repository.
-* Single chart for all gateways (Ingress, Egress, East West).
-
-#### General concerns
-
-For a smooth migration, the resource names and `Deployment.spec.selector` labels must match.
-
-If you install with `helm install istio-gateway istio/gateway`, resources will be named `istio-gateway` and the `selector` labels set to:
-
-```yaml
-app: istio-gateway
-istio: gateway # the release name with leading istio- prefix stripped
-```
-
-If your existing installation doesn't follow these names, you can override them. For example, if you have resources named `my-custom-gateway` with `selector` labels
-`foo=bar,istio=ingressgateway`:
-
-```yaml
-name: my-custom-gateway # Override the name to match existing resources
-labels:
-  app: "" # Unset default app selector label
-  istio: ingressgateway # override default istio selector label
-  foo: bar # Add the existing custom selector label
-```
-
-#### Migrating an existing Helm release
-
-An existing helm release can be `helm upgrade`d to this chart by using the same release name. For example, if a previous
-installation was done like:
-
-```console
-helm install istio-ingress manifests/charts/gateways/istio-ingress -n istio-system
-```
-
-It could be upgraded with
-
-```console
-helm upgrade istio-ingress manifests/charts/gateway -n istio-system --set name=istio-ingressgateway --set labels.app=istio-ingressgateway --set labels.istio=ingressgateway
-```
-
-Note the name and labels are overridden to match the names of the existing installation.
-
-Warning: the helm charts here default to using port 80 and 443, while the old charts used 8080 and 8443.
-If you have AuthorizationPolicies that reference port these ports, you should update them during this process,
-or customize the ports to match the old defaults.
-See the [security advisory](https://istio.io/latest/news/security/istio-security-2021-002/) for more information.
-
-#### Other migrations
-
-If you see errors like `rendered manifests contain a resource that already exists` during installation, you may need to forcibly take ownership.
-
-The script below can handle this for you. Replace `RELEASE` and `NAMESPACE` with the name and namespace of the release:
-
-```console
-KINDS=(service deployment)
-RELEASE=istio-ingressgateway
-NAMESPACE=istio-system
-for KIND in "${KINDS[@]}"; do
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-name=$RELEASE
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-namespace=$NAMESPACE
-    kubectl --namespace $NAMESPACE --overwrite=true label $KIND $RELEASE app.kubernetes.io/managed-by=Helm
-done
-```
-
-You may ignore errors about resources not being found.
diff --git a/resources/v1.24.5/charts/gateway/files/profile-ambient.yaml b/resources/v1.24.5/charts/gateway/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.5/charts/gateway/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.5/charts/gateway/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.5/charts/gateway/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.5/charts/gateway/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.5/charts/gateway/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.5/charts/gateway/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.5/charts/gateway/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.5/charts/gateway/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.5/charts/gateway/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.5/charts/gateway/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.5/charts/gateway/files/profile-demo.yaml b/resources/v1.24.5/charts/gateway/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.5/charts/gateway/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.5/charts/gateway/files/profile-platform-k3s.yaml b/resources/v1.24.5/charts/gateway/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.5/charts/gateway/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.5/charts/gateway/templates/deployment.yaml b/resources/v1.24.5/charts/gateway/templates/deployment.yaml
deleted file mode 100644
index 9db59d8b9..000000000
--- a/resources/v1.24.5/charts/gateway/templates/deployment.yaml
+++ /dev/null
@@ -1,128 +0,0 @@
-apiVersion: apps/v1
-kind: {{ .Values.kind | default "Deployment" }}
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  {{- with .Values.replicaCount }}
-  replicas: {{ . }}
-  {{- end }}
-  {{- end }}
-  {{- with .Values.strategy }}
-  strategy:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.minReadySeconds }}
-  minReadySeconds: {{ . }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "gateway.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
-        {{- include "gateway.selectorLabels" . | nindent 8 }}
-        app.kubernetes.io/name: {{ include "gateway.name" . }}
-        {{- include "istio.labels" .  | nindent 8}}
-        {{- range $key, $val := .Values.labels }}
-        {{- if and (ne $key "app") (ne $key "istio") }}
-        {{ $key | quote }}: {{ $val | quote }}
-        {{- end }}
-        {{- end }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
-      securityContext:
-      {{- if .Values.securityContext }}
-        {{- toYaml .Values.securityContext | nindent 8 }}
-      {{- else }}
-        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- end }}
-      {{- with .Values.volumes }}
-      volumes:
-        {{ toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: istio-proxy
-          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
-          image: auto
-          {{- with .Values.imagePullPolicy }}
-          imagePullPolicy: {{ . }}
-          {{- end }}
-          securityContext:
-          {{- if .Values.containerSecurityContext }}
-            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          {{- else }}
-            capabilities:
-              drop:
-              - ALL
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            {{- if not (eq (.Values.platform | default "") "openshift") }}
-            runAsUser: 1337
-            runAsGroup: 1337
-            {{- end }}
-            runAsNonRoot: true
-          {{- end }}
-          env:
-          {{- with .Values.networkGateway }}
-          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-            value: "{{.}}"
-          {{- end }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: {{ $val | quote }}
-          {{- end }}
-          ports:
-          - containerPort: 15090
-            protocol: TCP
-            name: http-envoy-prom
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          {{- with .Values.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.readinessProbe }}
-          readinessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
-      {{- with .Values.priorityClassName }}
-      priorityClassName: {{ . }}
-      {{- end }}
diff --git a/resources/v1.24.5/charts/gateway/templates/poddisruptionbudget.yaml b/resources/v1.24.5/charts/gateway/templates/poddisruptionbudget.yaml
deleted file mode 100644
index b0155cdf0..000000000
--- a/resources/v1.24.5/charts/gateway/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-{{- if .Values.podDisruptionBudget }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-spec:
-  selector:
-    matchLabels:
-  {{- include "gateway.selectorLabels" . | nindent 6 }}
-  {{- with .Values.podDisruptionBudget }}
-    {{- toYaml . | nindent 2 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.24.5/charts/gateway/templates/service.yaml b/resources/v1.24.5/charts/gateway/templates/service.yaml
deleted file mode 100644
index 25ce3bcb0..000000000
--- a/resources/v1.24.5/charts/gateway/templates/service.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-{{- if not (eq .Values.service.type "None") }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-    {{- with .Values.networkGateway }}
-    topology.istio.io/network: "{{.}}"
-    {{- end }}
-  annotations:
-    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
-spec:
-{{- with .Values.service.loadBalancerIP }}
-  loadBalancerIP: "{{ . }}"
-{{- end }}
-{{- if eq .Values.service.type "LoadBalancer" }}
-  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
-  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
-  {{- end }}
-{{- end }}
-{{- if .Values.service.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.service.ipFamilies }}
-  ipFamilies:
-{{- range .Values.service.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
-{{- with .Values.service.loadBalancerSourceRanges }}
-  loadBalancerSourceRanges:
-{{ toYaml . | indent 4 }}
-{{- end }}
-{{- with .Values.service.externalTrafficPolicy }}
-  externalTrafficPolicy: "{{ . }}"
-{{- end }}
-  type: {{ .Values.service.type }}
-  ports:
-{{- if .Values.networkGateway }}
-  - name: status-port
-    port: 15021
-    targetPort: 15021
-  - name: tls
-    port: 15443
-    targetPort: 15443
-  - name: tls-istiod
-    port: 15012
-    targetPort: 15012
-  - name: tls-webhook
-    port: 15017
-    targetPort: 15017
-{{- else }}
-{{ .Values.service.ports | toYaml | indent 4 }}
-{{- end }}
-{{- if .Values.service.externalIPs }}
-  externalIPs: {{- range .Values.service.externalIPs }}
-    - {{.}}
-  {{- end }}
-{{- end }}
-  selector:
-    {{- include "gateway.selectorLabels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.24.5/charts/gateway/templates/zzz_profile.yaml b/resources/v1.24.5/charts/gateway/templates/zzz_profile.yaml
deleted file mode 100644
index 72d3adc53..000000000
--- a/resources/v1.24.5/charts/gateway/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.5/charts/gateway/values.schema.json b/resources/v1.24.5/charts/gateway/values.schema.json
deleted file mode 100644
index 3fdaa2730..000000000
--- a/resources/v1.24.5/charts/gateway/values.schema.json
+++ /dev/null
@@ -1,330 +0,0 @@
-{
-  "$schema": "http://json-schema.org/schema#",
-  "$defs": {
-    "values": {
-      "type": "object",
-      "properties": {
-        "global": {
-          "type": "object"
-        },
-        "affinity": {
-          "type": "object"
-        },
-        "securityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "containerSecurityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "kind": {
-          "type": "string",
-          "enum": [
-            "Deployment",
-            "DaemonSet"
-          ]
-        },
-        "annotations": {
-          "additionalProperties": {
-            "type": [
-              "string",
-              "integer"
-            ]
-          },
-          "type": "object"
-        },
-        "autoscaling": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            },
-            "maxReplicas": {
-              "type": "integer"
-            },
-            "minReplicas": {
-              "type": "integer"
-            },
-            "targetCPUUtilizationPercentage": {
-              "type": "integer"
-            }
-          }
-        },
-        "env": {
-          "type": "object"
-        },
-        "strategy": {
-          "type": "object"
-        },
-        "minReadySeconds": {
-          "type": [
-            "null",
-            "integer"
-          ]
-        },
-        "readinessProbe": {
-          "type": [
-            "null",
-            "object"
-          ]
-        },
-        "labels": {
-          "type": "object"
-        },
-        "name": {
-          "type": "string"
-        },
-        "nodeSelector": {
-          "type": "object"
-        },
-        "podAnnotations": {
-          "type": "object",
-          "properties": {
-            "inject.istio.io/templates": {
-              "type": "string"
-            },
-            "prometheus.io/path": {
-              "type": "string"
-            },
-            "prometheus.io/port": {
-              "type": "string"
-            },
-            "prometheus.io/scrape": {
-              "type": "string"
-            }
-          }
-        },
-        "replicaCount": {
-          "type": [
-            "integer",
-            "null"
-          ]
-        },
-        "resources": {
-          "type": "object",
-          "properties": {
-            "limits": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            },
-            "requests": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            }
-          }
-        },
-        "revision": {
-          "type": "string"
-        },
-        "compatibilityVersion": {
-          "type": "string"
-        },
-        "runAsRoot": {
-          "type": "boolean"
-        },
-        "unprivilegedPort": {
-          "type": [
-            "string",
-            "boolean"
-          ],
-          "enum": [
-            true,
-            false,
-            "auto"
-          ]
-        },
-        "service": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "externalTrafficPolicy": {
-              "type": "string"
-            },
-            "loadBalancerIP": {
-              "type": "string"
-            },
-            "loadBalancerSourceRanges": {
-              "type": "array"
-            },
-            "ipFamilies": {
-              "items": {
-                "type": "string",
-                "enum": [
-                  "IPv4",
-                  "IPv6"
-                ]
-              }
-            },
-            "ipFamilyPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "SingleStack",
-                "PreferDualStack",
-                "RequireDualStack"
-              ]
-            },
-            "ports": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string"
-                  },
-                  "port": {
-                    "type": "integer"
-                  },
-                  "protocol": {
-                    "type": "string"
-                  },
-                  "targetPort": {
-                    "type": "integer"
-                  }
-                }
-              }
-            },
-            "type": {
-              "type": "string"
-            }
-          }
-        },
-        "serviceAccount": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "name": {
-              "type": "string"
-            },
-            "create": {
-              "type": "boolean"
-            }
-          }
-        },
-        "rbac": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            }
-          }
-        },
-        "tolerations": {
-          "type": "array"
-        },
-        "topologySpreadConstraints": {
-          "type": "array"
-        },
-        "networkGateway": {
-          "type": "string"
-        },
-        "imagePullPolicy": {
-          "type": "string",
-          "enum": [
-            "",
-            "Always",
-            "IfNotPresent",
-            "Never"
-          ]
-        },
-        "imagePullSecrets": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "name": {
-                "type": "string"
-              }
-            }
-          }
-        },
-        "podDisruptionBudget": {
-          "type": "object",
-          "properties": {
-            "minAvailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "maxUnavailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "unhealthyPodEvictionPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "IfHealthyBudget",
-                "AlwaysAllow"
-              ]
-            }
-          }
-        },
-        "terminationGracePeriodSeconds": {
-          "type": "number"
-        },
-        "volumes": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "volumeMounts": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "priorityClassName": {
-          "type": "string"
-        },
-        "_internal_defaults_do_not_set": {
-          "type": "object"
-        }
-      },
-      "additionalProperties": false
-    }
-  },
-  "defaults": {
-    "$ref": "#/$defs/values"
-  },
-  "$ref": "#/$defs/values"
-}
diff --git a/resources/v1.24.5/charts/gateway/values.yaml b/resources/v1.24.5/charts/gateway/values.yaml
deleted file mode 100644
index b02240df1..000000000
--- a/resources/v1.24.5/charts/gateway/values.yaml
+++ /dev/null
@@ -1,166 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Name allows overriding the release name. Generally this should not be set
-  name: ""
-  # revision declares which revision this gateway is a part of
-  revision: ""
-
-  # Controls the spec.replicas setting for the Gateway deployment if set.
-  # Otherwise defaults to Kubernetes Deployment default (1).
-  replicaCount:
-
-  kind: Deployment
-
-  rbac:
-    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
-    # when using http://gateway-api.org/.
-    enabled: true
-
-  serviceAccount:
-    # If set, a service account will be created. Otherwise, the default is used
-    create: true
-    # Annotations to add to the service account
-    annotations: {}
-    # The name of the service account to use.
-    # If not set, the release name is used
-    name: ""
-
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/stats/prometheus"
-    inject.istio.io/templates: "gateway"
-    sidecar.istio.io/inject: "true"
-
-  # Define the security context for the pod.
-  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-  securityContext: {}
-  containerSecurityContext: {}
-
-  service:
-    # Type of service. Set to "None" to disable the service entirely
-    type: LoadBalancer
-    ports:
-    - name: status-port
-      port: 15021
-      protocol: TCP
-      targetPort: 15021
-    - name: http2
-      port: 80
-      protocol: TCP
-      targetPort: 80
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
-    annotations: {}
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    externalTrafficPolicy: ""
-    externalIPs: []
-    ipFamilyPolicy: ""
-    ipFamilies: []
-    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
-    # allocateLoadBalancerNodePorts: false
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: 2000m
-      memory: 1024Mi
-
-  autoscaling:
-    enabled: true
-    minReplicas: 1
-    maxReplicas: 5
-    targetCPUUtilizationPercentage: 80
-    targetMemoryUtilizationPercentage: {}
-    autoscaleBehavior: {}
-
-  # Pod environment variables
-  env: {}
-
-  # Deployment Update strategy
-  strategy: {}
-  
-  # Sets the Deployment minReadySeconds value
-  minReadySeconds:
-  
-  # Optionally configure a custom readinessProbe. By default the control plane
-  # automatically injects the readinessProbe. If you wish to override that
-  # behavior, you may define your own readinessProbe here.
-  readinessProbe: {}
-
-  # Labels to apply to all resources
-  labels: {}
-
-  # Annotations to apply to all resources
-  annotations: {}
-
-  nodeSelector: {}
-
-  tolerations: []
-
-  topologySpreadConstraints: []
-
-  affinity: {}
-
-  # If specified, the gateway will act as a network gateway for the given network.
-  networkGateway: ""
-
-  # Specify image pull policy if default behavior isn't desired.
-  # Default behavior: latest images will be Always else IfNotPresent
-  imagePullPolicy: ""
-
-  imagePullSecrets: []
-
-  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
-  #
-  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
-  # which means that no PodDisruptionBudget resource will be created.
-  #
-  # To enable the PodDisruptionBudget, configure it by specifying the
-  # `minAvailable` or `maxUnavailable`. For example, to set the
-  # minimum number of available replicas to 1, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #
-  # Or, to allow a maximum of 1 unavailable replica, you can set:
-  #
-  # podDisruptionBudget:
-  #   maxUnavailable: 1
-  #
-  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
-  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #   unhealthyPodEvictionPolicy: AlwaysAllow
-  #
-  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
-  #
-  # podDisruptionBudget: {}
-  #
-  podDisruptionBudget: {}
-
-  # Sets the per-pod terminationGracePeriodSeconds setting.
-  terminationGracePeriodSeconds: 30
-
-  # A list of `Volumes` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumes: []
-
-  # A list of `VolumeMounts` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumeMounts: []
-
-  # Configure this to a higher priority class in order to make sure your Istio gateway pods
-  # will not be killed because of low priority class.
-  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-  # for more detail.
-  priorityClassName: ""
diff --git a/resources/v1.24.5/charts/istiod/Chart.yaml b/resources/v1.24.5/charts/istiod/Chart.yaml
deleted file mode 100644
index d4e72a3d8..000000000
--- a/resources/v1.24.5/charts/istiod/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.5
-description: Helm chart for istio control plane
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- istiod
-- istio-discovery
-name: istiod
-sources:
-- https://github.com/istio/istio
-version: 1.24.5
diff --git a/resources/v1.24.5/charts/istiod/README.md b/resources/v1.24.5/charts/istiod/README.md
deleted file mode 100644
index ddbfbc8fe..000000000
--- a/resources/v1.24.5/charts/istiod/README.md
+++ /dev/null
@@ -1,73 +0,0 @@
-# Istiod Helm Chart
-
-This chart installs an Istiod deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-Before installing, ensure CRDs are installed in the cluster (from the `istio/base` chart).
-
-To install the chart with the release name `istiod`:
-
-```console
-kubectl create namespace istio-system
-helm install istiod istio/istiod --namespace istio-system
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istiod` deployment:
-
-```console
-helm delete istiod --namespace istio-system
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istiod
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Examples
-
-#### Configuring mesh configuration settings
-
-Any [Mesh Config](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/) options can be configured like below:
-
-```yaml
-meshConfig:
-  accessLogFile: /dev/stdout
-```
-
-#### Revisions
-
-Control plane revisions allow deploying multiple versions of the control plane in the same cluster.
-This allows safe [canary upgrades](https://istio.io/latest/docs/setup/upgrade/canary/)
-
-```yaml
-revision: my-revision-name
-```
diff --git a/resources/v1.24.5/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.24.5/charts/istiod/files/gateway-injection-template.yaml
deleted file mode 100644
index dbd83cc57..000000000
--- a/resources/v1.24.5/charts/istiod/files/gateway-injection-template.yaml
+++ /dev/null
@@ -1,253 +0,0 @@
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations:
-    istio.io/rev: {{ .Revision | default "default" | quote }}
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- end }}
-spec:
-  securityContext:
-  {{- if .Values.gateways.securityContext }}
-    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
-  {{- else }}
-    sysctls:
-    - name: net.ipv4.ip_unprivileged_port_start
-      value: "0"
-  {{- end }}
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - router
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- end }}
-    securityContext:
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-    env:
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-  volumes:
-  - emptyDir: {}
-    name: workload-socket
-  - emptyDir: {}
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else}}
-  - emptyDir: {}
-    name: workload-certs
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.5/charts/istiod/files/grpc-agent.yaml b/resources/v1.24.5/charts/istiod/files/grpc-agent.yaml
deleted file mode 100644
index 7290fcdca..000000000
--- a/resources/v1.24.5/charts/istiod/files/grpc-agent.yaml
+++ /dev/null
@@ -1,310 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-    sidecar.istio.io/rewriteAppHTTPProbers: "false",
-  }
-spec:
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15020
-      protocol: TCP
-      name: mesh-metrics
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-          - --url=http://localhost:15020/healthz/ready
-    env:
-    - name: ISTIO_META_GENERATOR
-      value: grpc
-    - name: OUTPUT_CERTS
-      value: /var/lib/istio/data
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    # grpc uses xds:/// to resolve – no need to resolve VIP
-    - name: ISTIO_META_DNS_CAPTURE
-      value: "false"
-    - name: DISABLE_ENVOY
-      value: "true"
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15020
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # UDS channel between istioagent and gRPC client for XDS/SDS
-    - mountPath: /etc/istio/proxy
-      name: istio-xds
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-{{- range $index, $container := .Spec.Containers  }}
-{{ if not (eq $container.Name "istio-proxy") }}
-  - name: {{ $container.Name }}
-    env:
-      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
-        value: "true"
-      - name: "GRPC_XDS_BOOTSTRAP"
-        value: "/etc/istio/proxy/grpc-bootstrap.json"
-    volumeMounts:
-      - mountPath: /var/lib/istio/data
-        name: istio-data
-      # UDS channel between istioagent and gRPC client for XDS/SDS
-      - mountPath: /etc/istio/proxy
-        name: istio-xds
-      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-        readOnly: true
-      {{- else }}
-      - name: workload-certs
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-      {{- end }}
-{{- end }}
-{{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-xds
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.5/charts/istiod/files/injection-template.yaml b/resources/v1.24.5/charts/istiod/files/injection-template.yaml
deleted file mode 100644
index 0ef948e6a..000000000
--- a/resources/v1.24.5/charts/istiod/files/injection-template.yaml
+++ /dev/null
@@ -1,510 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
-    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
-    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
-    {{- end }}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-{{- if .Values.pilot.cni.enabled }}
-    {{- if eq .Values.pilot.cni.provider "multus" }}
-    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
-    {{- end }}
-    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}traffic.sidecar.istio.io/includeInboundPorts: "{{.}}",{{ end }}
-    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
-    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
-    {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
-    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
-    {{- end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
-{{- end }}
-  }
-spec:
-  {{- $holdProxy := and
-      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
-      (not $nativeSidecar) }}
-  initContainers:
-  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
-  {{ if .Values.pilot.cni.enabled -}}
-  - name: istio-validation
-  {{ else -}}
-  - name: istio-init
-  {{ end -}}
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    args:
-    - istio-iptables
-    - "-p"
-    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
-    - "-z"
-    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
-    - "-u"
-    - {{ .ProxyUID | default "1337" | quote }}
-    - "-m"
-    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
-    - "-i"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
-    - "-x"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
-    - "-b"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
-    - "-d"
-  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
-    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
-  {{- else }}
-    - "15090,15021"
-  {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
-    - "-q"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
-    {{ end -}}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
-    - "-o"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
-    {{ end -}}
-     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
-    - "-c"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
-    {{ end -}}
-    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
-    {{ if .Values.global.logAsJson -}}
-    - "--log_as_json"
-    {{ end -}}
-    {{ if .Values.pilot.cni.enabled -}}
-    - "--run-validation"
-    - "--skip-rule-apply"
-    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
-    - "--force-apply"
-    {{ end -}}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-  {{- if .ProxyConfig.ProxyMetadata }}
-    env:
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-  {{- end }}
-    resources:
-  {{ template "resources" . }}
-    securityContext:
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      privileged: {{ .Values.global.proxy.privileged }}
-      capabilities:
-    {{- if not .Values.pilot.cni.enabled }}
-        add:
-        - NET_ADMIN
-        - NET_RAW
-    {{- end }}
-        drop:
-        - ALL
-    {{- if not .Values.pilot.cni.enabled }}
-      readOnlyRootFilesystem: false
-      runAsGroup: 0
-      runAsNonRoot: false
-      runAsUser: 0
-    {{- else }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsNonRoot: true
-    {{- end }}
-  {{ end -}}
-  {{ if not $nativeSidecar }}
-  containers:
-  {{ end }}
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.outlierLogPath }}
-    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-  {{- end}}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- else if $holdProxy }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-  {{- else if $nativeSidecar }}
-    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
-    lifecycle:
-      preStop:
-        exec:
-          command:
-          - pilot-agent
-          - request
-          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
-          - POST
-          - drain
-  {{- end }}
-    env:
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - name: ISTIO_BOOTSTRAP_OVERRIDE
-      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
-    {{- end }}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-  {{ if .Values.global.proxy.startupProbe.enabled }}
-    startupProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: 0
-      periodSeconds: 1
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
-  {{ end }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    {{ end -}}
-    securityContext:
-      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
-      allowPrivilegeEscalation: true
-      capabilities:
-        add:
-        - NET_ADMIN
-        drop:
-        - ALL
-      privileged: true
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else }}
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      capabilities:
-        {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-        add:
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
-        - NET_ADMIN
-        {{- end }}
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
-        - NET_BIND_SERVICE
-        {{- end }}
-        {{- end }}
-        drop:
-        - ALL
-      privileged: {{ .Values.global.proxy.privileged }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else -}}
-      runAsNonRoot: true
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      {{- end }}
-      {{- end }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - mountPath: /etc/istio/custom-bootstrap
-      name: custom-bootstrap-volume
-    {{- end }}
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
-      name: lightstep-certs
-      readOnly: true
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  - emptyDir:
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-  - name: lightstep-certs
-    secret:
-      optional: true
-      secretName: lightstep.cacert
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.5/charts/istiod/files/kube-gateway.yaml b/resources/v1.24.5/charts/istiod/files/kube-gateway.yaml
deleted file mode 100644
index dbe158de1..000000000
--- a/resources/v1.24.5/charts/istiod/files/kube-gateway.yaml
+++ /dev/null
@@ -1,345 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-gateway-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": {{.Name}}
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-gateway-controller"
-          ) | nindent 8 }}
-    spec:
-      securityContext:
-      {{- if .Values.gateways.securityContext }}
-        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
-      {{- else }}
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- if .Values.gateways.seccompProfile }}
-        seccompProfile:
-      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
-      {{- end }}
-      {{- end }}
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-      {{- else }}
-        image: "{{ .ProxyImage }}"
-      {{- end }}
-        {{- if .Values.global.proxy.resources }}
-        resources:
-          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsUser: {{ .ProxyUID | default "1337" }}
-          runAsGroup: {{ .ProxyGID | default "1337" }}
-          runAsNonRoot: true
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        args:
-        - proxy
-        - router
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-      {{- if .Values.global.sts.servicePort }}
-        - --stsPort={{ .Values.global.sts.servicePort }}
-      {{- end }}
-      {{- if .Values.global.logAsJson }}
-        - --log_as_json
-      {{- end }}
-      {{- if .Values.global.proxy.lifecycle }}
-        lifecycle:
-          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
-      {{- end }}
-        env:
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        - name: ISTIO_META_POD_PORTS
-          value: "[]"
-        - name: ISTIO_META_APP_CONTAINERS
-          value: ""
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: "{{ .ProxyConfig.InterceptionMode.String }}"
-        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
-        - name: ISTIO_META_NETWORK
-          value: {{.|quote}}
-        {{- end }}
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName|quote}}
-        - name: ISTIO_META_OWNER
-          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
-        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-          value: {{.|quote}}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        volumeMounts:
-        - name: workload-socket
-          mountPath: /var/run/secrets/workload-spiffe-uds
-        - name: credential-socket
-          mountPath: /var/run/secrets/credential-uds
-        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-        - name: gke-workload-certificate
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-          readOnly: true
-        {{- else }}
-        - name: workload-certs
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-        {{- end }}
-        {{- if eq .Values.global.pilotCertProvider "istiod" }}
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        {{- end }}
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        # SDS channel between istioagent and Envoy
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - name: istio-podinfo
-          mountPath: /etc/istio/pod
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir: {}
-        name: credential-socket
-      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        csi:
-          driver: workloadcertificates.security.cloud.google.com
-      {{- else}}
-      - emptyDir: {}
-        name: workload-certs
-      {{- end }}
-      # SDS channel between istioagent and Envoy
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - name: istio-data
-        emptyDir: {}
-      - name: istio-podinfo
-        downwardAPI:
-          items:
-            - path: "labels"
-              fieldRef:
-                fieldPath: metadata.labels
-            - path: "annotations"
-              fieldRef:
-                fieldPath: metadata.annotations
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: {{ .Values.global.sds.token.aud }}
-      {{- if eq .Values.global.pilotCertProvider "istiod" }}
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: {{.UID}}
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": {{.Name}}
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.24.5/charts/istiod/files/profile-ambient.yaml b/resources/v1.24.5/charts/istiod/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.5/charts/istiod/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.5/charts/istiod/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.5/charts/istiod/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.5/charts/istiod/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.5/charts/istiod/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.5/charts/istiod/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.5/charts/istiod/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.5/charts/istiod/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.5/charts/istiod/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.5/charts/istiod/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.5/charts/istiod/files/profile-demo.yaml b/resources/v1.24.5/charts/istiod/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.5/charts/istiod/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.5/charts/istiod/files/profile-platform-k3s.yaml b/resources/v1.24.5/charts/istiod/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.5/charts/istiod/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.5/charts/istiod/files/waypoint.yaml b/resources/v1.24.5/charts/istiod/files/waypoint.yaml
deleted file mode 100644
index 07a420878..000000000
--- a/resources/v1.24.5/charts/istiod/files/waypoint.yaml
+++ /dev/null
@@ -1,336 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-mesh-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": "{{.Name}}"
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "istio.io/dataplane-mode" "none"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-mesh-controller"
-          ) | nindent 8}}
-    spec:
-      {{- if .Values.global.waypoint.affinity }}
-      affinity:
-      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.topologySpreadConstraints }}
-      topologySpreadConstraints:
-      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.nodeSelector }}
-      nodeSelector:
-      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.tolerations }}
-      tolerations:
-      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: 2
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-        {{- else }}
-        image: "{{ .ProxyImage }}"
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        args:
-        - proxy
-        - waypoint
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --serviceCluster
-        - {{.ServiceAccount}}.$(POD_NAMESPACE)
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-        {{- if .Values.global.logAsJson }}
-        - --log_as_json
-        {{- end }}
-        {{- if .Values.global.proxy.outlierLogPath }}
-        - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-        {{- end}}
-        env:
-        - name: ISTIO_META_SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        {{- if .ProxyConfig.ProxyMetadata }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
-        {{- if $network }}
-        - name: ISTIO_META_NETWORK
-          value: "{{ $network }}"
-        {{- end }}
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: REDIRECT
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName}}
-        - name: ISTIO_META_OWNER
-          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- if .Values.global.waypoint.resources }}
-        resources:
-        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        securityContext:
-          privileged: false
-        {{- if not (eq .Values.global.platform "openshift") }}
-          runAsGroup: 1337
-          runAsUser: 1337
-        {{- end }}
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-            - ALL
-{{- if .Values.gateways.seccompProfile }}
-          seccompProfile:
-{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
-{{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/workload-spiffe-uds
-          name: workload-socket
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /etc/istio/pod
-          name: istio-podinfo
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - emptyDir:
-          medium: Memory
-        name: go-proxy-envoy
-      - emptyDir: {}
-        name: istio-data
-      - emptyDir: {}
-        name: go-proxy-data
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.labels
-            path: labels
-          - fieldRef:
-              fieldPath: metadata.annotations
-            path: annotations
-        name: istio-podinfo
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              audience: istio-ca
-              expirationSeconds: 43200
-              path: istio-token
-      - configMap:
-          name: istio-ca-root-cert
-        name: istiod-ca-cert
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap
-      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
-      (omit .InfrastructureAnnotations
-        "kubectl.kubernetes.io/last-applied-configuration"
-        "gateway.istio.io/name-override"
-        "gateway.istio.io/service-account"
-        "gateway.istio.io/controller-version"
-      ) | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": "{{.Name}}"
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.24.5/charts/istiod/templates/autoscale.yaml b/resources/v1.24.5/charts/istiod/templates/autoscale.yaml
deleted file mode 100644
index 09cd6258c..000000000
--- a/resources/v1.24.5/charts/istiod/templates/autoscale.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if and .Values.autoscaleEnabled .Values.autoscaleMin .Values.autoscaleMax }}
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  maxReplicas: {{ .Values.autoscaleMax }}
-  minReplicas: {{ .Values.autoscaleMin }}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  metrics:
-  - type: Resource
-    resource:
-      name: cpu
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.cpu.targetAverageUtilization }}
-  {{- if .Values.memory.targetAverageUtilization }}
-  - type: Resource
-    resource:
-      name: memory
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.memory.targetAverageUtilization }}
-  {{- end }}
-  {{- if .Values.autoscaleBehavior }}
-  behavior: {{ toYaml .Values.autoscaleBehavior | nindent 4 }}
-  {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/clusterrole.yaml b/resources/v1.24.5/charts/istiod/templates/clusterrole.yaml
deleted file mode 100644
index 0c340b5b3..000000000
--- a/resources/v1.24.5/charts/istiod/templates/clusterrole.yaml
+++ /dev/null
@@ -1,187 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  # sidecar injection controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-
-  # configuration validation webhook controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-
-  # istio configuration
-  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
-  # please proceed with caution
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["get", "watch", "list"]
-    resources: ["*"]
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["update", "patch"]
-    resources:
-    - authorizationpolicies/status
-    - destinationrules/status
-    - envoyfilters/status
-    - gateways/status
-    - peerauthentications/status
-    - proxyconfigs/status
-    - requestauthentications/status
-    - serviceentries/status
-    - sidecars/status
-    - telemetries/status
-    - virtualservices/status
-    - wasmplugins/status
-    - workloadentries/status
-    - workloadgroups/status
-{{- end }}
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries/status",  "serviceentries/status" ]
-  - apiGroups: ["security.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "authorizationpolicies/status" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services/status" ]
-
-  # auto-detect installed CRD definitions
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-
-  # discovery and routing
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-
-{{- if .Values.taint.enabled }}
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["patch"]
-{{- end }}
-
-  # ingress controller
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-{{- end}}
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses", "ingressclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-
-  # required for CA's namespace controller
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-
-  # Istiod and bootstrap.
-{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
-{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "certificatesigningrequests"
-      - "certificatesigningrequests/approval"
-      - "certificatesigningrequests/status"
-    verbs: ["update", "create", "get", "delete", "watch"]
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "signers"
-    resourceNames:
-{{- range .Values.global.certSigners }}
-    - {{ . | quote }}
-{{- end }}
-    verbs: ["approve"]
-{{- end}}
-
-  # Used by Istiod to verify the JWT tokens
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-
-  # Used by Istiod to verify gateway SDS
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-
-  # Use for Kubernetes Service APIs
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources:
-    - backendtlspolicies/status
-    - gatewayclasses/status
-    - gateways/status
-    - grpcroutes/status
-    - httproutes/status
-    - referencegrants/status
-    - tcproutes/status
-    - tlsroutes/status
-    - udproutes/status
-    verbs: ["update", "patch"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["gatewayclasses"]
-    verbs: ["create", "update", "patch", "delete"]
-
-  # Needed for multicluster secret reading, possibly ingress certs in the future
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "watch", "list"]
-
-  # Used for MCS serviceexport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: [ "get", "watch", "list", "create", "delete"]
-
-  # Used for MCS serviceimport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "watch", "list"]
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: ["apps"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "deployments" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "serviceaccounts"]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.24.5/charts/istiod/templates/clusterrolebinding.yaml
deleted file mode 100644
index 10781b407..000000000
--- a/resources/v1.24.5/charts/istiod/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-- kind: ServiceAccount
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.24.5/charts/istiod/templates/configmap-jwks.yaml
deleted file mode 100644
index 3505d2822..000000000
--- a/resources/v1.24.5/charts/istiod/templates/configmap-jwks.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.jwksResolverExtraRootCA }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  extra.pem: {{ .Values.jwksResolverExtraRootCA | quote }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/configmap-values.yaml b/resources/v1.24.5/charts/istiod/templates/configmap-values.yaml
deleted file mode 100644
index a7e60369d..000000000
--- a/resources/v1.24.5/charts/istiod/templates/configmap-values.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  original-values: |-
-{{ .Values._original | toPrettyJson | indent 4 }}
-{{- $_ := unset $.Values "_original" }}
-  merged-values: |-
-{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.24.5/charts/istiod/templates/configmap.yaml b/resources/v1.24.5/charts/istiod/templates/configmap.yaml
deleted file mode 100644
index 57702ea53..000000000
--- a/resources/v1.24.5/charts/istiod/templates/configmap.yaml
+++ /dev/null
@@ -1,109 +0,0 @@
-{{- define "mesh" }}
-    # The trust domain corresponds to the trust root of a system.
-    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
-    trustDomain: "cluster.local"
-
-    # The namespace to treat as the administrative root namespace for Istio configuration.
-    # When processing a leaf namespace Istio will search for declarations in that namespace first
-    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
-    # is processed as if it were declared in the leaf namespace.
-    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
-
-  {{ $prom := include "default-prometheus" . | eq "true" }}
-  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
-  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
-  {{- if or $prom $sdMetrics $sdLogs }}
-    defaultProviders:
-    {{- if or $prom $sdMetrics }}
-      metrics:
-      {{ if $prom }}- prometheus{{ end }}
-      {{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
-    {{- end }}
-    {{- if and $sdMetrics $sdLogs }}
-      accessLogging:
-      - stackdriver
-    {{- end }}
-  {{- end }}
-
-    defaultConfig:
-      {{- if .Values.global.meshID }}
-      meshId: "{{ .Values.global.meshID }}"
-      {{- end }}
-      {{- with (.Values.global.proxy.variant | default .Values.global.variant) }}
-      image:
-        imageType: {{. | quote}}
-      {{- end }}
-      {{- if not (eq .Values.global.proxy.tracer "none") }}
-      tracing:
-      {{- if eq .Values.global.proxy.tracer "lightstep" }}
-        lightstep:
-          # Address of the LightStep Satellite pool
-          address: {{ .Values.global.tracer.lightstep.address }}
-          # Access Token used to communicate with the Satellite pool
-          accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
-      {{- else if eq .Values.global.proxy.tracer "zipkin" }}
-        zipkin:
-          # Address of the Zipkin collector
-          address: {{ ((.Values.global.tracer).zipkin).address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
-      {{- else if eq .Values.global.proxy.tracer "datadog" }}
-        datadog:
-          # Address of the Datadog Agent
-          address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
-      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
-        stackdriver:
-          # enables trace output to stdout.
-          debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}
-          # The global default max number of attributes per span.
-          maxNumberOfAttributes: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAttributes | default "200" }}
-          # The global default max number of annotation events per span.
-          maxNumberOfAnnotations: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAnnotations | default "200" }}
-          # The global default max number of message events per span.
-          maxNumberOfMessageEvents: {{ (($.Values.global.tracer).stackdriver).maxNumberOfMessageEvents | default "200" }}
-      {{- else if eq .Values.global.proxy.tracer "openCensusAgent" }}
-      {{/* Fill in openCensusAgent configuration from meshConfig so it isn't overwritten below */}}
-{{ toYaml $.Values.meshConfig.defaultConfig.tracing | indent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- if .Values.global.remotePilotAddress }}
-      discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
-      {{- else }}
-      discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
-      {{- end }}
-{{- end }}
-
-{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
-{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
-{{- $originalMesh := include "mesh" . | fromYaml }}
-{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
-
-{{- if .Values.configMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-
-  # Configuration file for the mesh networks to be used by the Split Horizon EDS.
-  meshNetworks: |-
-  {{- if .Values.global.meshNetworks }}
-    networks:
-{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
-  {{- else }}
-    networks: {}
-  {{- end }}
-
-  mesh: |-
-{{- if .Values.meshConfig }}
-{{ $mesh | toYaml | indent 4 }}
-{{- else }}
-{{- include "mesh" . }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/deployment.yaml b/resources/v1.24.5/charts/istiod/templates/deployment.yaml
deleted file mode 100644
index cd48ab757..000000000
--- a/resources/v1.24.5/charts/istiod/templates/deployment.yaml
+++ /dev/null
@@ -1,290 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- range $key, $val := .Values.deploymentLabels }}
-    {{ $key }}: "{{ $val }}"
-{{- end }}
-spec:
-{{- if not .Values.autoscaleEnabled }}
-{{- if .Values.replicaCount }}
-  replicas: {{ .Values.replicaCount }}
-{{- end }}
-{{- end }}
-  strategy:
-    rollingUpdate:
-      maxSurge: {{ .Values.rollingMaxSurge }}
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  selector:
-    matchLabels:
-      {{- if ne .Values.revision "" }}
-      app: istiod
-      istio.io/rev: {{ .Values.revision | default "default" | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
-  template:
-    metadata:
-      labels:
-        app: istiod
-        istio.io/rev: {{ .Values.revision | default "default" | quote }}
-        sidecar.istio.io/inject: "false"
-        operator.istio.io/component: "Pilot"
-        {{- if ne .Values.revision "" }}
-        istio: istiod
-        {{- else }}
-        istio: pilot
-        {{- end }}
-        {{- range $key, $val := .Values.podLabels }}
-        {{ $key }}: "{{ $val }}"
-        {{- end }}
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: "istiod"
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        prometheus.io/port: "15014"
-        prometheus.io/scrape: "true"
-        sidecar.istio.io/inject: "false"
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{- if .Values.nodeSelector }}
-      nodeSelector:
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- with .Values.affinity }}
-      affinity:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      tolerations:
-        - key: cni.istio.io/not-ready
-          operator: "Exists"
-{{- with .Values.tolerations }}
-{{- toYaml . | nindent 8 }}
-{{- end }}
-{{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- if .Values.global.priorityClassName }}
-      priorityClassName: "{{ .Values.global.priorityClassName }}"
-{{- end }}
-{{- with .Values.initContainers }}
-      initContainers:
-        {{- tpl (toYaml .) $ | nindent 8 }}
-{{- end }}
-      containers:
-        - name: discovery
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
-{{- end }}
-{{- if .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
-{{- end }}
-          args:
-          - "discovery"
-          - --monitoringAddr=:15014
-{{- if .Values.global.logging.level }}
-          - --log_output_level={{ .Values.global.logging.level }}
-{{- end}}
-{{- if .Values.global.logAsJson }}
-          - --log_as_json
-{{- end }}
-          - --domain
-          - {{ .Values.global.proxy.clusterDomain }}
-{{- if .Values.taint.namespace }}
-          - --cniNamespace={{ .Values.taint.namespace }}
-{{- end }}
-          - --keepaliveMaxServerConnectionAge
-          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
-{{- if .Values.extraContainerArgs }}
-          {{- with .Values.extraContainerArgs }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-{{- end }}
-          ports:
-          - containerPort: 8080
-            protocol: TCP
-            name: http-debug
-          - containerPort: 15010
-            protocol: TCP
-            name: grpc-xds
-          - containerPort: 15012
-            protocol: TCP
-            name: tls-xds
-          - containerPort: 15017
-            protocol: TCP
-            name: https-webhooks
-          - containerPort: 15014
-            protocol: TCP
-            name: http-monitoring
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 8080
-            initialDelaySeconds: 1
-            periodSeconds: 3
-            timeoutSeconds: 5
-          env:
-          - name: REVISION
-            value: "{{ .Values.revision | default `default` }}"
-          - name: PILOT_CERT_PROVIDER
-            value: {{ .Values.global.pilotCertProvider }}
-          - name: POD_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.name
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.namespace
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: spec.serviceAccountName
-          - name: KUBECONFIG
-            value: /var/run/secrets/remote/config
-          # If you explicitly told us where ztunnel lives, use that.
-          # Otherwise, assume it lives in our namespace
-          # Also, check for an explicit ENV override (legacy approach) and prefer that
-          # if present
-          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
-          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
-          - name: CA_TRUSTED_NODE_ACCOUNTS
-            value: "{{ $ztTrustedNS }}/ztunnel"
-          {{- end }}
-          {{- if .Values.env }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: "{{ $val }}"
-          {{- end }}
-          {{- end }}
-{{- if .Values.traceSampling }}
-          - name: PILOT_TRACE_SAMPLING
-            value: "{{ .Values.traceSampling }}"
-{{- end }}
-# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
-# don't set it here to avoid duplication.
-# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
-{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
-          - name: EXTERNAL_ISTIOD
-            value: "{{ .Values.global.externalIstiod }}"
-{{- end }}
-          - name: PILOT_ENABLE_ANALYSIS
-            value: "{{ .Values.global.istiod.enableAnalysis }}"
-          - name: CLUSTER_ID
-            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
-          - name: GOMEMLIMIT
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.memory
-          - name: GOMAXPROCS
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.cpu
-                divisor: "1"
-          - name: PLATFORM
-            value: "{{ coalesce .Values.global.platform .Values.platform }}"
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-              - ALL
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          volumeMounts:
-          - name: istio-token
-            mountPath: /var/run/secrets/tokens
-            readOnly: true
-          - name: local-certs
-            mountPath: /var/run/secrets/istio-dns
-          - name: cacerts
-            mountPath: /etc/cacerts
-            readOnly: true
-          - name: istio-kubeconfig
-            mountPath: /var/run/secrets/remote
-            readOnly: true
-          {{- if .Values.jwksResolverExtraRootCA }}
-          - name: extracacerts
-            mountPath: /cacerts
-          {{- end }}
-          - name: istio-csr-dns-cert
-            mountPath: /var/run/secrets/istiod/tls
-            readOnly: true
-          - name: istio-csr-ca-configmap
-            mountPath: /var/run/secrets/istiod/ca
-            readOnly: true
-          {{- with .Values.volumeMounts }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-      volumes:
-      # Technically not needed on this pod - but it helps debugging/testing SDS
-      # Should be removed after everything works.
-      - emptyDir:
-          medium: Memory
-        name: local-certs
-      - name: istio-token
-        projected:
-          sources:
-            - serviceAccountToken:
-                audience: {{ .Values.global.sds.token.aud }}
-                expirationSeconds: 43200
-                path: istio-token
-      # Optional: user-generated root
-      - name: cacerts
-        secret:
-          secretName: cacerts
-          optional: true
-      - name: istio-kubeconfig
-        secret:
-          secretName: istio-kubeconfig
-          optional: true
-      # Optional: istio-csr dns pilot certs
-      - name: istio-csr-dns-cert
-        secret:
-          secretName: istiod-tls
-          optional: true
-      - name: istio-csr-ca-configmap
-        configMap:
-          name: istio-ca-root-cert
-          defaultMode: 420
-          optional: true
-  {{- if .Values.jwksResolverExtraRootCA }}
-      - name: extracacerts
-        configMap:
-          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  {{- end }}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
-
----
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.24.5/charts/istiod/templates/istiod-injector-configmap.yaml
deleted file mode 100644
index 560c284ff..000000000
--- a/resources/v1.24.5/charts/istiod/templates/istiod-injector-configmap.yaml
+++ /dev/null
@@ -1,81 +0,0 @@
-{{- if not .Values.global.omitSidecarInjectorConfigMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
-  values: |-
-{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
-{{ $pilotVals := pick .Values "cni" -}}
-{{ $vals = set $vals "pilot" $pilotVals -}}
-{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
-{{ $vals = set $vals "gateways" $gatewayVals -}}
-{{ $vals | toPrettyJson | indent 4 }}
-
-  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
-  # and istiod webhook functionality.
-  #
-  # New fields should not use Values - it is a 'primary' config object, users should be able
-  # to fine tune it or use it with kube-inject.
-  config: |-
-    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
-    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
-    defaultTemplates:
-{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
-    - {{ . }}
-{{- end }}
-    {{- else }}
-    defaultTemplates: [sidecar]
-    {{- end }}
-    policy: {{ .Values.global.proxy.autoInject }}
-    alwaysInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
-    neverInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
-    injectedAnnotations:
-      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
-      "{{ $key }}": {{ $val | quote }}
-      {{- end }}
-    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
-         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
-         This should make it obvious that their installation is broken.
-     */}}
-    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
-    templates:
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
-      sidecar: |
-{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
-      gateway: |
-{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
-      grpc-simple: |
-{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
-      grpc-agent: |
-{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
-      waypoint: |
-{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
-      kube-gateway: |
-{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
-{{- end }}
-{{- with .Values.sidecarInjectorWebhook.templates }}
-{{ toYaml . | trim | indent 6 }}
-{{- end }}
-
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.24.5/charts/istiod/templates/mutatingwebhook.yaml
deleted file mode 100644
index 22160f70a..000000000
--- a/resources/v1.24.5/charts/istiod/templates/mutatingwebhook.yaml
+++ /dev/null
@@ -1,164 +0,0 @@
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- /* Core defines the common configuration used by all webhook segments */}}
-{{/* Copy just what we need to avoid expensive deepCopy */}}
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "caBundle" .Values.istiodRemote.injectionCABundle
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-    {{- if .caBundle }}
-    caBundle: "{{ .caBundle }}"
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  reinvocationPolicy: "{{ .reinvocationPolicy }}"
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
-{{- if not .Values.global.operatorManageWebhooks }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq .Release.Namespace "istio-system"}}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- else }}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
-
-{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
-{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-
-
-{{- /* Webhooks for default revision */}}
-{{- if (eq .Values.revision "") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.24.5/charts/istiod/templates/poddisruptionbudget.yaml
deleted file mode 100644
index 1eacf16e6..000000000
--- a/resources/v1.24.5/charts/istiod/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    istio: pilot
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app: istiod
-      {{- if ne .Values.revision "" }}
-      istio.io/rev: {{ .Values.revision | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.24.5/charts/istiod/templates/reader-clusterrole.yaml
deleted file mode 100644
index dbaa80503..000000000
--- a/resources/v1.24.5/charts/istiod/templates/reader-clusterrole.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - "config.istio.io"
-      - "security.istio.io"
-      - "networking.istio.io"
-      - "authentication.istio.io"
-      - "rbac.istio.io"
-      - "telemetry.istio.io"
-      - "extensions.istio.io"
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
-    resources: ["gateways"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: ["get", "list", "watch", "create", "delete"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["apps"]
-    resources: ["replicasets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-{{- if .Values.istiodRemote.enabled }}
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-{{- end}}
diff --git a/resources/v1.24.5/charts/istiod/templates/reader-clusterrolebinding.yaml b/resources/v1.24.5/charts/istiod/templates/reader-clusterrolebinding.yaml
deleted file mode 100644
index aea9f01f7..000000000
--- a/resources/v1.24.5/charts/istiod/templates/reader-clusterrolebinding.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istio-reader-service-account
-    namespace: {{ .Values.global.istioNamespace }}
diff --git a/resources/v1.24.5/charts/istiod/templates/remote-istiod-endpoints.yaml b/resources/v1.24.5/charts/istiod/templates/remote-istiod-endpoints.yaml
deleted file mode 100644
index a6de571da..000000000
--- a/resources/v1.24.5/charts/istiod/templates/remote-istiod-endpoints.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-# if the remotePilotAddress is an IP addr
-{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-subsets:
-- addresses:
-  - ip: {{ .Values.global.remotePilotAddress }}
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 15017
-    name: tcp-webhook
-    protocol: TCP
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.24.5/charts/istiod/templates/remote-istiod-service.yaml
deleted file mode 100644
index 220277dc0..000000000
--- a/resources/v1.24.5/charts/istiod/templates/remote-istiod-service.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 443
-    targetPort: 15017
-    name: tcp-webhook
-    protocol: TCP
-  {{- if and .Values.global.remotePilotAddress (not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress)) }}
-  # if the remotePilotAddress is not an IP addr, we use ExternalName
-  type: ExternalName
-  externalName: {{ .Values.global.remotePilotAddress }}
-  {{- end }}
-{{- if .Values.global.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.global.ipFamilies }}
-  ipFamilies:
-{{- range .Values.global.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/revision-tags.yaml b/resources/v1.24.5/charts/istiod/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.24.5/charts/istiod/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/role.yaml b/resources/v1.24.5/charts/istiod/templates/role.yaml
deleted file mode 100644
index 10d89e8d1..000000000
--- a/resources/v1.24.5/charts/istiod/templates/role.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-# permissions to verify the webhook is ready and rejecting
-# invalid config. We use --server-dry-run so no config is persisted.
-- apiGroups: ["networking.istio.io"]
-  verbs: ["create"]
-  resources: ["gateways"]
-
-# For storing CA secret
-- apiGroups: [""]
-  resources: ["secrets"]
-  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
-  verbs: ["create", "get", "watch", "list", "update", "delete"]
-
-# For status controller, so it can delete the distribution report configmap
-- apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["delete"]
-
-# For gateway deployment controller
-- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
-  verbs: ["get", "update", "patch", "create"]
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/rolebinding.yaml b/resources/v1.24.5/charts/istiod/templates/rolebinding.yaml
deleted file mode 100644
index a42f4ec44..000000000
--- a/resources/v1.24.5/charts/istiod/templates/rolebinding.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/service.yaml b/resources/v1.24.5/charts/istiod/templates/service.yaml
deleted file mode 100644
index 30d5b8912..000000000
--- a/resources/v1.24.5/charts/istiod/templates/service.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  {{- if .Values.serviceAnnotations }}
-  annotations:
-{{ toYaml .Values.serviceAnnotations | indent 4 }}
-  {{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: istiod
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-    - port: 15010
-      name: grpc-xds # plaintext
-      protocol: TCP
-    - port: 15012
-      name: https-dns # mTLS with k8s-signed cert
-      protocol: TCP
-    - port: 443
-      name: https-webhook # validation and injection
-      targetPort: 15017
-      protocol: TCP
-    - port: 15014
-      name: http-monitoring # prometheus stats
-      protocol: TCP
-  selector:
-    app: istiod
-    {{- if ne .Values.revision "" }}
-    istio.io/rev: {{ .Values.revision | quote }}
-    {{- else }}
-    # Label used by the 'default' service. For versioned deployments we match with app and version.
-    # This avoids default deployment picking the canary
-    istio: pilot
-    {{- end }}
-  {{- if .Values.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.ipFamilyPolicy }}
-  {{- end }}
-  {{- if .Values.ipFamilies }}
-  ipFamilies:
-  {{- range .Values.ipFamilies }}
-  - {{ . }}
-  {{- end }}
-  {{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/serviceaccount.yaml b/resources/v1.24.5/charts/istiod/templates/serviceaccount.yaml
deleted file mode 100644
index a673a4d07..000000000
--- a/resources/v1.24.5/charts/istiod/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-  {{- if .Values.serviceAccountAnnotations }}
-  annotations:
-{{- toYaml .Values.serviceAccountAnnotations | nindent 4 }}
-  {{- end }}
-{{- end }}
----
diff --git a/resources/v1.24.5/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.24.5/charts/istiod/templates/validatingadmissionpolicy.yaml
deleted file mode 100644
index d36eef68e..000000000
--- a/resources/v1.24.5/charts/istiod/templates/validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.experimental.stableValidationPolicy }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-policy-binding{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-spec:
-  policyName: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  validationActions: [Deny]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.24.5/charts/istiod/templates/validatingwebhookconfiguration.yaml
deleted file mode 100644
index fb28836a0..000000000
--- a/resources/v1.24.5/charts/istiod/templates/validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,68 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.global.configValidation }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  # Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
-  # are rejecting invalid configs on a per-revision basis.
-  - name: rev.validation.istio.io
-    clientConfig:
-      # Should change from base but cannot for API compat
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.5/charts/istiod/templates/zzy_descope_legacy.yaml b/resources/v1.24.5/charts/istiod/templates/zzy_descope_legacy.yaml
deleted file mode 100644
index ae8fced29..000000000
--- a/resources/v1.24.5/charts/istiod/templates/zzy_descope_legacy.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-{{/* Copy anything under `.pilot` to `.`, to avoid the need to specify a redundant prefix.
-Due to the file naming, this always happens after zzz_profile.yaml */}}
-{{- $_ := mustMergeOverwrite $.Values (index $.Values "pilot") }}
\ No newline at end of file
diff --git a/resources/v1.24.5/charts/istiod/templates/zzz_profile.yaml b/resources/v1.24.5/charts/istiod/templates/zzz_profile.yaml
deleted file mode 100644
index 52f665fbd..000000000
--- a/resources/v1.24.5/charts/istiod/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $x := set $.Values "_original" (deepCopy $.Values) }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.5/charts/istiod/values.yaml b/resources/v1.24.5/charts/istiod/values.yaml
deleted file mode 100644
index 2eec94045..000000000
--- a/resources/v1.24.5/charts/istiod/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.24.5
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.24.5/charts/revisiontags/Chart.yaml b/resources/v1.24.5/charts/revisiontags/Chart.yaml
deleted file mode 100644
index 243a76e02..000000000
--- a/resources/v1.24.5/charts/revisiontags/Chart.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.5
-description: Helm chart for istio revision tags
-name: revisiontags
-sources:
-- https://github.com/istio-ecosystem/sail-operator
-version: 0.1.0
-
diff --git a/resources/v1.24.5/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.24.5/charts/revisiontags/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.5/charts/revisiontags/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.5/charts/revisiontags/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.5/charts/revisiontags/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.5/charts/revisiontags/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.5/charts/revisiontags/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.5/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.5/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.5/charts/revisiontags/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.5/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.5/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.5/charts/revisiontags/files/profile-demo.yaml b/resources/v1.24.5/charts/revisiontags/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.5/charts/revisiontags/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.5/charts/revisiontags/files/profile-platform-k3s.yaml b/resources/v1.24.5/charts/revisiontags/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.5/charts/revisiontags/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.5/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.24.5/charts/revisiontags/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.24.5/charts/revisiontags/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.5/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.24.5/charts/revisiontags/templates/zzz_profile.yaml
deleted file mode 100644
index 52f665fbd..000000000
--- a/resources/v1.24.5/charts/revisiontags/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $x := set $.Values "_original" (deepCopy $.Values) }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.5/charts/revisiontags/values.yaml b/resources/v1.24.5/charts/revisiontags/values.yaml
deleted file mode 100644
index 2eec94045..000000000
--- a/resources/v1.24.5/charts/revisiontags/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.24.5
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.24.5/charts/ztunnel/Chart.yaml b/resources/v1.24.5/charts/ztunnel/Chart.yaml
deleted file mode 100644
index ee981c63b..000000000
--- a/resources/v1.24.5/charts/ztunnel/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.5
-description: Helm chart for istio ztunnel components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-ztunnel
-- istio
-name: ztunnel
-sources:
-- https://github.com/istio/istio
-version: 1.24.5
diff --git a/resources/v1.24.5/charts/ztunnel/README.md b/resources/v1.24.5/charts/ztunnel/README.md
deleted file mode 100644
index ffe0b94fe..000000000
--- a/resources/v1.24.5/charts/ztunnel/README.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# Istio Ztunnel Helm Chart
-
-This chart installs an Istio ztunnel.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart:
-
-```console
-helm install ztunnel istio/ztunnel
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the chart:
-
-```console
-helm delete ztunnel
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/ztunnel
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.24.5/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.24.5/charts/ztunnel/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.5/charts/ztunnel/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.5/charts/ztunnel/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.5/charts/ztunnel/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.5/charts/ztunnel/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.5/charts/ztunnel/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.5/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.5/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.5/charts/ztunnel/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.5/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.5/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.5/charts/ztunnel/files/profile-demo.yaml b/resources/v1.24.5/charts/ztunnel/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.5/charts/ztunnel/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.5/charts/ztunnel/files/profile-platform-k3s.yaml b/resources/v1.24.5/charts/ztunnel/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.5/charts/ztunnel/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.5/charts/ztunnel/templates/daemonset.yaml b/resources/v1.24.5/charts/ztunnel/templates/daemonset.yaml
deleted file mode 100644
index c6e2daf48..000000000
--- a/resources/v1.24.5/charts/ztunnel/templates/daemonset.yaml
+++ /dev/null
@@ -1,197 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-spec:
-  updateStrategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app: ztunnel
-  template:
-    metadata:
-      labels:
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app: ztunnel
-        app.kubernetes.io/name: ztunnel
-        {{- include "istio.labels" . | nindent 8}}
-{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-{{- if .Values.revision }}
-        istio.io/rev: {{ .Values.revision }}
-{{- end }}
-{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-{{- if .Values.nodeSelector }}
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- if .Values.affinity }}
-      affinity:
-{{ toYaml .Values.affinity | trim | indent 8 }}
-{{- end }}
-      serviceAccountName: ztunnel
-      tolerations:
-        - effect: NoSchedule
-          operator: Exists
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      containers:
-      - name: istio-proxy
-{{- if contains "/" .Values.image }}
-        image: "{{ .Values.image }}"
-{{- else }}
-        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
-{{- end }}
-        ports:
-        - containerPort: 15020
-          name: ztunnel-stats
-          protocol: TCP
-        resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 10 }}
-{{- end }}
-{{- with .Values.imagePullPolicy }}
-        imagePullPolicy: {{ . }}
-{{- end }}
-        securityContext:
-          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
-          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
-          allowPrivilegeEscalation: true
-          privileged: false
-          capabilities:
-            drop:
-            - ALL
-            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
-            - NET_ADMIN # Required for TPROXY and setsockopt
-            - SYS_ADMIN # Required for `setns` - doing things in other netns
-            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
-          readOnlyRootFilesystem: true
-          runAsGroup: 1337
-          runAsNonRoot: false
-          runAsUser: 0
-{{- if .Values.seLinuxOptions }}
-          seLinuxOptions:
-{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
-{{- end }}
-        readinessProbe:
-          httpGet:
-            port: 15021
-            path: /healthz/ready
-        args:
-        - proxy
-        - ztunnel
-        env:
-        - name: CA_ADDRESS
-        {{- if .Values.caAddress }}
-          value: {{ .Values.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: XDS_ADDRESS
-        {{- if .Values.xdsAddress }}
-          value: {{ .Values.xdsAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        {{- if .Values.logAsJson }}
-        - name: LOG_FORMAT
-          value: json
-        {{- end}}
-        - name: RUST_LOG
-          value: {{ .Values.logLevel | quote }}
-        - name: RUST_BACKTRACE
-          value: "1"
-        - name: ISTIO_META_CLUSTER_ID
-          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
-        - name: INPOD_ENABLED
-          value: "true"
-        - name: TERMINATION_GRACE_PERIOD_SECONDS
-          value: "{{ .Values.terminationGracePeriodSeconds }}"
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
-        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        {{- with .Values.env }}
-        {{- range $key, $val := . }}
-        - name: {{ $key }}
-          value: "{{ $val }}"
-        {{- end }}
-        {{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /var/run/ztunnel
-          name: cni-ztunnel-sock-dir
-        - mountPath: /tmp
-          name: tmp
-        {{- with .Values.volumeMounts }}
-          {{- toYaml . | nindent 8 }}
-        {{- end }}
-      priorityClassName: system-node-critical
-      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
-      volumes:
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: istio-ca
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      - name: cni-ztunnel-sock-dir
-        hostPath:
-          path: /var/run/ztunnel
-          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
-      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
-      - name: tmp
-        emptyDir: {}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
diff --git a/resources/v1.24.5/charts/ztunnel/templates/rbac.yaml b/resources/v1.24.5/charts/ztunnel/templates/rbac.yaml
deleted file mode 100644
index 65bbea52b..000000000
--- a/resources/v1.24.5/charts/ztunnel/templates/rbac.yaml
+++ /dev/null
@@ -1,72 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-  {{- with .Values.imagePullSecrets }}
-imagePullSecrets:
-  {{- range . }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
----
-{{- if (eq (.Values.platform | default "") "openshift") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: ztunnel
-  labels:
-    app: ztunnel
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-rules:
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: ztunnel
-  labels:
-    app: ztunnel
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ztunnel
-subjects:
-- kind: ServiceAccount
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-{{- end }}
----
diff --git a/resources/v1.24.5/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.24.5/charts/ztunnel/templates/zzz_profile.yaml
deleted file mode 100644
index 72d3adc53..000000000
--- a/resources/v1.24.5/charts/ztunnel/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.5/charts/ztunnel/values.yaml b/resources/v1.24.5/charts/ztunnel/values.yaml
deleted file mode 100644
index 593fd980b..000000000
--- a/resources/v1.24.5/charts/ztunnel/values.yaml
+++ /dev/null
@@ -1,98 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
-  hub: gcr.io/istio-release
-  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
-  tag: 1.24.5
-  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
-  variant: ""
-
-  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
-  # If Image contains a "/", it will replace the entire `image` in the pod.
-  image: ztunnel
-
-  # Labels to apply to all top level resources
-  labels: {}
-  # Annotations to apply to all top level resources
-  annotations: {}
-
-  # Additional volumeMounts to the ztunnel container
-  volumeMounts: []
-
-  # Additional volumes to the ztunnel pod
-  volumes: []
-
-  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-
-  # Additional labels to apply on the pod level
-  podLabels: {}
-
-  # Pod resource configuration
-  resources:
-    requests:
-      cpu: 200m
-      # Ztunnel memory scales with the size of the cluster and traffic load
-      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
-      memory: 512Mi
-
-  # List of secret names to add to the service account as image pull secrets
-  imagePullSecrets: []
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
-
-  # Override for the pod imagePullPolicy
-  imagePullPolicy: ""
-
-  # Settings for multicluster
-  multiCluster:
-    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
-    # with Istiod configuration.
-    clusterName: ""
-
-  # meshConfig defines runtime configuration of components.
-  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
-  # components.
-  # TODO: https://github.com/istio/istio/issues/43248
-  meshConfig:
-    defaultConfig:
-      proxyMetadata: {}
-
-  # This value defines:
-  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
-  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
-  # Default K8S value is 30 seconds
-  terminationGracePeriodSeconds: 30
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
-  revision: ""
-
-  # The customized CA address to retrieve certificates for the pods in the cluster.
-  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-  caAddress: ""
-
-  # The customized XDS address to retrieve configuration.
-  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
-  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
-  xdsAddress: ""
-
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
-  istioNamespace: istio-system
-
-  # Configuration log level of ztunnel binary, default is info.
-  # Valid values are: trace, debug, info, warn, error
-  logLevel: info
-
-  # To output all logs in json format
-  logAsJson: false
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seLinuxOptions: {}
-  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
-  #seLinuxOptions:
-  #  type: spc_t
diff --git a/resources/v1.24.5/cni-1.24.5.tgz.etag b/resources/v1.24.5/cni-1.24.5.tgz.etag
deleted file mode 100644
index 28af8cb5c..000000000
--- a/resources/v1.24.5/cni-1.24.5.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-ac097bdd096253758f7553a781c0eec0
diff --git a/resources/v1.24.5/commit b/resources/v1.24.5/commit
deleted file mode 100644
index 6521720b4..000000000
--- a/resources/v1.24.5/commit
+++ /dev/null
@@ -1 +0,0 @@
-1.24.5
diff --git a/resources/v1.24.5/gateway-1.24.5.tgz.etag b/resources/v1.24.5/gateway-1.24.5.tgz.etag
deleted file mode 100644
index d2e5319d5..000000000
--- a/resources/v1.24.5/gateway-1.24.5.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-7c567073b088ccbfa79ef3a6ec147683
diff --git a/resources/v1.24.5/istiod-1.24.5.tgz.etag b/resources/v1.24.5/istiod-1.24.5.tgz.etag
deleted file mode 100644
index 1c4ebd54d..000000000
--- a/resources/v1.24.5/istiod-1.24.5.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-92b826c85f20d4beb1dee46e96e34a85
diff --git a/resources/v1.24.5/profiles/default.yaml b/resources/v1.24.5/profiles/default.yaml
deleted file mode 100644
index e9e0a3931..000000000
--- a/resources/v1.24.5/profiles/default.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  # Most default values come from the helm chart's values.yaml
-  # Below are the things that differ
-  values:
-    defaultRevision: ""
-    global:
-      istioNamespace: istio-system
-      configValidation: true
diff --git a/resources/v1.24.5/ztunnel-1.24.5.tgz.etag b/resources/v1.24.5/ztunnel-1.24.5.tgz.etag
deleted file mode 100644
index 5283e20f7..000000000
--- a/resources/v1.24.5/ztunnel-1.24.5.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-cfabf8363d581f95995b9ef14c73bac5
diff --git a/resources/v1.24.6/base-1.24.6.tgz.etag b/resources/v1.24.6/base-1.24.6.tgz.etag
deleted file mode 100644
index f4ae792a2..000000000
--- a/resources/v1.24.6/base-1.24.6.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-ae95f71ffa885e0c346f7f402e38be55
diff --git a/resources/v1.24.6/charts/base/Chart.yaml b/resources/v1.24.6/charts/base/Chart.yaml
deleted file mode 100644
index af2bd1051..000000000
--- a/resources/v1.24.6/charts/base/Chart.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.6
-description: Helm chart for deploying Istio cluster resources and CRDs
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-name: base
-sources:
-- https://github.com/istio/istio
-version: 1.24.6
diff --git a/resources/v1.24.6/charts/base/files/profile-ambient.yaml b/resources/v1.24.6/charts/base/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.6/charts/base/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.6/charts/base/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.6/charts/base/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.6/charts/base/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.6/charts/base/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.6/charts/base/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.6/charts/base/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.6/charts/base/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.6/charts/base/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.6/charts/base/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.6/charts/base/files/profile-demo.yaml b/resources/v1.24.6/charts/base/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.6/charts/base/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.6/charts/base/files/profile-platform-k3s.yaml b/resources/v1.24.6/charts/base/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.6/charts/base/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.6/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml b/resources/v1.24.6/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
deleted file mode 100644
index 2616b09c9..000000000
--- a/resources/v1.24.6/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,53 +0,0 @@
-{{- if and .Values.experimental.stableValidationPolicy (not (eq .Values.defaultRevision "")) }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-default-policy.istio.io"
-  labels:
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision }}
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-default-policy-binding.istio.io"
-spec:
-  policyName: "stable-channel-default-policy.istio.io"
-  validationActions: [Deny]
-{{- end }}
diff --git a/resources/v1.24.6/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml b/resources/v1.24.6/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
deleted file mode 100644
index 8cb76fd77..000000000
--- a/resources/v1.24.6/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-{{- if not (eq .Values.defaultRevision "") }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istiod-default-validator
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  - name: validation.istio.io
-    clientConfig:
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        {{- if (eq .Values.defaultRevision "default") }}
-        name: istiod
-        {{- else }}
-        name: istiod-{{ .Values.defaultRevision }}
-        {{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-{{- end }}
diff --git a/resources/v1.24.6/charts/base/templates/reader-serviceaccount.yaml b/resources/v1.24.6/charts/base/templates/reader-serviceaccount.yaml
deleted file mode 100644
index ba829a6bf..000000000
--- a/resources/v1.24.6/charts/base/templates/reader-serviceaccount.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-# This singleton service account aggregates reader permissions for the revisions in a given cluster
-# ATM this is a singleton per cluster with Istio installed, and is not revisioned. It maybe should be,
-# as otherwise compromising the token for this SA would give you access to *every* installed revision.
-# Should be used for remote secret creation.
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-    {{- end }}
-    {{- end }}
-metadata:
-  name: istio-reader-service-account
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.24.6/charts/base/templates/zzz_profile.yaml b/resources/v1.24.6/charts/base/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.6/charts/base/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.6/charts/base/values.yaml b/resources/v1.24.6/charts/base/values.yaml
deleted file mode 100644
index 98c9c3645..000000000
--- a/resources/v1.24.6/charts/base/values.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  global:
-
-    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-
-    # Used to locate istiod.
-    istioNamespace: istio-system
-
-    # Platform where Istio is deployed. Possible values are: "openshift", "gcp".
-    # An empty value means it is a vanilla Kubernetes distribution, therefore no special
-    # treatment will be considered.
-    platform: ""
-  base:
-    # A list of CRDs to exclude. Requires `enableCRDTemplates` to be true.
-    # Example: `excludedCRDs: ["envoyfilters.networking.istio.io"]`.
-    # Note: when installing with `istioctl`, `enableIstioConfigCRDs=false` must also be set.
-    excludedCRDs: []
-    # Helm (as of V3) does not support upgrading CRDs, because it is not universally
-    # safe for them to support this.
-    # Istio as a project enforces certain backwards-compat guarantees that allow us
-    # to safely upgrade CRDs in spite of this, so we default to self-managing CRDs
-    # as standard K8S resources in Helm, and disable Helm's CRD management. See also:
-    # https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#method-2-separate-charts
-    enableCRDTemplates: true
-
-    # Validation webhook configuration url
-    # For example: https://$remotePilotAddress:15017/validate
-    validationURL: ""
-    # Validation webhook caBundle value. Useful when running pilot with a well known cert
-    validationCABundle: ""
-
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  defaultRevision: "default"
-  experimental:
-    stableValidationPolicy: false
diff --git a/resources/v1.24.6/charts/cni/Chart.yaml b/resources/v1.24.6/charts/cni/Chart.yaml
deleted file mode 100644
index 1099fd700..000000000
--- a/resources/v1.24.6/charts/cni/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.6
-description: Helm chart for istio-cni components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-cni
-- istio
-name: cni
-sources:
-- https://github.com/istio/istio
-version: 1.24.6
diff --git a/resources/v1.24.6/charts/cni/README.md b/resources/v1.24.6/charts/cni/README.md
deleted file mode 100644
index a8b78d5bd..000000000
--- a/resources/v1.24.6/charts/cni/README.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# Istio CNI Helm Chart
-
-This chart installs the Istio CNI Plugin. See the [CNI installation guide](https://istio.io/latest/docs/setup/additional-setup/cni/)
-for more information.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-cni`:
-
-```console
-helm install istio-cni istio/cni -n kube-system
-```
-
-Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
-`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
-'system-node-critical' outside of kube-system.
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istio-cni
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Ambient
-
-To enable ambient, you can use the ambient profile: `--set profile=ambient`.
-
-#### Calico
-
-For Calico, you must also modify the settings to allow source spoofing:
-
-- if deployed by operator,  `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`
-- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )
-
-### GKE notes
-
-On GKE, 'kube-system' is required.
-
-If using `helm template`, `--set cni.cniBinDir=/home/kubernetes/bin` is required - with `helm install`
-it is auto-detected.
diff --git a/resources/v1.24.6/charts/cni/files/profile-ambient.yaml b/resources/v1.24.6/charts/cni/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.6/charts/cni/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.6/charts/cni/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.6/charts/cni/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.6/charts/cni/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.6/charts/cni/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.6/charts/cni/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.6/charts/cni/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.6/charts/cni/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.6/charts/cni/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.6/charts/cni/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.6/charts/cni/files/profile-demo.yaml b/resources/v1.24.6/charts/cni/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.6/charts/cni/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.6/charts/cni/files/profile-platform-k3s.yaml b/resources/v1.24.6/charts/cni/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.6/charts/cni/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.6/charts/cni/templates/clusterrole.yaml b/resources/v1.24.6/charts/cni/templates/clusterrole.yaml
deleted file mode 100644
index f4d4b7754..000000000
--- a/resources/v1.24.6/charts/cni/templates/clusterrole.yaml
+++ /dev/null
@@ -1,77 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: ["security.openshift.io"] 
-  resources: ["securitycontextconstraints"] 
-  resourceNames: ["privileged"] 
-  verbs: ["use"]
-- apiGroups: [""]
-  resources: ["pods","nodes","namespaces"]
-  verbs: ["get", "list", "watch"]
-{{- if (eq ((coalesce .Values.platform .Values.global.platform) | default "") "openshift") }}
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
-{{- end }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-repair-role
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "patch"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["watch", "get", "list"]
-{{- if .Values.repair.repairPods }}
-{{- /*  No privileges needed*/}}
-{{- else if .Values.repair.deletePods }}
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["delete"]
-{{- else if .Values.repair.labelPods }}
-  - apiGroups: [""]
-    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-    resources: ["pods/status"]
-    verbs: ["patch", "update"]
-{{- end }}
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: [""]
-  {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-  resources: ["pods/status"]
-  verbs: ["patch", "update"]
-{{- end }}
diff --git a/resources/v1.24.6/charts/cni/templates/clusterrolebinding.yaml b/resources/v1.24.6/charts/cni/templates/clusterrolebinding.yaml
deleted file mode 100644
index 42fedab1f..000000000
--- a/resources/v1.24.6/charts/cni/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-repair-rolebinding
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-repair-role
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "name" . }}
-    namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-ambient
-{{- end }}
diff --git a/resources/v1.24.6/charts/cni/templates/configmap-cni.yaml b/resources/v1.24.6/charts/cni/templates/configmap-cni.yaml
deleted file mode 100644
index 1009d55d7..000000000
--- a/resources/v1.24.6/charts/cni/templates/configmap-cni.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: {{ template "name" . }}-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  CURRENT_AGENT_VERSION: {{ .Values.tag | default .Values.global.tag | quote }}
-  AMBIENT_ENABLED: {{ .Values.ambient.enabled | quote }}
-  AMBIENT_DNS_CAPTURE: {{ .Values.ambient.dnsCapture | default "false" | quote  }}
-  AMBIENT_IPV6: {{ .Values.ambient.ipv6 | default "false" | quote }}
-  {{- if .Values.cniConfFileName }} # K8S < 1.24 doesn't like empty values
-  CNI_CONF_NAME: {{ .Values.cniConfFileName }} # Name of the CNI config file to create. Only override if you know the exact path your CNI requires..
-  {{- end }}
-  CHAINED_CNI_PLUGIN: {{ .Values.chained | quote }}
-  EXCLUDE_NAMESPACES: "{{ range $idx, $ns := .Values.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
-  REPAIR_ENABLED: {{ .Values.repair.enabled | quote }}
-  REPAIR_LABEL_PODS: {{ .Values.repair.labelPods | quote }}
-  REPAIR_DELETE_PODS: {{ .Values.repair.deletePods | quote }}
-  REPAIR_REPAIR_PODS: {{ .Values.repair.repairPods | quote }}
-  REPAIR_INIT_CONTAINER_NAME: {{ .Values.repair.initContainerName | quote }}
-  REPAIR_BROKEN_POD_LABEL_KEY: {{ .Values.repair.brokenPodLabelKey | quote }}
-  REPAIR_BROKEN_POD_LABEL_VALUE: {{ .Values.repair.brokenPodLabelValue | quote }}
-  {{- with .Values.env }}
-  {{- range $key, $val := . }}
-  {{ $key }}: "{{ $val }}"
-  {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.6/charts/cni/templates/daemonset.yaml b/resources/v1.24.6/charts/cni/templates/daemonset.yaml
deleted file mode 100644
index 4db08e0db..000000000
--- a/resources/v1.24.6/charts/cni/templates/daemonset.yaml
+++ /dev/null
@@ -1,236 +0,0 @@
-# This manifest installs the Istio install-cni container, as well
-# as the Istio CNI plugin and config on
-# each master and worker node in a Kubernetes cluster.
-{{- $defaultBinDir :=
-    (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
-      "/home/kubernetes/bin"
-      "/opt/cni/bin"
-}}
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  # Note that this is templated but evaluates to a fixed name
-  # which the CNI plugin may fall back onto in some failsafe scenarios.
-  # if this name is changed, CNI plugin logic that checks for this name
-  # format should also be updated.
-  name: {{ template "name" . }}-node
-  namespace: {{ .Release.Namespace }}
-  labels:
-    k8s-app: {{ template "name" . }}-node
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  selector:
-    matchLabels:
-      k8s-app: {{ template "name" . }}-node
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  template:
-    metadata:
-      labels:
-        k8s-app: {{ template "name" . }}-node
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: {{ template "name" . }}
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-        # Add Prometheus Scrape annotations
-        prometheus.io/scrape: 'true'
-        prometheus.io/port: "15014"
-        prometheus.io/path: '/metrics'
-        # Add AppArmor annotation
-        # This is required to avoid conflicts with AppArmor profiles which block certain
-        # privileged pod capabilities.
-        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
-        # securityContext which is otherwise preferred.
-        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
-        # Custom annotations
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{if .Values.ambient.enabled }}
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-{{ end }}
-      nodeSelector:
-        kubernetes.io/os: linux
-      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      tolerations:
-        # Make sure istio-cni-node gets scheduled on all nodes.
-        - effect: NoSchedule
-          operator: Exists
-        # Mark the pod as a critical add-on for rescheduling.
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      priorityClassName: system-node-critical
-      serviceAccountName: {{ template "name" . }}
-      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
-      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
-      terminationGracePeriodSeconds: 5
-      containers:
-        # This container installs the Istio CNI binaries
-        # and CNI network config file on each node.
-        - name: install-cni
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
-{{- end }}
-{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
-{{- end }}
-          ports:
-          - containerPort: 15014
-            name: metrics
-            protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8000
-          securityContext:
-            privileged: false
-            runAsGroup: 0
-            runAsUser: 0
-            runAsNonRoot: false
-            # Both ambient and sidecar repair mode require elevated node privileges to function.
-            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
-            # add capabilities based on feature.
-            capabilities:
-              drop:
-              - ALL
-              add:
-              # CAP_NET_ADMIN is required to allow ipset and route table access
-              - NET_ADMIN
-              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
-              - NET_RAW
-              # CAP_SYS_PTRACE is required for repair mode to describe the pod's network namespace
-              # in ambient and repair mode.
-              - SYS_PTRACE
-              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
-              # network namespaces in `/proc` to obtain descriptors for entering pod network
-              # namespaces. There does not appear to be a more granular capability for this.
-              - SYS_ADMIN
-              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
-              # the typical ability to read/write to folders owned by others.
-              # This can cause problems if the hostPath mounts we use, which we require write access into,
-              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
-              - DAC_OVERRIDE
-{{- if .Values.seLinuxOptions }}
-{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
-            seLinuxOptions:
-{{ toYaml . | trim | indent 14 }}
-{{- end }}
-{{- end }}
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          command: ["install-cni"]
-          args:
-            {{- if or .Values.logging.level .Values.global.logging.level }}
-            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
-            {{- end}}
-            {{- if .Values.global.logAsJson }}
-            - --log_as_json
-            {{- end}}
-          envFrom:
-            - configMapRef:
-                name: {{ template "name" . }}-config
-          env:
-            - name: REPAIR_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: REPAIR_RUN_AS_DAEMON
-              value: "true"
-            - name: REPAIR_SIDECAR_ANNOTATION
-              value: "sidecar.istio.io/status"
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  apiVersion: v1
-                  fieldPath: spec.nodeName
-            - name: GOMEMLIMIT
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.memory
-            - name: GOMAXPROCS
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.cpu
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          volumeMounts:
-            - mountPath: /host/opt/cni/bin
-              name: cni-bin-dir
-            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-            - mountPath: /host/proc
-              name: cni-host-procfs
-              readOnly: true
-            {{- end }}
-            - mountPath: /host/etc/cni/net.d
-              name: cni-net-dir
-            - mountPath: /var/run/istio-cni
-              name: cni-socket-dir
-            {{- if .Values.ambient.enabled }}
-            - mountPath: /host/var/run/netns
-              mountPropagation: HostToContainer
-              name: cni-netns-dir
-            - mountPath: /var/run/ztunnel
-              name: cni-ztunnel-sock-dir
-            {{ end }}
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-      volumes:
-        # Used to install CNI.
-        - name: cni-bin-dir
-          hostPath:
-            path: {{ .Values.cniBinDir | default $defaultBinDir }}
-        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-        - name: cni-host-procfs
-          hostPath:
-            path: /proc
-            type: Directory
-        {{- end }}
-        {{- if .Values.ambient.enabled }}
-        - name: cni-ztunnel-sock-dir
-          hostPath:
-            path: /var/run/ztunnel
-            type: DirectoryOrCreate
-        {{- end }}
-        - name: cni-net-dir
-          hostPath:
-            path: {{ default "/etc/cni/net.d" .Values.cniConfDir }}
-        # Used for UDS sockets for logging, ambient eventing
-        - name: cni-socket-dir
-          hostPath:
-            path: /var/run/istio-cni
-        - name: cni-netns-dir
-          hostPath:
-            path: {{ .Values.cniNetnsDir | default "/var/run/netns" }}
-            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
-            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
-            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.24.6/charts/cni/templates/network-attachment-definition.yaml b/resources/v1.24.6/charts/cni/templates/network-attachment-definition.yaml
deleted file mode 100644
index 86a2eb7c0..000000000
--- a/resources/v1.24.6/charts/cni/templates/network-attachment-definition.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-{{- if eq .Values.provider "multus" }}
-apiVersion: k8s.cni.cncf.io/v1
-kind: NetworkAttachmentDefinition
-metadata:
-  name: {{ template "name" . }}
-  namespace: default
-  labels:
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.24.6/charts/cni/templates/resourcequota.yaml b/resources/v1.24.6/charts/cni/templates/resourcequota.yaml
deleted file mode 100644
index 9a6d61ff9..000000000
--- a/resources/v1.24.6/charts/cni/templates/resourcequota.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-{{- if .Values.resourceQuotas.enabled }}
-apiVersion: v1
-kind: ResourceQuota
-metadata:
-  name: {{ template "name" . }}-resource-quota
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  hard:
-    pods: {{ .Values.resourceQuotas.pods | quote }}
-  scopeSelector:
-    matchExpressions:
-    - operator: In
-      scopeName: PriorityClass
-      values:
-      - system-node-critical
-{{- end }}
diff --git a/resources/v1.24.6/charts/cni/templates/serviceaccount.yaml b/resources/v1.24.6/charts/cni/templates/serviceaccount.yaml
deleted file mode 100644
index 3193d7b74..000000000
--- a/resources/v1.24.6/charts/cni/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-{{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-{{- end }}
-{{- end }}
-metadata:
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.24.6/charts/cni/templates/zzz_profile.yaml b/resources/v1.24.6/charts/cni/templates/zzz_profile.yaml
deleted file mode 100644
index 35623047c..000000000
--- a/resources/v1.24.6/charts/cni/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.6/charts/cni/values.yaml b/resources/v1.24.6/charts/cni/values.yaml
deleted file mode 100644
index 9fe838552..000000000
--- a/resources/v1.24.6/charts/cni/values.yaml
+++ /dev/null
@@ -1,149 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  hub: ""
-  tag: ""
-  variant: ""
-  image: install-cni
-  pullPolicy: ""
-
-  # Same as `global.logging.level`, but will override it if set
-  logging:
-    level: ""
-
-  # Configuration file to insert istio-cni plugin configuration
-  # by default this will be the first file found in the cni-conf-dir
-  # Example
-  # cniConfFileName: 10-calico.conflist
-
-  # CNI bin and conf dir override settings
-  # defaults:
-  cniBinDir: "" # Auto-detected based on version; defaults to /opt/cni/bin.
-  cniConfDir: /etc/cni/net.d
-  cniConfFileName: ""
-  # This directory must exist on the node, if it does not, consult your container runtime
-  # documentation for the appropriate path.
-  cniNetnsDir: # Defaults to '/var/run/netns', in minikube/docker/others can be '/var/run/docker/netns'.
-
-
-  excludeNamespaces:
-    - kube-system
-
-  # Allows user to set custom affinity for the DaemonSet
-  affinity: {}
-
-  # Custom annotations on pod level, if you need them
-  podAnnotations: {}
-
-  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
-  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
-  chained: true
-
-  # Custom configuration happens based on the CNI provider.
-  # Possible values: "default", "multus"
-  provider: "default"
-
-  # Configure ambient settings
-  ambient:
-    # If enabled, ambient redirection will be enabled
-    enabled: false
-    # Set ambient config dir path: defaults to /etc/ambient-config
-    configDir: ""
-    # If enabled, and ambient is enabled, DNS redirection will be enabled
-    dnsCapture: false
-    # If enabled, and ambient is enabled, enables ipv6 support
-    ipv6: true
-
-
-  repair:
-    enabled: true
-    hub: ""
-    tag: ""
-
-    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
-    # This defines the action the controller will take when a pod is detected as broken.
-
-    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
-    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
-    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
-    labelPods: false
-    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
-    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
-    deletePods: false
-    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
-    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
-    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
-    repairPods: true
-
-    initContainerName: "istio-validation"
-
-    brokenPodLabelKey: "cni.istio.io/uninitialized"
-    brokenPodLabelValue: "true"
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
-  seLinuxOptions: {}
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 100Mi
-
-  resourceQuotas:
-    enabled: false
-    pods: 5000
-
-  # The number of pods that can be unavailable during rolling update (see
-  # `updateStrategy.rollingUpdate.maxUnavailable` here:
-  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
-  # May be specified as a number of pods or as a percent of the total number
-  # of pods at the start of the update.
-  rollingMaxUnavailable: 1
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  global:
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-
-    # Default tag for Istio images.
-    tag: 1.24.6
-
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # change cni scope level to control logging out of istio-cni-node DaemonSet
-    logging:
-      level: info
-
-    logAsJson: false
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Default resources allocated
-    defaultResources:
-      requests:
-        cpu: 100m
-        memory: 100Mi
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
diff --git a/resources/v1.24.6/charts/gateway/Chart.yaml b/resources/v1.24.6/charts/gateway/Chart.yaml
deleted file mode 100644
index 3ea40df2d..000000000
--- a/resources/v1.24.6/charts/gateway/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.6
-description: Helm chart for deploying Istio gateways
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- gateways
-name: gateway
-sources:
-- https://github.com/istio/istio
-type: application
-version: 1.24.6
diff --git a/resources/v1.24.6/charts/gateway/README.md b/resources/v1.24.6/charts/gateway/README.md
deleted file mode 100644
index 5c064d165..000000000
--- a/resources/v1.24.6/charts/gateway/README.md
+++ /dev/null
@@ -1,170 +0,0 @@
-# Istio Gateway Helm Chart
-
-This chart installs an Istio gateway deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-ingressgateway`:
-
-```console
-helm install istio-ingressgateway istio/gateway
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istio-ingressgateway` deployment:
-
-```console
-helm delete istio-ingressgateway
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/gateway
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### OpenShift
-
-When deploying the gateway in an OpenShift cluster, use the `openshift` profile to override the default values, for example:
-
-```console
-helm install istio-ingressgateway istio/gateway --set profile=openshift
-```
-
-### `image: auto` Information
-
-The image used by the chart, `auto`, may be unintuitive.
-This exists because the pod spec will be automatically populated at runtime, using the same mechanism as [Sidecar Injection](istio.io/latest/docs/setup/additional-setup/sidecar-injection).
-This allows the same configurations and lifecycle to apply to gateways as sidecars.
-
-Note: this does mean that the namespace the gateway is deployed in must not have the `istio-injection=disabled` label.
-See [Controlling the injection policy](https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy) for more info.
-
-### Examples
-
-#### Egress Gateway
-
-Deploying a Gateway to be used as an [Egress Gateway](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/):
-
-```yaml
-service:
-  # Egress gateways do not need an external LoadBalancer IP
-  type: ClusterIP
-```
-
-#### Multi-network/VM Gateway
-
-Deploying a Gateway to be used as a [Multi-network Gateway](https://istio.io/latest/docs/setup/install/multicluster/) for network `network-1`:
-
-```yaml
-networkGateway: network-1
-```
-
-### Migrating from other installation methods
-
-Installations from other installation methods (such as istioctl, Istio Operator, other helm charts, etc) can be migrated to use the new Helm charts
-following the guidance below.
-If you are able to, a clean installation is simpler. However, this often requires an external IP migration which can be challenging.
-
-WARNING: when installing over an existing deployment, the two deployments will be merged together by Helm, which may lead to unexpected results.
-
-#### Legacy Gateway Helm charts
-
-Istio historically offered two different charts - `manifests/charts/gateways/istio-ingress` and `manifests/charts/gateways/istio-egress`.
-These are replaced by this chart.
-While not required, it is recommended all new users use this chart, and existing users migrate when possible.
-
-This chart has the following benefits and differences:
-* Designed with Helm best practices in mind (standardized values options, values schema, values are not all nested under `gateways.istio-ingressgateway.*`, release name and namespace taken into account, etc).
-* Utilizes Gateway injection, simplifying upgrades, allowing gateways to run in any namespace, and avoiding repeating config for sidecars and gateways.
-* Published to official Istio Helm repository.
-* Single chart for all gateways (Ingress, Egress, East West).
-
-#### General concerns
-
-For a smooth migration, the resource names and `Deployment.spec.selector` labels must match.
-
-If you install with `helm install istio-gateway istio/gateway`, resources will be named `istio-gateway` and the `selector` labels set to:
-
-```yaml
-app: istio-gateway
-istio: gateway # the release name with leading istio- prefix stripped
-```
-
-If your existing installation doesn't follow these names, you can override them. For example, if you have resources named `my-custom-gateway` with `selector` labels
-`foo=bar,istio=ingressgateway`:
-
-```yaml
-name: my-custom-gateway # Override the name to match existing resources
-labels:
-  app: "" # Unset default app selector label
-  istio: ingressgateway # override default istio selector label
-  foo: bar # Add the existing custom selector label
-```
-
-#### Migrating an existing Helm release
-
-An existing helm release can be `helm upgrade`d to this chart by using the same release name. For example, if a previous
-installation was done like:
-
-```console
-helm install istio-ingress manifests/charts/gateways/istio-ingress -n istio-system
-```
-
-It could be upgraded with
-
-```console
-helm upgrade istio-ingress manifests/charts/gateway -n istio-system --set name=istio-ingressgateway --set labels.app=istio-ingressgateway --set labels.istio=ingressgateway
-```
-
-Note the name and labels are overridden to match the names of the existing installation.
-
-Warning: the helm charts here default to using port 80 and 443, while the old charts used 8080 and 8443.
-If you have AuthorizationPolicies that reference port these ports, you should update them during this process,
-or customize the ports to match the old defaults.
-See the [security advisory](https://istio.io/latest/news/security/istio-security-2021-002/) for more information.
-
-#### Other migrations
-
-If you see errors like `rendered manifests contain a resource that already exists` during installation, you may need to forcibly take ownership.
-
-The script below can handle this for you. Replace `RELEASE` and `NAMESPACE` with the name and namespace of the release:
-
-```console
-KINDS=(service deployment)
-RELEASE=istio-ingressgateway
-NAMESPACE=istio-system
-for KIND in "${KINDS[@]}"; do
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-name=$RELEASE
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-namespace=$NAMESPACE
-    kubectl --namespace $NAMESPACE --overwrite=true label $KIND $RELEASE app.kubernetes.io/managed-by=Helm
-done
-```
-
-You may ignore errors about resources not being found.
diff --git a/resources/v1.24.6/charts/gateway/files/profile-ambient.yaml b/resources/v1.24.6/charts/gateway/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.6/charts/gateway/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.6/charts/gateway/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.6/charts/gateway/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.6/charts/gateway/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.6/charts/gateway/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.6/charts/gateway/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.6/charts/gateway/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.6/charts/gateway/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.6/charts/gateway/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.6/charts/gateway/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.6/charts/gateway/files/profile-demo.yaml b/resources/v1.24.6/charts/gateway/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.6/charts/gateway/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.6/charts/gateway/files/profile-platform-k3s.yaml b/resources/v1.24.6/charts/gateway/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.6/charts/gateway/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.6/charts/gateway/templates/deployment.yaml b/resources/v1.24.6/charts/gateway/templates/deployment.yaml
deleted file mode 100644
index 9db59d8b9..000000000
--- a/resources/v1.24.6/charts/gateway/templates/deployment.yaml
+++ /dev/null
@@ -1,128 +0,0 @@
-apiVersion: apps/v1
-kind: {{ .Values.kind | default "Deployment" }}
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  {{- with .Values.replicaCount }}
-  replicas: {{ . }}
-  {{- end }}
-  {{- end }}
-  {{- with .Values.strategy }}
-  strategy:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.minReadySeconds }}
-  minReadySeconds: {{ . }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "gateway.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
-        {{- include "gateway.selectorLabels" . | nindent 8 }}
-        app.kubernetes.io/name: {{ include "gateway.name" . }}
-        {{- include "istio.labels" .  | nindent 8}}
-        {{- range $key, $val := .Values.labels }}
-        {{- if and (ne $key "app") (ne $key "istio") }}
-        {{ $key | quote }}: {{ $val | quote }}
-        {{- end }}
-        {{- end }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
-      securityContext:
-      {{- if .Values.securityContext }}
-        {{- toYaml .Values.securityContext | nindent 8 }}
-      {{- else }}
-        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- end }}
-      {{- with .Values.volumes }}
-      volumes:
-        {{ toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: istio-proxy
-          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
-          image: auto
-          {{- with .Values.imagePullPolicy }}
-          imagePullPolicy: {{ . }}
-          {{- end }}
-          securityContext:
-          {{- if .Values.containerSecurityContext }}
-            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          {{- else }}
-            capabilities:
-              drop:
-              - ALL
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            {{- if not (eq (.Values.platform | default "") "openshift") }}
-            runAsUser: 1337
-            runAsGroup: 1337
-            {{- end }}
-            runAsNonRoot: true
-          {{- end }}
-          env:
-          {{- with .Values.networkGateway }}
-          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-            value: "{{.}}"
-          {{- end }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: {{ $val | quote }}
-          {{- end }}
-          ports:
-          - containerPort: 15090
-            protocol: TCP
-            name: http-envoy-prom
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          {{- with .Values.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.readinessProbe }}
-          readinessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
-      {{- with .Values.priorityClassName }}
-      priorityClassName: {{ . }}
-      {{- end }}
diff --git a/resources/v1.24.6/charts/gateway/templates/poddisruptionbudget.yaml b/resources/v1.24.6/charts/gateway/templates/poddisruptionbudget.yaml
deleted file mode 100644
index b0155cdf0..000000000
--- a/resources/v1.24.6/charts/gateway/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-{{- if .Values.podDisruptionBudget }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-spec:
-  selector:
-    matchLabels:
-  {{- include "gateway.selectorLabels" . | nindent 6 }}
-  {{- with .Values.podDisruptionBudget }}
-    {{- toYaml . | nindent 2 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.24.6/charts/gateway/templates/service.yaml b/resources/v1.24.6/charts/gateway/templates/service.yaml
deleted file mode 100644
index 25ce3bcb0..000000000
--- a/resources/v1.24.6/charts/gateway/templates/service.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-{{- if not (eq .Values.service.type "None") }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-    {{- with .Values.networkGateway }}
-    topology.istio.io/network: "{{.}}"
-    {{- end }}
-  annotations:
-    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
-spec:
-{{- with .Values.service.loadBalancerIP }}
-  loadBalancerIP: "{{ . }}"
-{{- end }}
-{{- if eq .Values.service.type "LoadBalancer" }}
-  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
-  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
-  {{- end }}
-{{- end }}
-{{- if .Values.service.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.service.ipFamilies }}
-  ipFamilies:
-{{- range .Values.service.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
-{{- with .Values.service.loadBalancerSourceRanges }}
-  loadBalancerSourceRanges:
-{{ toYaml . | indent 4 }}
-{{- end }}
-{{- with .Values.service.externalTrafficPolicy }}
-  externalTrafficPolicy: "{{ . }}"
-{{- end }}
-  type: {{ .Values.service.type }}
-  ports:
-{{- if .Values.networkGateway }}
-  - name: status-port
-    port: 15021
-    targetPort: 15021
-  - name: tls
-    port: 15443
-    targetPort: 15443
-  - name: tls-istiod
-    port: 15012
-    targetPort: 15012
-  - name: tls-webhook
-    port: 15017
-    targetPort: 15017
-{{- else }}
-{{ .Values.service.ports | toYaml | indent 4 }}
-{{- end }}
-{{- if .Values.service.externalIPs }}
-  externalIPs: {{- range .Values.service.externalIPs }}
-    - {{.}}
-  {{- end }}
-{{- end }}
-  selector:
-    {{- include "gateway.selectorLabels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.24.6/charts/gateway/templates/zzz_profile.yaml b/resources/v1.24.6/charts/gateway/templates/zzz_profile.yaml
deleted file mode 100644
index 72d3adc53..000000000
--- a/resources/v1.24.6/charts/gateway/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.6/charts/gateway/values.schema.json b/resources/v1.24.6/charts/gateway/values.schema.json
deleted file mode 100644
index 3fdaa2730..000000000
--- a/resources/v1.24.6/charts/gateway/values.schema.json
+++ /dev/null
@@ -1,330 +0,0 @@
-{
-  "$schema": "http://json-schema.org/schema#",
-  "$defs": {
-    "values": {
-      "type": "object",
-      "properties": {
-        "global": {
-          "type": "object"
-        },
-        "affinity": {
-          "type": "object"
-        },
-        "securityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "containerSecurityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "kind": {
-          "type": "string",
-          "enum": [
-            "Deployment",
-            "DaemonSet"
-          ]
-        },
-        "annotations": {
-          "additionalProperties": {
-            "type": [
-              "string",
-              "integer"
-            ]
-          },
-          "type": "object"
-        },
-        "autoscaling": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            },
-            "maxReplicas": {
-              "type": "integer"
-            },
-            "minReplicas": {
-              "type": "integer"
-            },
-            "targetCPUUtilizationPercentage": {
-              "type": "integer"
-            }
-          }
-        },
-        "env": {
-          "type": "object"
-        },
-        "strategy": {
-          "type": "object"
-        },
-        "minReadySeconds": {
-          "type": [
-            "null",
-            "integer"
-          ]
-        },
-        "readinessProbe": {
-          "type": [
-            "null",
-            "object"
-          ]
-        },
-        "labels": {
-          "type": "object"
-        },
-        "name": {
-          "type": "string"
-        },
-        "nodeSelector": {
-          "type": "object"
-        },
-        "podAnnotations": {
-          "type": "object",
-          "properties": {
-            "inject.istio.io/templates": {
-              "type": "string"
-            },
-            "prometheus.io/path": {
-              "type": "string"
-            },
-            "prometheus.io/port": {
-              "type": "string"
-            },
-            "prometheus.io/scrape": {
-              "type": "string"
-            }
-          }
-        },
-        "replicaCount": {
-          "type": [
-            "integer",
-            "null"
-          ]
-        },
-        "resources": {
-          "type": "object",
-          "properties": {
-            "limits": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            },
-            "requests": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            }
-          }
-        },
-        "revision": {
-          "type": "string"
-        },
-        "compatibilityVersion": {
-          "type": "string"
-        },
-        "runAsRoot": {
-          "type": "boolean"
-        },
-        "unprivilegedPort": {
-          "type": [
-            "string",
-            "boolean"
-          ],
-          "enum": [
-            true,
-            false,
-            "auto"
-          ]
-        },
-        "service": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "externalTrafficPolicy": {
-              "type": "string"
-            },
-            "loadBalancerIP": {
-              "type": "string"
-            },
-            "loadBalancerSourceRanges": {
-              "type": "array"
-            },
-            "ipFamilies": {
-              "items": {
-                "type": "string",
-                "enum": [
-                  "IPv4",
-                  "IPv6"
-                ]
-              }
-            },
-            "ipFamilyPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "SingleStack",
-                "PreferDualStack",
-                "RequireDualStack"
-              ]
-            },
-            "ports": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string"
-                  },
-                  "port": {
-                    "type": "integer"
-                  },
-                  "protocol": {
-                    "type": "string"
-                  },
-                  "targetPort": {
-                    "type": "integer"
-                  }
-                }
-              }
-            },
-            "type": {
-              "type": "string"
-            }
-          }
-        },
-        "serviceAccount": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "name": {
-              "type": "string"
-            },
-            "create": {
-              "type": "boolean"
-            }
-          }
-        },
-        "rbac": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            }
-          }
-        },
-        "tolerations": {
-          "type": "array"
-        },
-        "topologySpreadConstraints": {
-          "type": "array"
-        },
-        "networkGateway": {
-          "type": "string"
-        },
-        "imagePullPolicy": {
-          "type": "string",
-          "enum": [
-            "",
-            "Always",
-            "IfNotPresent",
-            "Never"
-          ]
-        },
-        "imagePullSecrets": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "name": {
-                "type": "string"
-              }
-            }
-          }
-        },
-        "podDisruptionBudget": {
-          "type": "object",
-          "properties": {
-            "minAvailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "maxUnavailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "unhealthyPodEvictionPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "IfHealthyBudget",
-                "AlwaysAllow"
-              ]
-            }
-          }
-        },
-        "terminationGracePeriodSeconds": {
-          "type": "number"
-        },
-        "volumes": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "volumeMounts": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "priorityClassName": {
-          "type": "string"
-        },
-        "_internal_defaults_do_not_set": {
-          "type": "object"
-        }
-      },
-      "additionalProperties": false
-    }
-  },
-  "defaults": {
-    "$ref": "#/$defs/values"
-  },
-  "$ref": "#/$defs/values"
-}
diff --git a/resources/v1.24.6/charts/gateway/values.yaml b/resources/v1.24.6/charts/gateway/values.yaml
deleted file mode 100644
index b02240df1..000000000
--- a/resources/v1.24.6/charts/gateway/values.yaml
+++ /dev/null
@@ -1,166 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Name allows overriding the release name. Generally this should not be set
-  name: ""
-  # revision declares which revision this gateway is a part of
-  revision: ""
-
-  # Controls the spec.replicas setting for the Gateway deployment if set.
-  # Otherwise defaults to Kubernetes Deployment default (1).
-  replicaCount:
-
-  kind: Deployment
-
-  rbac:
-    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
-    # when using http://gateway-api.org/.
-    enabled: true
-
-  serviceAccount:
-    # If set, a service account will be created. Otherwise, the default is used
-    create: true
-    # Annotations to add to the service account
-    annotations: {}
-    # The name of the service account to use.
-    # If not set, the release name is used
-    name: ""
-
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/stats/prometheus"
-    inject.istio.io/templates: "gateway"
-    sidecar.istio.io/inject: "true"
-
-  # Define the security context for the pod.
-  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-  securityContext: {}
-  containerSecurityContext: {}
-
-  service:
-    # Type of service. Set to "None" to disable the service entirely
-    type: LoadBalancer
-    ports:
-    - name: status-port
-      port: 15021
-      protocol: TCP
-      targetPort: 15021
-    - name: http2
-      port: 80
-      protocol: TCP
-      targetPort: 80
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
-    annotations: {}
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    externalTrafficPolicy: ""
-    externalIPs: []
-    ipFamilyPolicy: ""
-    ipFamilies: []
-    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
-    # allocateLoadBalancerNodePorts: false
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: 2000m
-      memory: 1024Mi
-
-  autoscaling:
-    enabled: true
-    minReplicas: 1
-    maxReplicas: 5
-    targetCPUUtilizationPercentage: 80
-    targetMemoryUtilizationPercentage: {}
-    autoscaleBehavior: {}
-
-  # Pod environment variables
-  env: {}
-
-  # Deployment Update strategy
-  strategy: {}
-  
-  # Sets the Deployment minReadySeconds value
-  minReadySeconds:
-  
-  # Optionally configure a custom readinessProbe. By default the control plane
-  # automatically injects the readinessProbe. If you wish to override that
-  # behavior, you may define your own readinessProbe here.
-  readinessProbe: {}
-
-  # Labels to apply to all resources
-  labels: {}
-
-  # Annotations to apply to all resources
-  annotations: {}
-
-  nodeSelector: {}
-
-  tolerations: []
-
-  topologySpreadConstraints: []
-
-  affinity: {}
-
-  # If specified, the gateway will act as a network gateway for the given network.
-  networkGateway: ""
-
-  # Specify image pull policy if default behavior isn't desired.
-  # Default behavior: latest images will be Always else IfNotPresent
-  imagePullPolicy: ""
-
-  imagePullSecrets: []
-
-  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
-  #
-  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
-  # which means that no PodDisruptionBudget resource will be created.
-  #
-  # To enable the PodDisruptionBudget, configure it by specifying the
-  # `minAvailable` or `maxUnavailable`. For example, to set the
-  # minimum number of available replicas to 1, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #
-  # Or, to allow a maximum of 1 unavailable replica, you can set:
-  #
-  # podDisruptionBudget:
-  #   maxUnavailable: 1
-  #
-  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
-  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #   unhealthyPodEvictionPolicy: AlwaysAllow
-  #
-  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
-  #
-  # podDisruptionBudget: {}
-  #
-  podDisruptionBudget: {}
-
-  # Sets the per-pod terminationGracePeriodSeconds setting.
-  terminationGracePeriodSeconds: 30
-
-  # A list of `Volumes` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumes: []
-
-  # A list of `VolumeMounts` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumeMounts: []
-
-  # Configure this to a higher priority class in order to make sure your Istio gateway pods
-  # will not be killed because of low priority class.
-  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-  # for more detail.
-  priorityClassName: ""
diff --git a/resources/v1.24.6/charts/istiod/Chart.yaml b/resources/v1.24.6/charts/istiod/Chart.yaml
deleted file mode 100644
index 7efdd6e56..000000000
--- a/resources/v1.24.6/charts/istiod/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.6
-description: Helm chart for istio control plane
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- istiod
-- istio-discovery
-name: istiod
-sources:
-- https://github.com/istio/istio
-version: 1.24.6
diff --git a/resources/v1.24.6/charts/istiod/README.md b/resources/v1.24.6/charts/istiod/README.md
deleted file mode 100644
index ddbfbc8fe..000000000
--- a/resources/v1.24.6/charts/istiod/README.md
+++ /dev/null
@@ -1,73 +0,0 @@
-# Istiod Helm Chart
-
-This chart installs an Istiod deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-Before installing, ensure CRDs are installed in the cluster (from the `istio/base` chart).
-
-To install the chart with the release name `istiod`:
-
-```console
-kubectl create namespace istio-system
-helm install istiod istio/istiod --namespace istio-system
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istiod` deployment:
-
-```console
-helm delete istiod --namespace istio-system
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istiod
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Examples
-
-#### Configuring mesh configuration settings
-
-Any [Mesh Config](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/) options can be configured like below:
-
-```yaml
-meshConfig:
-  accessLogFile: /dev/stdout
-```
-
-#### Revisions
-
-Control plane revisions allow deploying multiple versions of the control plane in the same cluster.
-This allows safe [canary upgrades](https://istio.io/latest/docs/setup/upgrade/canary/)
-
-```yaml
-revision: my-revision-name
-```
diff --git a/resources/v1.24.6/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.24.6/charts/istiod/files/gateway-injection-template.yaml
deleted file mode 100644
index dbd83cc57..000000000
--- a/resources/v1.24.6/charts/istiod/files/gateway-injection-template.yaml
+++ /dev/null
@@ -1,253 +0,0 @@
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations:
-    istio.io/rev: {{ .Revision | default "default" | quote }}
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- end }}
-spec:
-  securityContext:
-  {{- if .Values.gateways.securityContext }}
-    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
-  {{- else }}
-    sysctls:
-    - name: net.ipv4.ip_unprivileged_port_start
-      value: "0"
-  {{- end }}
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - router
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- end }}
-    securityContext:
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-    env:
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-  volumes:
-  - emptyDir: {}
-    name: workload-socket
-  - emptyDir: {}
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else}}
-  - emptyDir: {}
-    name: workload-certs
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.6/charts/istiod/files/grpc-agent.yaml b/resources/v1.24.6/charts/istiod/files/grpc-agent.yaml
deleted file mode 100644
index 7290fcdca..000000000
--- a/resources/v1.24.6/charts/istiod/files/grpc-agent.yaml
+++ /dev/null
@@ -1,310 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-    sidecar.istio.io/rewriteAppHTTPProbers: "false",
-  }
-spec:
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15020
-      protocol: TCP
-      name: mesh-metrics
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-          - --url=http://localhost:15020/healthz/ready
-    env:
-    - name: ISTIO_META_GENERATOR
-      value: grpc
-    - name: OUTPUT_CERTS
-      value: /var/lib/istio/data
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    # grpc uses xds:/// to resolve – no need to resolve VIP
-    - name: ISTIO_META_DNS_CAPTURE
-      value: "false"
-    - name: DISABLE_ENVOY
-      value: "true"
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15020
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # UDS channel between istioagent and gRPC client for XDS/SDS
-    - mountPath: /etc/istio/proxy
-      name: istio-xds
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-{{- range $index, $container := .Spec.Containers  }}
-{{ if not (eq $container.Name "istio-proxy") }}
-  - name: {{ $container.Name }}
-    env:
-      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
-        value: "true"
-      - name: "GRPC_XDS_BOOTSTRAP"
-        value: "/etc/istio/proxy/grpc-bootstrap.json"
-    volumeMounts:
-      - mountPath: /var/lib/istio/data
-        name: istio-data
-      # UDS channel between istioagent and gRPC client for XDS/SDS
-      - mountPath: /etc/istio/proxy
-        name: istio-xds
-      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-        readOnly: true
-      {{- else }}
-      - name: workload-certs
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-      {{- end }}
-{{- end }}
-{{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-xds
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.6/charts/istiod/files/injection-template.yaml b/resources/v1.24.6/charts/istiod/files/injection-template.yaml
deleted file mode 100644
index 0ef948e6a..000000000
--- a/resources/v1.24.6/charts/istiod/files/injection-template.yaml
+++ /dev/null
@@ -1,510 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
-    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
-    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
-    {{- end }}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-{{- if .Values.pilot.cni.enabled }}
-    {{- if eq .Values.pilot.cni.provider "multus" }}
-    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
-    {{- end }}
-    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}traffic.sidecar.istio.io/includeInboundPorts: "{{.}}",{{ end }}
-    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
-    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
-    {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
-    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
-    {{- end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
-{{- end }}
-  }
-spec:
-  {{- $holdProxy := and
-      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
-      (not $nativeSidecar) }}
-  initContainers:
-  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
-  {{ if .Values.pilot.cni.enabled -}}
-  - name: istio-validation
-  {{ else -}}
-  - name: istio-init
-  {{ end -}}
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    args:
-    - istio-iptables
-    - "-p"
-    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
-    - "-z"
-    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
-    - "-u"
-    - {{ .ProxyUID | default "1337" | quote }}
-    - "-m"
-    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
-    - "-i"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
-    - "-x"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
-    - "-b"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
-    - "-d"
-  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
-    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
-  {{- else }}
-    - "15090,15021"
-  {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
-    - "-q"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
-    {{ end -}}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
-    - "-o"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
-    {{ end -}}
-     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
-    - "-c"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
-    {{ end -}}
-    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
-    {{ if .Values.global.logAsJson -}}
-    - "--log_as_json"
-    {{ end -}}
-    {{ if .Values.pilot.cni.enabled -}}
-    - "--run-validation"
-    - "--skip-rule-apply"
-    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
-    - "--force-apply"
-    {{ end -}}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-  {{- if .ProxyConfig.ProxyMetadata }}
-    env:
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-  {{- end }}
-    resources:
-  {{ template "resources" . }}
-    securityContext:
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      privileged: {{ .Values.global.proxy.privileged }}
-      capabilities:
-    {{- if not .Values.pilot.cni.enabled }}
-        add:
-        - NET_ADMIN
-        - NET_RAW
-    {{- end }}
-        drop:
-        - ALL
-    {{- if not .Values.pilot.cni.enabled }}
-      readOnlyRootFilesystem: false
-      runAsGroup: 0
-      runAsNonRoot: false
-      runAsUser: 0
-    {{- else }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsNonRoot: true
-    {{- end }}
-  {{ end -}}
-  {{ if not $nativeSidecar }}
-  containers:
-  {{ end }}
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.outlierLogPath }}
-    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-  {{- end}}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- else if $holdProxy }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-  {{- else if $nativeSidecar }}
-    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
-    lifecycle:
-      preStop:
-        exec:
-          command:
-          - pilot-agent
-          - request
-          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
-          - POST
-          - drain
-  {{- end }}
-    env:
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - name: ISTIO_BOOTSTRAP_OVERRIDE
-      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
-    {{- end }}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-  {{ if .Values.global.proxy.startupProbe.enabled }}
-    startupProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: 0
-      periodSeconds: 1
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
-  {{ end }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    {{ end -}}
-    securityContext:
-      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
-      allowPrivilegeEscalation: true
-      capabilities:
-        add:
-        - NET_ADMIN
-        drop:
-        - ALL
-      privileged: true
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else }}
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      capabilities:
-        {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-        add:
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
-        - NET_ADMIN
-        {{- end }}
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
-        - NET_BIND_SERVICE
-        {{- end }}
-        {{- end }}
-        drop:
-        - ALL
-      privileged: {{ .Values.global.proxy.privileged }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else -}}
-      runAsNonRoot: true
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      {{- end }}
-      {{- end }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - mountPath: /etc/istio/custom-bootstrap
-      name: custom-bootstrap-volume
-    {{- end }}
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
-      name: lightstep-certs
-      readOnly: true
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  - emptyDir:
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-  - name: lightstep-certs
-    secret:
-      optional: true
-      secretName: lightstep.cacert
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.24.6/charts/istiod/files/kube-gateway.yaml b/resources/v1.24.6/charts/istiod/files/kube-gateway.yaml
deleted file mode 100644
index dbe158de1..000000000
--- a/resources/v1.24.6/charts/istiod/files/kube-gateway.yaml
+++ /dev/null
@@ -1,345 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-gateway-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": {{.Name}}
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-gateway-controller"
-          ) | nindent 8 }}
-    spec:
-      securityContext:
-      {{- if .Values.gateways.securityContext }}
-        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
-      {{- else }}
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- if .Values.gateways.seccompProfile }}
-        seccompProfile:
-      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
-      {{- end }}
-      {{- end }}
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-      {{- else }}
-        image: "{{ .ProxyImage }}"
-      {{- end }}
-        {{- if .Values.global.proxy.resources }}
-        resources:
-          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsUser: {{ .ProxyUID | default "1337" }}
-          runAsGroup: {{ .ProxyGID | default "1337" }}
-          runAsNonRoot: true
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        args:
-        - proxy
-        - router
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-      {{- if .Values.global.sts.servicePort }}
-        - --stsPort={{ .Values.global.sts.servicePort }}
-      {{- end }}
-      {{- if .Values.global.logAsJson }}
-        - --log_as_json
-      {{- end }}
-      {{- if .Values.global.proxy.lifecycle }}
-        lifecycle:
-          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
-      {{- end }}
-        env:
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        - name: ISTIO_META_POD_PORTS
-          value: "[]"
-        - name: ISTIO_META_APP_CONTAINERS
-          value: ""
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: "{{ .ProxyConfig.InterceptionMode.String }}"
-        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
-        - name: ISTIO_META_NETWORK
-          value: {{.|quote}}
-        {{- end }}
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName|quote}}
-        - name: ISTIO_META_OWNER
-          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
-        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-          value: {{.|quote}}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        volumeMounts:
-        - name: workload-socket
-          mountPath: /var/run/secrets/workload-spiffe-uds
-        - name: credential-socket
-          mountPath: /var/run/secrets/credential-uds
-        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-        - name: gke-workload-certificate
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-          readOnly: true
-        {{- else }}
-        - name: workload-certs
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-        {{- end }}
-        {{- if eq .Values.global.pilotCertProvider "istiod" }}
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        {{- end }}
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        # SDS channel between istioagent and Envoy
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - name: istio-podinfo
-          mountPath: /etc/istio/pod
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir: {}
-        name: credential-socket
-      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        csi:
-          driver: workloadcertificates.security.cloud.google.com
-      {{- else}}
-      - emptyDir: {}
-        name: workload-certs
-      {{- end }}
-      # SDS channel between istioagent and Envoy
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - name: istio-data
-        emptyDir: {}
-      - name: istio-podinfo
-        downwardAPI:
-          items:
-            - path: "labels"
-              fieldRef:
-                fieldPath: metadata.labels
-            - path: "annotations"
-              fieldRef:
-                fieldPath: metadata.annotations
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: {{ .Values.global.sds.token.aud }}
-      {{- if eq .Values.global.pilotCertProvider "istiod" }}
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: {{.UID}}
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": {{.Name}}
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.24.6/charts/istiod/files/profile-ambient.yaml b/resources/v1.24.6/charts/istiod/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.6/charts/istiod/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.6/charts/istiod/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.6/charts/istiod/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.6/charts/istiod/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.6/charts/istiod/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.6/charts/istiod/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.6/charts/istiod/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.6/charts/istiod/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.6/charts/istiod/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.6/charts/istiod/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.6/charts/istiod/files/profile-demo.yaml b/resources/v1.24.6/charts/istiod/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.6/charts/istiod/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.6/charts/istiod/files/profile-platform-k3s.yaml b/resources/v1.24.6/charts/istiod/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.6/charts/istiod/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.6/charts/istiod/files/waypoint.yaml b/resources/v1.24.6/charts/istiod/files/waypoint.yaml
deleted file mode 100644
index 07a420878..000000000
--- a/resources/v1.24.6/charts/istiod/files/waypoint.yaml
+++ /dev/null
@@ -1,336 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-mesh-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": "{{.Name}}"
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "istio.io/dataplane-mode" "none"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-mesh-controller"
-          ) | nindent 8}}
-    spec:
-      {{- if .Values.global.waypoint.affinity }}
-      affinity:
-      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.topologySpreadConstraints }}
-      topologySpreadConstraints:
-      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.nodeSelector }}
-      nodeSelector:
-      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.tolerations }}
-      tolerations:
-      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: 2
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-        {{- else }}
-        image: "{{ .ProxyImage }}"
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        args:
-        - proxy
-        - waypoint
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --serviceCluster
-        - {{.ServiceAccount}}.$(POD_NAMESPACE)
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-        {{- if .Values.global.logAsJson }}
-        - --log_as_json
-        {{- end }}
-        {{- if .Values.global.proxy.outlierLogPath }}
-        - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-        {{- end}}
-        env:
-        - name: ISTIO_META_SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        {{- if .ProxyConfig.ProxyMetadata }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
-        {{- if $network }}
-        - name: ISTIO_META_NETWORK
-          value: "{{ $network }}"
-        {{- end }}
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: REDIRECT
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName}}
-        - name: ISTIO_META_OWNER
-          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- if .Values.global.waypoint.resources }}
-        resources:
-        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        securityContext:
-          privileged: false
-        {{- if not (eq .Values.global.platform "openshift") }}
-          runAsGroup: 1337
-          runAsUser: 1337
-        {{- end }}
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-            - ALL
-{{- if .Values.gateways.seccompProfile }}
-          seccompProfile:
-{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
-{{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/workload-spiffe-uds
-          name: workload-socket
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /etc/istio/pod
-          name: istio-podinfo
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - emptyDir:
-          medium: Memory
-        name: go-proxy-envoy
-      - emptyDir: {}
-        name: istio-data
-      - emptyDir: {}
-        name: go-proxy-data
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.labels
-            path: labels
-          - fieldRef:
-              fieldPath: metadata.annotations
-            path: annotations
-        name: istio-podinfo
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              audience: istio-ca
-              expirationSeconds: 43200
-              path: istio-token
-      - configMap:
-          name: istio-ca-root-cert
-        name: istiod-ca-cert
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap
-      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
-      (omit .InfrastructureAnnotations
-        "kubectl.kubernetes.io/last-applied-configuration"
-        "gateway.istio.io/name-override"
-        "gateway.istio.io/service-account"
-        "gateway.istio.io/controller-version"
-      ) | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": "{{.Name}}"
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.24.6/charts/istiod/templates/autoscale.yaml b/resources/v1.24.6/charts/istiod/templates/autoscale.yaml
deleted file mode 100644
index 09cd6258c..000000000
--- a/resources/v1.24.6/charts/istiod/templates/autoscale.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if and .Values.autoscaleEnabled .Values.autoscaleMin .Values.autoscaleMax }}
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  maxReplicas: {{ .Values.autoscaleMax }}
-  minReplicas: {{ .Values.autoscaleMin }}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  metrics:
-  - type: Resource
-    resource:
-      name: cpu
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.cpu.targetAverageUtilization }}
-  {{- if .Values.memory.targetAverageUtilization }}
-  - type: Resource
-    resource:
-      name: memory
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.memory.targetAverageUtilization }}
-  {{- end }}
-  {{- if .Values.autoscaleBehavior }}
-  behavior: {{ toYaml .Values.autoscaleBehavior | nindent 4 }}
-  {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/clusterrole.yaml b/resources/v1.24.6/charts/istiod/templates/clusterrole.yaml
deleted file mode 100644
index 0c340b5b3..000000000
--- a/resources/v1.24.6/charts/istiod/templates/clusterrole.yaml
+++ /dev/null
@@ -1,187 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  # sidecar injection controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-
-  # configuration validation webhook controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-
-  # istio configuration
-  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
-  # please proceed with caution
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["get", "watch", "list"]
-    resources: ["*"]
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["update", "patch"]
-    resources:
-    - authorizationpolicies/status
-    - destinationrules/status
-    - envoyfilters/status
-    - gateways/status
-    - peerauthentications/status
-    - proxyconfigs/status
-    - requestauthentications/status
-    - serviceentries/status
-    - sidecars/status
-    - telemetries/status
-    - virtualservices/status
-    - wasmplugins/status
-    - workloadentries/status
-    - workloadgroups/status
-{{- end }}
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries/status",  "serviceentries/status" ]
-  - apiGroups: ["security.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "authorizationpolicies/status" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services/status" ]
-
-  # auto-detect installed CRD definitions
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-
-  # discovery and routing
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-
-{{- if .Values.taint.enabled }}
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["patch"]
-{{- end }}
-
-  # ingress controller
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-{{- end}}
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses", "ingressclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-
-  # required for CA's namespace controller
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-
-  # Istiod and bootstrap.
-{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
-{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "certificatesigningrequests"
-      - "certificatesigningrequests/approval"
-      - "certificatesigningrequests/status"
-    verbs: ["update", "create", "get", "delete", "watch"]
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "signers"
-    resourceNames:
-{{- range .Values.global.certSigners }}
-    - {{ . | quote }}
-{{- end }}
-    verbs: ["approve"]
-{{- end}}
-
-  # Used by Istiod to verify the JWT tokens
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-
-  # Used by Istiod to verify gateway SDS
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-
-  # Use for Kubernetes Service APIs
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources:
-    - backendtlspolicies/status
-    - gatewayclasses/status
-    - gateways/status
-    - grpcroutes/status
-    - httproutes/status
-    - referencegrants/status
-    - tcproutes/status
-    - tlsroutes/status
-    - udproutes/status
-    verbs: ["update", "patch"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["gatewayclasses"]
-    verbs: ["create", "update", "patch", "delete"]
-
-  # Needed for multicluster secret reading, possibly ingress certs in the future
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "watch", "list"]
-
-  # Used for MCS serviceexport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: [ "get", "watch", "list", "create", "delete"]
-
-  # Used for MCS serviceimport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "watch", "list"]
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: ["apps"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "deployments" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "serviceaccounts"]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.24.6/charts/istiod/templates/clusterrolebinding.yaml
deleted file mode 100644
index 10781b407..000000000
--- a/resources/v1.24.6/charts/istiod/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-- kind: ServiceAccount
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.24.6/charts/istiod/templates/configmap-jwks.yaml
deleted file mode 100644
index 3505d2822..000000000
--- a/resources/v1.24.6/charts/istiod/templates/configmap-jwks.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.jwksResolverExtraRootCA }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  extra.pem: {{ .Values.jwksResolverExtraRootCA | quote }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/configmap-values.yaml b/resources/v1.24.6/charts/istiod/templates/configmap-values.yaml
deleted file mode 100644
index a7e60369d..000000000
--- a/resources/v1.24.6/charts/istiod/templates/configmap-values.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  original-values: |-
-{{ .Values._original | toPrettyJson | indent 4 }}
-{{- $_ := unset $.Values "_original" }}
-  merged-values: |-
-{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.24.6/charts/istiod/templates/configmap.yaml b/resources/v1.24.6/charts/istiod/templates/configmap.yaml
deleted file mode 100644
index 57702ea53..000000000
--- a/resources/v1.24.6/charts/istiod/templates/configmap.yaml
+++ /dev/null
@@ -1,109 +0,0 @@
-{{- define "mesh" }}
-    # The trust domain corresponds to the trust root of a system.
-    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
-    trustDomain: "cluster.local"
-
-    # The namespace to treat as the administrative root namespace for Istio configuration.
-    # When processing a leaf namespace Istio will search for declarations in that namespace first
-    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
-    # is processed as if it were declared in the leaf namespace.
-    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
-
-  {{ $prom := include "default-prometheus" . | eq "true" }}
-  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
-  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
-  {{- if or $prom $sdMetrics $sdLogs }}
-    defaultProviders:
-    {{- if or $prom $sdMetrics }}
-      metrics:
-      {{ if $prom }}- prometheus{{ end }}
-      {{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
-    {{- end }}
-    {{- if and $sdMetrics $sdLogs }}
-      accessLogging:
-      - stackdriver
-    {{- end }}
-  {{- end }}
-
-    defaultConfig:
-      {{- if .Values.global.meshID }}
-      meshId: "{{ .Values.global.meshID }}"
-      {{- end }}
-      {{- with (.Values.global.proxy.variant | default .Values.global.variant) }}
-      image:
-        imageType: {{. | quote}}
-      {{- end }}
-      {{- if not (eq .Values.global.proxy.tracer "none") }}
-      tracing:
-      {{- if eq .Values.global.proxy.tracer "lightstep" }}
-        lightstep:
-          # Address of the LightStep Satellite pool
-          address: {{ .Values.global.tracer.lightstep.address }}
-          # Access Token used to communicate with the Satellite pool
-          accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
-      {{- else if eq .Values.global.proxy.tracer "zipkin" }}
-        zipkin:
-          # Address of the Zipkin collector
-          address: {{ ((.Values.global.tracer).zipkin).address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
-      {{- else if eq .Values.global.proxy.tracer "datadog" }}
-        datadog:
-          # Address of the Datadog Agent
-          address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
-      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
-        stackdriver:
-          # enables trace output to stdout.
-          debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}
-          # The global default max number of attributes per span.
-          maxNumberOfAttributes: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAttributes | default "200" }}
-          # The global default max number of annotation events per span.
-          maxNumberOfAnnotations: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAnnotations | default "200" }}
-          # The global default max number of message events per span.
-          maxNumberOfMessageEvents: {{ (($.Values.global.tracer).stackdriver).maxNumberOfMessageEvents | default "200" }}
-      {{- else if eq .Values.global.proxy.tracer "openCensusAgent" }}
-      {{/* Fill in openCensusAgent configuration from meshConfig so it isn't overwritten below */}}
-{{ toYaml $.Values.meshConfig.defaultConfig.tracing | indent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- if .Values.global.remotePilotAddress }}
-      discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
-      {{- else }}
-      discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
-      {{- end }}
-{{- end }}
-
-{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
-{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
-{{- $originalMesh := include "mesh" . | fromYaml }}
-{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
-
-{{- if .Values.configMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-
-  # Configuration file for the mesh networks to be used by the Split Horizon EDS.
-  meshNetworks: |-
-  {{- if .Values.global.meshNetworks }}
-    networks:
-{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
-  {{- else }}
-    networks: {}
-  {{- end }}
-
-  mesh: |-
-{{- if .Values.meshConfig }}
-{{ $mesh | toYaml | indent 4 }}
-{{- else }}
-{{- include "mesh" . }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/deployment.yaml b/resources/v1.24.6/charts/istiod/templates/deployment.yaml
deleted file mode 100644
index cd48ab757..000000000
--- a/resources/v1.24.6/charts/istiod/templates/deployment.yaml
+++ /dev/null
@@ -1,290 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- range $key, $val := .Values.deploymentLabels }}
-    {{ $key }}: "{{ $val }}"
-{{- end }}
-spec:
-{{- if not .Values.autoscaleEnabled }}
-{{- if .Values.replicaCount }}
-  replicas: {{ .Values.replicaCount }}
-{{- end }}
-{{- end }}
-  strategy:
-    rollingUpdate:
-      maxSurge: {{ .Values.rollingMaxSurge }}
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  selector:
-    matchLabels:
-      {{- if ne .Values.revision "" }}
-      app: istiod
-      istio.io/rev: {{ .Values.revision | default "default" | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
-  template:
-    metadata:
-      labels:
-        app: istiod
-        istio.io/rev: {{ .Values.revision | default "default" | quote }}
-        sidecar.istio.io/inject: "false"
-        operator.istio.io/component: "Pilot"
-        {{- if ne .Values.revision "" }}
-        istio: istiod
-        {{- else }}
-        istio: pilot
-        {{- end }}
-        {{- range $key, $val := .Values.podLabels }}
-        {{ $key }}: "{{ $val }}"
-        {{- end }}
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: "istiod"
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        prometheus.io/port: "15014"
-        prometheus.io/scrape: "true"
-        sidecar.istio.io/inject: "false"
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{- if .Values.nodeSelector }}
-      nodeSelector:
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- with .Values.affinity }}
-      affinity:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      tolerations:
-        - key: cni.istio.io/not-ready
-          operator: "Exists"
-{{- with .Values.tolerations }}
-{{- toYaml . | nindent 8 }}
-{{- end }}
-{{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- if .Values.global.priorityClassName }}
-      priorityClassName: "{{ .Values.global.priorityClassName }}"
-{{- end }}
-{{- with .Values.initContainers }}
-      initContainers:
-        {{- tpl (toYaml .) $ | nindent 8 }}
-{{- end }}
-      containers:
-        - name: discovery
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
-{{- end }}
-{{- if .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
-{{- end }}
-          args:
-          - "discovery"
-          - --monitoringAddr=:15014
-{{- if .Values.global.logging.level }}
-          - --log_output_level={{ .Values.global.logging.level }}
-{{- end}}
-{{- if .Values.global.logAsJson }}
-          - --log_as_json
-{{- end }}
-          - --domain
-          - {{ .Values.global.proxy.clusterDomain }}
-{{- if .Values.taint.namespace }}
-          - --cniNamespace={{ .Values.taint.namespace }}
-{{- end }}
-          - --keepaliveMaxServerConnectionAge
-          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
-{{- if .Values.extraContainerArgs }}
-          {{- with .Values.extraContainerArgs }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-{{- end }}
-          ports:
-          - containerPort: 8080
-            protocol: TCP
-            name: http-debug
-          - containerPort: 15010
-            protocol: TCP
-            name: grpc-xds
-          - containerPort: 15012
-            protocol: TCP
-            name: tls-xds
-          - containerPort: 15017
-            protocol: TCP
-            name: https-webhooks
-          - containerPort: 15014
-            protocol: TCP
-            name: http-monitoring
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 8080
-            initialDelaySeconds: 1
-            periodSeconds: 3
-            timeoutSeconds: 5
-          env:
-          - name: REVISION
-            value: "{{ .Values.revision | default `default` }}"
-          - name: PILOT_CERT_PROVIDER
-            value: {{ .Values.global.pilotCertProvider }}
-          - name: POD_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.name
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.namespace
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: spec.serviceAccountName
-          - name: KUBECONFIG
-            value: /var/run/secrets/remote/config
-          # If you explicitly told us where ztunnel lives, use that.
-          # Otherwise, assume it lives in our namespace
-          # Also, check for an explicit ENV override (legacy approach) and prefer that
-          # if present
-          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
-          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
-          - name: CA_TRUSTED_NODE_ACCOUNTS
-            value: "{{ $ztTrustedNS }}/ztunnel"
-          {{- end }}
-          {{- if .Values.env }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: "{{ $val }}"
-          {{- end }}
-          {{- end }}
-{{- if .Values.traceSampling }}
-          - name: PILOT_TRACE_SAMPLING
-            value: "{{ .Values.traceSampling }}"
-{{- end }}
-# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
-# don't set it here to avoid duplication.
-# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
-{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
-          - name: EXTERNAL_ISTIOD
-            value: "{{ .Values.global.externalIstiod }}"
-{{- end }}
-          - name: PILOT_ENABLE_ANALYSIS
-            value: "{{ .Values.global.istiod.enableAnalysis }}"
-          - name: CLUSTER_ID
-            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
-          - name: GOMEMLIMIT
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.memory
-          - name: GOMAXPROCS
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.cpu
-                divisor: "1"
-          - name: PLATFORM
-            value: "{{ coalesce .Values.global.platform .Values.platform }}"
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-              - ALL
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          volumeMounts:
-          - name: istio-token
-            mountPath: /var/run/secrets/tokens
-            readOnly: true
-          - name: local-certs
-            mountPath: /var/run/secrets/istio-dns
-          - name: cacerts
-            mountPath: /etc/cacerts
-            readOnly: true
-          - name: istio-kubeconfig
-            mountPath: /var/run/secrets/remote
-            readOnly: true
-          {{- if .Values.jwksResolverExtraRootCA }}
-          - name: extracacerts
-            mountPath: /cacerts
-          {{- end }}
-          - name: istio-csr-dns-cert
-            mountPath: /var/run/secrets/istiod/tls
-            readOnly: true
-          - name: istio-csr-ca-configmap
-            mountPath: /var/run/secrets/istiod/ca
-            readOnly: true
-          {{- with .Values.volumeMounts }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-      volumes:
-      # Technically not needed on this pod - but it helps debugging/testing SDS
-      # Should be removed after everything works.
-      - emptyDir:
-          medium: Memory
-        name: local-certs
-      - name: istio-token
-        projected:
-          sources:
-            - serviceAccountToken:
-                audience: {{ .Values.global.sds.token.aud }}
-                expirationSeconds: 43200
-                path: istio-token
-      # Optional: user-generated root
-      - name: cacerts
-        secret:
-          secretName: cacerts
-          optional: true
-      - name: istio-kubeconfig
-        secret:
-          secretName: istio-kubeconfig
-          optional: true
-      # Optional: istio-csr dns pilot certs
-      - name: istio-csr-dns-cert
-        secret:
-          secretName: istiod-tls
-          optional: true
-      - name: istio-csr-ca-configmap
-        configMap:
-          name: istio-ca-root-cert
-          defaultMode: 420
-          optional: true
-  {{- if .Values.jwksResolverExtraRootCA }}
-      - name: extracacerts
-        configMap:
-          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  {{- end }}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
-
----
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.24.6/charts/istiod/templates/istiod-injector-configmap.yaml
deleted file mode 100644
index 560c284ff..000000000
--- a/resources/v1.24.6/charts/istiod/templates/istiod-injector-configmap.yaml
+++ /dev/null
@@ -1,81 +0,0 @@
-{{- if not .Values.global.omitSidecarInjectorConfigMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
-  values: |-
-{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
-{{ $pilotVals := pick .Values "cni" -}}
-{{ $vals = set $vals "pilot" $pilotVals -}}
-{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
-{{ $vals = set $vals "gateways" $gatewayVals -}}
-{{ $vals | toPrettyJson | indent 4 }}
-
-  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
-  # and istiod webhook functionality.
-  #
-  # New fields should not use Values - it is a 'primary' config object, users should be able
-  # to fine tune it or use it with kube-inject.
-  config: |-
-    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
-    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
-    defaultTemplates:
-{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
-    - {{ . }}
-{{- end }}
-    {{- else }}
-    defaultTemplates: [sidecar]
-    {{- end }}
-    policy: {{ .Values.global.proxy.autoInject }}
-    alwaysInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
-    neverInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
-    injectedAnnotations:
-      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
-      "{{ $key }}": {{ $val | quote }}
-      {{- end }}
-    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
-         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
-         This should make it obvious that their installation is broken.
-     */}}
-    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
-    templates:
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
-      sidecar: |
-{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
-      gateway: |
-{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
-      grpc-simple: |
-{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
-      grpc-agent: |
-{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
-      waypoint: |
-{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
-      kube-gateway: |
-{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
-{{- end }}
-{{- with .Values.sidecarInjectorWebhook.templates }}
-{{ toYaml . | trim | indent 6 }}
-{{- end }}
-
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.24.6/charts/istiod/templates/mutatingwebhook.yaml
deleted file mode 100644
index 22160f70a..000000000
--- a/resources/v1.24.6/charts/istiod/templates/mutatingwebhook.yaml
+++ /dev/null
@@ -1,164 +0,0 @@
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- /* Core defines the common configuration used by all webhook segments */}}
-{{/* Copy just what we need to avoid expensive deepCopy */}}
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "caBundle" .Values.istiodRemote.injectionCABundle
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-    {{- if .caBundle }}
-    caBundle: "{{ .caBundle }}"
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  reinvocationPolicy: "{{ .reinvocationPolicy }}"
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
-{{- if not .Values.global.operatorManageWebhooks }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq .Release.Namespace "istio-system"}}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- else }}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
-
-{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
-{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-
-
-{{- /* Webhooks for default revision */}}
-{{- if (eq .Values.revision "") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.24.6/charts/istiod/templates/poddisruptionbudget.yaml
deleted file mode 100644
index 1eacf16e6..000000000
--- a/resources/v1.24.6/charts/istiod/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    istio: pilot
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app: istiod
-      {{- if ne .Values.revision "" }}
-      istio.io/rev: {{ .Values.revision | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.24.6/charts/istiod/templates/reader-clusterrole.yaml
deleted file mode 100644
index dbaa80503..000000000
--- a/resources/v1.24.6/charts/istiod/templates/reader-clusterrole.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - "config.istio.io"
-      - "security.istio.io"
-      - "networking.istio.io"
-      - "authentication.istio.io"
-      - "rbac.istio.io"
-      - "telemetry.istio.io"
-      - "extensions.istio.io"
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
-    resources: ["gateways"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: ["get", "list", "watch", "create", "delete"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["apps"]
-    resources: ["replicasets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-{{- if .Values.istiodRemote.enabled }}
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-{{- end}}
diff --git a/resources/v1.24.6/charts/istiod/templates/reader-clusterrolebinding.yaml b/resources/v1.24.6/charts/istiod/templates/reader-clusterrolebinding.yaml
deleted file mode 100644
index aea9f01f7..000000000
--- a/resources/v1.24.6/charts/istiod/templates/reader-clusterrolebinding.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istio-reader-service-account
-    namespace: {{ .Values.global.istioNamespace }}
diff --git a/resources/v1.24.6/charts/istiod/templates/remote-istiod-endpoints.yaml b/resources/v1.24.6/charts/istiod/templates/remote-istiod-endpoints.yaml
deleted file mode 100644
index a6de571da..000000000
--- a/resources/v1.24.6/charts/istiod/templates/remote-istiod-endpoints.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-# if the remotePilotAddress is an IP addr
-{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-subsets:
-- addresses:
-  - ip: {{ .Values.global.remotePilotAddress }}
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 15017
-    name: tcp-webhook
-    protocol: TCP
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.24.6/charts/istiod/templates/remote-istiod-service.yaml
deleted file mode 100644
index 220277dc0..000000000
--- a/resources/v1.24.6/charts/istiod/templates/remote-istiod-service.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 443
-    targetPort: 15017
-    name: tcp-webhook
-    protocol: TCP
-  {{- if and .Values.global.remotePilotAddress (not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress)) }}
-  # if the remotePilotAddress is not an IP addr, we use ExternalName
-  type: ExternalName
-  externalName: {{ .Values.global.remotePilotAddress }}
-  {{- end }}
-{{- if .Values.global.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.global.ipFamilies }}
-  ipFamilies:
-{{- range .Values.global.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/revision-tags.yaml b/resources/v1.24.6/charts/istiod/templates/revision-tags.yaml
deleted file mode 100644
index 607358aa0..000000000
--- a/resources/v1.24.6/charts/istiod/templates/revision-tags.yaml
+++ /dev/null
@@ -1,147 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/role.yaml b/resources/v1.24.6/charts/istiod/templates/role.yaml
deleted file mode 100644
index 10d89e8d1..000000000
--- a/resources/v1.24.6/charts/istiod/templates/role.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-# permissions to verify the webhook is ready and rejecting
-# invalid config. We use --server-dry-run so no config is persisted.
-- apiGroups: ["networking.istio.io"]
-  verbs: ["create"]
-  resources: ["gateways"]
-
-# For storing CA secret
-- apiGroups: [""]
-  resources: ["secrets"]
-  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
-  verbs: ["create", "get", "watch", "list", "update", "delete"]
-
-# For status controller, so it can delete the distribution report configmap
-- apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["delete"]
-
-# For gateway deployment controller
-- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
-  verbs: ["get", "update", "patch", "create"]
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/rolebinding.yaml b/resources/v1.24.6/charts/istiod/templates/rolebinding.yaml
deleted file mode 100644
index a42f4ec44..000000000
--- a/resources/v1.24.6/charts/istiod/templates/rolebinding.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/service.yaml b/resources/v1.24.6/charts/istiod/templates/service.yaml
deleted file mode 100644
index 30d5b8912..000000000
--- a/resources/v1.24.6/charts/istiod/templates/service.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  {{- if .Values.serviceAnnotations }}
-  annotations:
-{{ toYaml .Values.serviceAnnotations | indent 4 }}
-  {{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: istiod
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-    - port: 15010
-      name: grpc-xds # plaintext
-      protocol: TCP
-    - port: 15012
-      name: https-dns # mTLS with k8s-signed cert
-      protocol: TCP
-    - port: 443
-      name: https-webhook # validation and injection
-      targetPort: 15017
-      protocol: TCP
-    - port: 15014
-      name: http-monitoring # prometheus stats
-      protocol: TCP
-  selector:
-    app: istiod
-    {{- if ne .Values.revision "" }}
-    istio.io/rev: {{ .Values.revision | quote }}
-    {{- else }}
-    # Label used by the 'default' service. For versioned deployments we match with app and version.
-    # This avoids default deployment picking the canary
-    istio: pilot
-    {{- end }}
-  {{- if .Values.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.ipFamilyPolicy }}
-  {{- end }}
-  {{- if .Values.ipFamilies }}
-  ipFamilies:
-  {{- range .Values.ipFamilies }}
-  - {{ . }}
-  {{- end }}
-  {{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/serviceaccount.yaml b/resources/v1.24.6/charts/istiod/templates/serviceaccount.yaml
deleted file mode 100644
index a673a4d07..000000000
--- a/resources/v1.24.6/charts/istiod/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-  {{- if .Values.serviceAccountAnnotations }}
-  annotations:
-{{- toYaml .Values.serviceAccountAnnotations | nindent 4 }}
-  {{- end }}
-{{- end }}
----
diff --git a/resources/v1.24.6/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.24.6/charts/istiod/templates/validatingadmissionpolicy.yaml
deleted file mode 100644
index d36eef68e..000000000
--- a/resources/v1.24.6/charts/istiod/templates/validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.experimental.stableValidationPolicy }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-policy-binding{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-spec:
-  policyName: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  validationActions: [Deny]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.24.6/charts/istiod/templates/validatingwebhookconfiguration.yaml
deleted file mode 100644
index fb28836a0..000000000
--- a/resources/v1.24.6/charts/istiod/templates/validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,68 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.global.configValidation }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  # Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
-  # are rejecting invalid configs on a per-revision basis.
-  - name: rev.validation.istio.io
-    clientConfig:
-      # Should change from base but cannot for API compat
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.24.6/charts/istiod/templates/zzy_descope_legacy.yaml b/resources/v1.24.6/charts/istiod/templates/zzy_descope_legacy.yaml
deleted file mode 100644
index ae8fced29..000000000
--- a/resources/v1.24.6/charts/istiod/templates/zzy_descope_legacy.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-{{/* Copy anything under `.pilot` to `.`, to avoid the need to specify a redundant prefix.
-Due to the file naming, this always happens after zzz_profile.yaml */}}
-{{- $_ := mustMergeOverwrite $.Values (index $.Values "pilot") }}
\ No newline at end of file
diff --git a/resources/v1.24.6/charts/istiod/templates/zzz_profile.yaml b/resources/v1.24.6/charts/istiod/templates/zzz_profile.yaml
deleted file mode 100644
index 52f665fbd..000000000
--- a/resources/v1.24.6/charts/istiod/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $x := set $.Values "_original" (deepCopy $.Values) }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.6/charts/istiod/values.yaml b/resources/v1.24.6/charts/istiod/values.yaml
deleted file mode 100644
index 1cdbeb9cd..000000000
--- a/resources/v1.24.6/charts/istiod/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.24.6
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.24.6/charts/revisiontags/Chart.yaml b/resources/v1.24.6/charts/revisiontags/Chart.yaml
deleted file mode 100644
index 2e27880e7..000000000
--- a/resources/v1.24.6/charts/revisiontags/Chart.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.6
-description: Helm chart for istio revision tags
-name: revisiontags
-sources:
-- https://github.com/istio-ecosystem/sail-operator
-version: 0.1.0
-
diff --git a/resources/v1.24.6/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.24.6/charts/revisiontags/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.6/charts/revisiontags/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.6/charts/revisiontags/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.6/charts/revisiontags/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.6/charts/revisiontags/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.6/charts/revisiontags/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.6/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.6/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.6/charts/revisiontags/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.6/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.6/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.6/charts/revisiontags/files/profile-demo.yaml b/resources/v1.24.6/charts/revisiontags/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.6/charts/revisiontags/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.6/charts/revisiontags/files/profile-platform-k3s.yaml b/resources/v1.24.6/charts/revisiontags/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.6/charts/revisiontags/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.6/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.24.6/charts/revisiontags/templates/revision-tags.yaml
deleted file mode 100644
index 607358aa0..000000000
--- a/resources/v1.24.6/charts/revisiontags/templates/revision-tags.yaml
+++ /dev/null
@@ -1,147 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.24.6/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.24.6/charts/revisiontags/templates/zzz_profile.yaml
deleted file mode 100644
index 52f665fbd..000000000
--- a/resources/v1.24.6/charts/revisiontags/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $x := set $.Values "_original" (deepCopy $.Values) }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.6/charts/revisiontags/values.yaml b/resources/v1.24.6/charts/revisiontags/values.yaml
deleted file mode 100644
index 1cdbeb9cd..000000000
--- a/resources/v1.24.6/charts/revisiontags/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.24.6
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.24.6/charts/ztunnel/Chart.yaml b/resources/v1.24.6/charts/ztunnel/Chart.yaml
deleted file mode 100644
index 9a2f7fb25..000000000
--- a/resources/v1.24.6/charts/ztunnel/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.24.6
-description: Helm chart for istio ztunnel components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-ztunnel
-- istio
-name: ztunnel
-sources:
-- https://github.com/istio/istio
-version: 1.24.6
diff --git a/resources/v1.24.6/charts/ztunnel/README.md b/resources/v1.24.6/charts/ztunnel/README.md
deleted file mode 100644
index ffe0b94fe..000000000
--- a/resources/v1.24.6/charts/ztunnel/README.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# Istio Ztunnel Helm Chart
-
-This chart installs an Istio ztunnel.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart:
-
-```console
-helm install ztunnel istio/ztunnel
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the chart:
-
-```console
-helm delete ztunnel
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/ztunnel
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.24.6/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.24.6/charts/ztunnel/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.24.6/charts/ztunnel/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.24.6/charts/ztunnel/files/profile-compatibility-version-1.21.yaml b/resources/v1.24.6/charts/ztunnel/files/profile-compatibility-version-1.21.yaml
deleted file mode 100644
index c8da4d2e1..000000000
--- a/resources/v1.24.6/charts/ztunnel/files/profile-compatibility-version-1.21.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.22 behavioral changes
-    ENABLE_ENHANCED_RESOURCE_SCOPING: "false"
-    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"
-
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  # 1.22 behavioral changes
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_DELTA_XDS: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-    tracing:
-      zipkin:
-        address: zipkin.istio-system:9411
diff --git a/resources/v1.24.6/charts/ztunnel/files/profile-compatibility-version-1.22.yaml b/resources/v1.24.6/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 70d8eb40c..000000000
--- a/resources/v1.24.6/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.6/charts/ztunnel/files/profile-compatibility-version-1.23.yaml b/resources/v1.24.6/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 636bb6f15..000000000
--- a/resources/v1.24.6/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
diff --git a/resources/v1.24.6/charts/ztunnel/files/profile-demo.yaml b/resources/v1.24.6/charts/ztunnel/files/profile-demo.yaml
deleted file mode 100644
index eadbde17c..000000000
--- a/resources/v1.24.6/charts/ztunnel/files/profile-demo.yaml
+++ /dev/null
@@ -1,90 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The demo profile enables a variety of things to try out Istio in non-production environments.
-# * Lower resource utilization.
-# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
-# * More ports enabled on the ingress, which is used in some tasks.
-meshConfig:
-  accessLogFile: /dev/stdout
-  extensionProviders:
-    - name: otel
-      envoyOtelAls:
-        service: opentelemetry-collector.observability.svc.cluster.local
-        port: 4317
-    - name: skywalking
-      skywalking:
-        service: tracing.istio-system.svc.cluster.local
-        port: 11800
-    - name: otel-tracing
-      opentelemetry:
-        port: 4317
-        service: opentelemetry-collector.observability.svc.cluster.local
-
-cni:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-ztunnel:
-  resources:
-    requests:
-      cpu: 10m
-      memory: 40Mi
-
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  waypoint:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-
-pilot:
-  autoscaleEnabled: false
-  traceSampling: 100
-  resources:
-    requests:
-      cpu: 10m
-      memory: 100Mi
-
-gateways:
-  istio-egressgateway:
-    autoscaleEnabled: false
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
-  istio-ingressgateway:
-    autoscaleEnabled: false
-    ports:
-    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
-    # Note that AWS ELB will by default perform health checks on the first port
-    # on this list. Setting this to the health check port will ensure that health
-    # checks always work. https://github.com/istio/istio/issues/12503
-    - port: 15021
-      targetPort: 15021
-      name: status-port
-    - port: 80
-      targetPort: 8080
-      name: http2
-    - port: 443
-      targetPort: 8443
-      name: https
-    - port: 31400
-      targetPort: 31400
-      name: tcp
-      # This is the port where sni routing happens
-    - port: 15443
-      targetPort: 15443
-      name: tls
-    resources:
-      requests:
-        cpu: 10m
-        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.24.6/charts/ztunnel/files/profile-platform-k3s.yaml b/resources/v1.24.6/charts/ztunnel/files/profile-platform-k3s.yaml
deleted file mode 100644
index f3f2884aa..000000000
--- a/resources/v1.24.6/charts/ztunnel/files/profile-platform-k3s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /var/lib/rancher/k3s/data/current/bin/
diff --git a/resources/v1.24.6/charts/ztunnel/templates/daemonset.yaml b/resources/v1.24.6/charts/ztunnel/templates/daemonset.yaml
deleted file mode 100644
index c6e2daf48..000000000
--- a/resources/v1.24.6/charts/ztunnel/templates/daemonset.yaml
+++ /dev/null
@@ -1,197 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-spec:
-  updateStrategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app: ztunnel
-  template:
-    metadata:
-      labels:
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app: ztunnel
-        app.kubernetes.io/name: ztunnel
-        {{- include "istio.labels" . | nindent 8}}
-{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-{{- if .Values.revision }}
-        istio.io/rev: {{ .Values.revision }}
-{{- end }}
-{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-{{- if .Values.nodeSelector }}
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- if .Values.affinity }}
-      affinity:
-{{ toYaml .Values.affinity | trim | indent 8 }}
-{{- end }}
-      serviceAccountName: ztunnel
-      tolerations:
-        - effect: NoSchedule
-          operator: Exists
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      containers:
-      - name: istio-proxy
-{{- if contains "/" .Values.image }}
-        image: "{{ .Values.image }}"
-{{- else }}
-        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
-{{- end }}
-        ports:
-        - containerPort: 15020
-          name: ztunnel-stats
-          protocol: TCP
-        resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 10 }}
-{{- end }}
-{{- with .Values.imagePullPolicy }}
-        imagePullPolicy: {{ . }}
-{{- end }}
-        securityContext:
-          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
-          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
-          allowPrivilegeEscalation: true
-          privileged: false
-          capabilities:
-            drop:
-            - ALL
-            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
-            - NET_ADMIN # Required for TPROXY and setsockopt
-            - SYS_ADMIN # Required for `setns` - doing things in other netns
-            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
-          readOnlyRootFilesystem: true
-          runAsGroup: 1337
-          runAsNonRoot: false
-          runAsUser: 0
-{{- if .Values.seLinuxOptions }}
-          seLinuxOptions:
-{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
-{{- end }}
-        readinessProbe:
-          httpGet:
-            port: 15021
-            path: /healthz/ready
-        args:
-        - proxy
-        - ztunnel
-        env:
-        - name: CA_ADDRESS
-        {{- if .Values.caAddress }}
-          value: {{ .Values.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: XDS_ADDRESS
-        {{- if .Values.xdsAddress }}
-          value: {{ .Values.xdsAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        {{- if .Values.logAsJson }}
-        - name: LOG_FORMAT
-          value: json
-        {{- end}}
-        - name: RUST_LOG
-          value: {{ .Values.logLevel | quote }}
-        - name: RUST_BACKTRACE
-          value: "1"
-        - name: ISTIO_META_CLUSTER_ID
-          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
-        - name: INPOD_ENABLED
-          value: "true"
-        - name: TERMINATION_GRACE_PERIOD_SECONDS
-          value: "{{ .Values.terminationGracePeriodSeconds }}"
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
-        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        {{- with .Values.env }}
-        {{- range $key, $val := . }}
-        - name: {{ $key }}
-          value: "{{ $val }}"
-        {{- end }}
-        {{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /var/run/ztunnel
-          name: cni-ztunnel-sock-dir
-        - mountPath: /tmp
-          name: tmp
-        {{- with .Values.volumeMounts }}
-          {{- toYaml . | nindent 8 }}
-        {{- end }}
-      priorityClassName: system-node-critical
-      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
-      volumes:
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: istio-ca
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      - name: cni-ztunnel-sock-dir
-        hostPath:
-          path: /var/run/ztunnel
-          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
-      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
-      - name: tmp
-        emptyDir: {}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
diff --git a/resources/v1.24.6/charts/ztunnel/templates/rbac.yaml b/resources/v1.24.6/charts/ztunnel/templates/rbac.yaml
deleted file mode 100644
index 65bbea52b..000000000
--- a/resources/v1.24.6/charts/ztunnel/templates/rbac.yaml
+++ /dev/null
@@ -1,72 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-  {{- with .Values.imagePullSecrets }}
-imagePullSecrets:
-  {{- range . }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
----
-{{- if (eq (.Values.platform | default "") "openshift") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: ztunnel
-  labels:
-    app: ztunnel
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-rules:
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: ztunnel
-  labels:
-    app: ztunnel
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ztunnel
-subjects:
-- kind: ServiceAccount
-  name: ztunnel
-  namespace: {{ .Release.Namespace }}
-{{- end }}
----
diff --git a/resources/v1.24.6/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.24.6/charts/ztunnel/templates/zzz_profile.yaml
deleted file mode 100644
index 72d3adc53..000000000
--- a/resources/v1.24.6/charts/ztunnel/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with .Values.profile }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" $.Values.profile) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- if ($.Values.global).platform }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" ($.Values.global).platform) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" ($.Values.global).platform) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.24.6/charts/ztunnel/values.yaml b/resources/v1.24.6/charts/ztunnel/values.yaml
deleted file mode 100644
index 5d199949c..000000000
--- a/resources/v1.24.6/charts/ztunnel/values.yaml
+++ /dev/null
@@ -1,98 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
-  hub: gcr.io/istio-release
-  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
-  tag: 1.24.6
-  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
-  variant: ""
-
-  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
-  # If Image contains a "/", it will replace the entire `image` in the pod.
-  image: ztunnel
-
-  # Labels to apply to all top level resources
-  labels: {}
-  # Annotations to apply to all top level resources
-  annotations: {}
-
-  # Additional volumeMounts to the ztunnel container
-  volumeMounts: []
-
-  # Additional volumes to the ztunnel pod
-  volumes: []
-
-  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-
-  # Additional labels to apply on the pod level
-  podLabels: {}
-
-  # Pod resource configuration
-  resources:
-    requests:
-      cpu: 200m
-      # Ztunnel memory scales with the size of the cluster and traffic load
-      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
-      memory: 512Mi
-
-  # List of secret names to add to the service account as image pull secrets
-  imagePullSecrets: []
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
-
-  # Override for the pod imagePullPolicy
-  imagePullPolicy: ""
-
-  # Settings for multicluster
-  multiCluster:
-    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
-    # with Istiod configuration.
-    clusterName: ""
-
-  # meshConfig defines runtime configuration of components.
-  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
-  # components.
-  # TODO: https://github.com/istio/istio/issues/43248
-  meshConfig:
-    defaultConfig:
-      proxyMetadata: {}
-
-  # This value defines:
-  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
-  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
-  # Default K8S value is 30 seconds
-  terminationGracePeriodSeconds: 30
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
-  revision: ""
-
-  # The customized CA address to retrieve certificates for the pods in the cluster.
-  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-  caAddress: ""
-
-  # The customized XDS address to retrieve configuration.
-  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
-  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
-  xdsAddress: ""
-
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
-  istioNamespace: istio-system
-
-  # Configuration log level of ztunnel binary, default is info.
-  # Valid values are: trace, debug, info, warn, error
-  logLevel: info
-
-  # To output all logs in json format
-  logAsJson: false
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seLinuxOptions: {}
-  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
-  #seLinuxOptions:
-  #  type: spc_t
diff --git a/resources/v1.24.6/cni-1.24.6.tgz.etag b/resources/v1.24.6/cni-1.24.6.tgz.etag
deleted file mode 100644
index b879b2175..000000000
--- a/resources/v1.24.6/cni-1.24.6.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-9345341340b7c8892394e053e83efa64
diff --git a/resources/v1.24.6/commit b/resources/v1.24.6/commit
deleted file mode 100644
index 7a429d68a..000000000
--- a/resources/v1.24.6/commit
+++ /dev/null
@@ -1 +0,0 @@
-1.24.6
diff --git a/resources/v1.24.6/gateway-1.24.6.tgz.etag b/resources/v1.24.6/gateway-1.24.6.tgz.etag
deleted file mode 100644
index 095d5e349..000000000
--- a/resources/v1.24.6/gateway-1.24.6.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-565bf97a63a2c034018eaa3b6261020b
diff --git a/resources/v1.24.6/istiod-1.24.6.tgz.etag b/resources/v1.24.6/istiod-1.24.6.tgz.etag
deleted file mode 100644
index 75f3bb0d9..000000000
--- a/resources/v1.24.6/istiod-1.24.6.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-94d9c5ef03d7409069591f340c082547
diff --git a/resources/v1.24.6/profiles/default.yaml b/resources/v1.24.6/profiles/default.yaml
deleted file mode 100644
index e9e0a3931..000000000
--- a/resources/v1.24.6/profiles/default.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  # Most default values come from the helm chart's values.yaml
-  # Below are the things that differ
-  values:
-    defaultRevision: ""
-    global:
-      istioNamespace: istio-system
-      configValidation: true
diff --git a/resources/v1.24.6/ztunnel-1.24.6.tgz.etag b/resources/v1.24.6/ztunnel-1.24.6.tgz.etag
deleted file mode 100644
index 4d7cf9f02..000000000
--- a/resources/v1.24.6/ztunnel-1.24.6.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-d0d67ff4c69679cd3fc378592e5ae858
diff --git a/resources/v1.25.1/base-1.25.1.tgz.etag b/resources/v1.25.1/base-1.25.1.tgz.etag
deleted file mode 100644
index 9b641ce0a..000000000
--- a/resources/v1.25.1/base-1.25.1.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-145d53338899e4398f79465806d7065d
diff --git a/resources/v1.25.1/charts/base/Chart.yaml b/resources/v1.25.1/charts/base/Chart.yaml
deleted file mode 100644
index c8d7efcda..000000000
--- a/resources/v1.25.1/charts/base/Chart.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.1
-description: Helm chart for deploying Istio cluster resources and CRDs
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-name: base
-sources:
-- https://github.com/istio/istio
-version: 1.25.1
diff --git a/resources/v1.25.1/charts/base/README.md b/resources/v1.25.1/charts/base/README.md
deleted file mode 100644
index ae8f6d5b0..000000000
--- a/resources/v1.25.1/charts/base/README.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Istio base Helm Chart
-
-This chart installs resources shared by all Istio revisions. This includes Istio CRDs.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-base`:
-
-```console
-kubectl create namespace istio-system
-helm install istio-base istio/base -n istio-system
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.25.1/charts/base/files/profile-ambient.yaml b/resources/v1.25.1/charts/base/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.1/charts/base/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.1/charts/base/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.1/charts/base/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.1/charts/base/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/base/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.1/charts/base/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.1/charts/base/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/base/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.1/charts/base/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.1/charts/base/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/base/files/profile-platform-gke.yaml b/resources/v1.25.1/charts/base/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.1/charts/base/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.1/charts/base/files/profile-platform-k3d.yaml b/resources/v1.25.1/charts/base/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.1/charts/base/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.1/charts/base/files/profile-platform-microk8s.yaml b/resources/v1.25.1/charts/base/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.1/charts/base/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.1/charts/base/files/profile-platform-minikube.yaml b/resources/v1.25.1/charts/base/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.1/charts/base/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.1/charts/base/files/profile-platform-openshift.yaml b/resources/v1.25.1/charts/base/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.1/charts/base/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.1/charts/base/files/profile-preview.yaml b/resources/v1.25.1/charts/base/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.1/charts/base/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.1/charts/base/files/profile-remote.yaml b/resources/v1.25.1/charts/base/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.1/charts/base/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.1/charts/base/files/profile-stable.yaml b/resources/v1.25.1/charts/base/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.1/charts/base/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.1/charts/base/templates/NOTES.txt b/resources/v1.25.1/charts/base/templates/NOTES.txt
deleted file mode 100644
index f12616f57..000000000
--- a/resources/v1.25.1/charts/base/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-Istio base successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.25.1/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml b/resources/v1.25.1/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
deleted file mode 100644
index 2616b09c9..000000000
--- a/resources/v1.25.1/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,53 +0,0 @@
-{{- if and .Values.experimental.stableValidationPolicy (not (eq .Values.defaultRevision "")) }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-default-policy.istio.io"
-  labels:
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision }}
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-default-policy-binding.istio.io"
-spec:
-  policyName: "stable-channel-default-policy.istio.io"
-  validationActions: [Deny]
-{{- end }}
diff --git a/resources/v1.25.1/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml b/resources/v1.25.1/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
deleted file mode 100644
index 8cb76fd77..000000000
--- a/resources/v1.25.1/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-{{- if not (eq .Values.defaultRevision "") }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istiod-default-validator
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  - name: validation.istio.io
-    clientConfig:
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        {{- if (eq .Values.defaultRevision "default") }}
-        name: istiod
-        {{- else }}
-        name: istiod-{{ .Values.defaultRevision }}
-        {{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-{{- end }}
diff --git a/resources/v1.25.1/charts/base/templates/reader-serviceaccount.yaml b/resources/v1.25.1/charts/base/templates/reader-serviceaccount.yaml
deleted file mode 100644
index ba829a6bf..000000000
--- a/resources/v1.25.1/charts/base/templates/reader-serviceaccount.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-# This singleton service account aggregates reader permissions for the revisions in a given cluster
-# ATM this is a singleton per cluster with Istio installed, and is not revisioned. It maybe should be,
-# as otherwise compromising the token for this SA would give you access to *every* installed revision.
-# Should be used for remote secret creation.
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-    {{- end }}
-    {{- end }}
-metadata:
-  name: istio-reader-service-account
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.25.1/charts/base/templates/zzz_profile.yaml b/resources/v1.25.1/charts/base/templates/zzz_profile.yaml
deleted file mode 100644
index 9c2119b9a..000000000
--- a/resources/v1.25.1/charts/base/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.1/charts/cni/Chart.yaml b/resources/v1.25.1/charts/cni/Chart.yaml
deleted file mode 100644
index 00a713096..000000000
--- a/resources/v1.25.1/charts/cni/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.1
-description: Helm chart for istio-cni components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-cni
-- istio
-name: cni
-sources:
-- https://github.com/istio/istio
-version: 1.25.1
diff --git a/resources/v1.25.1/charts/cni/README.md b/resources/v1.25.1/charts/cni/README.md
deleted file mode 100644
index a8b78d5bd..000000000
--- a/resources/v1.25.1/charts/cni/README.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# Istio CNI Helm Chart
-
-This chart installs the Istio CNI Plugin. See the [CNI installation guide](https://istio.io/latest/docs/setup/additional-setup/cni/)
-for more information.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-cni`:
-
-```console
-helm install istio-cni istio/cni -n kube-system
-```
-
-Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
-`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
-'system-node-critical' outside of kube-system.
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istio-cni
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Ambient
-
-To enable ambient, you can use the ambient profile: `--set profile=ambient`.
-
-#### Calico
-
-For Calico, you must also modify the settings to allow source spoofing:
-
-- if deployed by operator,  `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`
-- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )
-
-### GKE notes
-
-On GKE, 'kube-system' is required.
-
-If using `helm template`, `--set cni.cniBinDir=/home/kubernetes/bin` is required - with `helm install`
-it is auto-detected.
diff --git a/resources/v1.25.1/charts/cni/files/profile-ambient.yaml b/resources/v1.25.1/charts/cni/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.1/charts/cni/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.1/charts/cni/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.1/charts/cni/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.1/charts/cni/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/cni/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.1/charts/cni/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.1/charts/cni/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/cni/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.1/charts/cni/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.1/charts/cni/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/cni/files/profile-platform-gke.yaml b/resources/v1.25.1/charts/cni/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.1/charts/cni/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.1/charts/cni/files/profile-platform-k3d.yaml b/resources/v1.25.1/charts/cni/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.1/charts/cni/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.1/charts/cni/files/profile-platform-microk8s.yaml b/resources/v1.25.1/charts/cni/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.1/charts/cni/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.1/charts/cni/files/profile-platform-minikube.yaml b/resources/v1.25.1/charts/cni/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.1/charts/cni/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.1/charts/cni/files/profile-platform-openshift.yaml b/resources/v1.25.1/charts/cni/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.1/charts/cni/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.1/charts/cni/files/profile-preview.yaml b/resources/v1.25.1/charts/cni/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.1/charts/cni/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.1/charts/cni/files/profile-remote.yaml b/resources/v1.25.1/charts/cni/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.1/charts/cni/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.1/charts/cni/files/profile-stable.yaml b/resources/v1.25.1/charts/cni/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.1/charts/cni/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.1/charts/cni/templates/NOTES.txt b/resources/v1.25.1/charts/cni/templates/NOTES.txt
deleted file mode 100644
index fb35525b9..000000000
--- a/resources/v1.25.1/charts/cni/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-"{{ .Release.Name }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.25.1/charts/cni/templates/_helpers.tpl b/resources/v1.25.1/charts/cni/templates/_helpers.tpl
deleted file mode 100644
index 73cc17b2f..000000000
--- a/resources/v1.25.1/charts/cni/templates/_helpers.tpl
+++ /dev/null
@@ -1,8 +0,0 @@
-{{- define "name" -}}
-    istio-cni
-{{- end }}
-
-
-{{- define "istio-tag" -}}
-    {{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}
-{{- end }}
diff --git a/resources/v1.25.1/charts/cni/templates/clusterrolebinding.yaml b/resources/v1.25.1/charts/cni/templates/clusterrolebinding.yaml
deleted file mode 100644
index 42fedab1f..000000000
--- a/resources/v1.25.1/charts/cni/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-repair-rolebinding
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-repair-role
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "name" . }}
-    namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-ambient
-{{- end }}
diff --git a/resources/v1.25.1/charts/cni/templates/configmap-cni.yaml b/resources/v1.25.1/charts/cni/templates/configmap-cni.yaml
deleted file mode 100644
index 5758af548..000000000
--- a/resources/v1.25.1/charts/cni/templates/configmap-cni.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: {{ template "name" . }}-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  CURRENT_AGENT_VERSION: {{ .Values.tag | default .Values.global.tag | quote }}
-  AMBIENT_ENABLED: {{ .Values.ambient.enabled | quote }}
-  AMBIENT_DNS_CAPTURE: {{ .Values.ambient.dnsCapture | quote  }}
-  AMBIENT_IPV6: {{ .Values.ambient.ipv6 | quote }}
-  AMBIENT_RECONCILE_POD_RULES_ON_STARTUP: {{ .Values.ambient.reconcileIptablesOnStartup | quote }}
-  {{- if .Values.cniConfFileName }} # K8S < 1.24 doesn't like empty values
-  CNI_CONF_NAME: {{ .Values.cniConfFileName }} # Name of the CNI config file to create. Only override if you know the exact path your CNI requires..
-  {{- end }}
-  CHAINED_CNI_PLUGIN: {{ .Values.chained | quote }}
-  EXCLUDED_NAMESPACES: "{{ range $idx, $ns := .Values.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
-  REPAIR_ENABLED: {{ .Values.chained | quote }}
-  REPAIR_LABEL_PODS: {{ .Values.repair.labelPods | quote }}
-  REPAIR_DELETE_PODS: {{ .Values.repair.deletePods | quote }}
-  REPAIR_REPAIR_PODS: {{ .Values.repair.repairPods | quote }}
-  REPAIR_INIT_CONTAINER_NAME: {{ .Values.repair.initContainerName | quote }}
-  REPAIR_BROKEN_POD_LABEL_KEY: {{ .Values.repair.brokenPodLabelKey | quote }}
-  REPAIR_BROKEN_POD_LABEL_VALUE: {{ .Values.repair.brokenPodLabelValue | quote }}
-  {{- with .Values.env }}
-  {{- range $key, $val := . }}
-  {{ $key }}: "{{ $val }}"
-  {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.1/charts/cni/templates/daemonset.yaml b/resources/v1.25.1/charts/cni/templates/daemonset.yaml
deleted file mode 100644
index f2e189b7c..000000000
--- a/resources/v1.25.1/charts/cni/templates/daemonset.yaml
+++ /dev/null
@@ -1,237 +0,0 @@
-# This manifest installs the Istio install-cni container, as well
-# as the Istio CNI plugin and config on
-# each master and worker node in a Kubernetes cluster.
-#
-# $detectedBinDir exists to support a GKE-specific platform override,
-# and is deprecated in favor of using the explicit `gke` platform profile.
-{{- $detectedBinDir := (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
-    "/home/kubernetes/bin"
-    "/opt/cni/bin"
-}}
-{{- if .Values.cniBinDir }}
-{{ $detectedBinDir = .Values.cniBinDir }}
-{{- end }}
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  name: {{ template "name" . }}-node
-  namespace: {{ .Release.Namespace }}
-  labels:
-    k8s-app: {{ template "name" . }}-node
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  selector:
-    matchLabels:
-      k8s-app: {{ template "name" . }}-node
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  template:
-    metadata:
-      labels:
-        k8s-app: {{ template "name" . }}-node
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: {{ template "name" . }}
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-        # Add Prometheus Scrape annotations
-        prometheus.io/scrape: 'true'
-        prometheus.io/port: "15014"
-        prometheus.io/path: '/metrics'
-        # Add AppArmor annotation
-        # This is required to avoid conflicts with AppArmor profiles which block certain
-        # privileged pod capabilities.
-        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
-        # securityContext which is otherwise preferred.
-        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
-        # Custom annotations
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{if .Values.ambient.enabled }}
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-{{ end }}
-      nodeSelector:
-        kubernetes.io/os: linux
-      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      tolerations:
-        # Make sure istio-cni-node gets scheduled on all nodes.
-        - effect: NoSchedule
-          operator: Exists
-        # Mark the pod as a critical add-on for rescheduling.
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      priorityClassName: system-node-critical
-      serviceAccountName: {{ template "name" . }}
-      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
-      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
-      terminationGracePeriodSeconds: 5
-      containers:
-        # This container installs the Istio CNI binaries
-        # and CNI network config file on each node.
-        - name: install-cni
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
-{{- end }}
-{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
-{{- end }}
-          ports:
-          - containerPort: 15014
-            name: metrics
-            protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8000
-          securityContext:
-            privileged: false
-            runAsGroup: 0
-            runAsUser: 0
-            runAsNonRoot: false
-            # Both ambient and sidecar repair mode require elevated node privileges to function.
-            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
-            # add capabilities based on feature.
-            capabilities:
-              drop:
-              - ALL
-              add:
-              # CAP_NET_ADMIN is required to allow ipset and route table access
-              - NET_ADMIN
-              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
-              - NET_RAW
-              # CAP_SYS_PTRACE is required for repair and ambient mode to describe
-              # the pod's network namespace.
-              - SYS_PTRACE
-              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
-              # network namespaces in `/proc` to obtain descriptors for entering pod network
-              # namespaces. There does not appear to be a more granular capability for this.
-              - SYS_ADMIN
-              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
-              # the typical ability to read/write to folders owned by others.
-              # This can cause problems if the hostPath mounts we use, which we require write access into,
-              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
-              - DAC_OVERRIDE
-{{- if .Values.seLinuxOptions }}
-{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
-            seLinuxOptions:
-{{ toYaml . | trim | indent 14 }}
-{{- end }}
-{{- end }}
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          command: ["install-cni"]
-          args:
-            {{- if or .Values.logging.level .Values.global.logging.level }}
-            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
-            {{- end}}
-            {{- if .Values.global.logAsJson }}
-            - --log_as_json
-            {{- end}}
-          envFrom:
-            - configMapRef:
-                name: {{ template "name" . }}-config
-          env:
-            - name: REPAIR_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: REPAIR_RUN_AS_DAEMON
-              value: "true"
-            - name: REPAIR_SIDECAR_ANNOTATION
-              value: "sidecar.istio.io/status"
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  apiVersion: v1
-                  fieldPath: spec.nodeName
-            - name: GOMEMLIMIT
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.memory
-            - name: GOMAXPROCS
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.cpu
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          volumeMounts:
-            - mountPath: /host/opt/cni/bin
-              name: cni-bin-dir
-            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-            - mountPath: /host/proc
-              name: cni-host-procfs
-              readOnly: true
-            {{- end }}
-            - mountPath: /host/etc/cni/net.d
-              name: cni-net-dir
-            - mountPath: /var/run/istio-cni
-              name: cni-socket-dir
-            {{- if .Values.ambient.enabled }}
-            - mountPath: /host/var/run/netns
-              mountPropagation: HostToContainer
-              name: cni-netns-dir
-            - mountPath: /var/run/ztunnel
-              name: cni-ztunnel-sock-dir
-            {{ end }}
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-      volumes:
-        # Used to install CNI.
-        - name: cni-bin-dir
-          hostPath:
-            path: {{ $detectedBinDir }}
-        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-        - name: cni-host-procfs
-          hostPath:
-            path: /proc
-            type: Directory
-        {{- end }}
-        {{- if .Values.ambient.enabled }}
-        - name: cni-ztunnel-sock-dir
-          hostPath:
-            path: /var/run/ztunnel
-            type: DirectoryOrCreate
-        {{- end }}
-        - name: cni-net-dir
-          hostPath:
-            path: {{ .Values.cniConfDir }}
-        # Used for UDS sockets for logging, ambient eventing
-        - name: cni-socket-dir
-          hostPath:
-            path: /var/run/istio-cni
-        - name: cni-netns-dir
-          hostPath:
-            path: {{ .Values.cniNetnsDir }}
-            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
-            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
-            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.25.1/charts/cni/templates/network-attachment-definition.yaml b/resources/v1.25.1/charts/cni/templates/network-attachment-definition.yaml
deleted file mode 100644
index 86a2eb7c0..000000000
--- a/resources/v1.25.1/charts/cni/templates/network-attachment-definition.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-{{- if eq .Values.provider "multus" }}
-apiVersion: k8s.cni.cncf.io/v1
-kind: NetworkAttachmentDefinition
-metadata:
-  name: {{ template "name" . }}
-  namespace: default
-  labels:
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/cni/templates/resourcequota.yaml b/resources/v1.25.1/charts/cni/templates/resourcequota.yaml
deleted file mode 100644
index 9a6d61ff9..000000000
--- a/resources/v1.25.1/charts/cni/templates/resourcequota.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-{{- if .Values.resourceQuotas.enabled }}
-apiVersion: v1
-kind: ResourceQuota
-metadata:
-  name: {{ template "name" . }}-resource-quota
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  hard:
-    pods: {{ .Values.resourceQuotas.pods | quote }}
-  scopeSelector:
-    matchExpressions:
-    - operator: In
-      scopeName: PriorityClass
-      values:
-      - system-node-critical
-{{- end }}
diff --git a/resources/v1.25.1/charts/cni/templates/serviceaccount.yaml b/resources/v1.25.1/charts/cni/templates/serviceaccount.yaml
deleted file mode 100644
index 3193d7b74..000000000
--- a/resources/v1.25.1/charts/cni/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-{{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-{{- end }}
-{{- end }}
-metadata:
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.25.1/charts/cni/templates/zzy_descope_legacy.yaml b/resources/v1.25.1/charts/cni/templates/zzy_descope_legacy.yaml
deleted file mode 100644
index a9584ac29..000000000
--- a/resources/v1.25.1/charts/cni/templates/zzy_descope_legacy.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-{{/* Copy anything under `.cni` to `.`, to avoid the need to specify a redundant prefix.
-Due to the file naming, this always happens after zzz_profile.yaml */}}
-{{- $_ := mustMergeOverwrite $.Values (index $.Values "cni") }}
\ No newline at end of file
diff --git a/resources/v1.25.1/charts/cni/templates/zzz_profile.yaml b/resources/v1.25.1/charts/cni/templates/zzz_profile.yaml
deleted file mode 100644
index 9c2119b9a..000000000
--- a/resources/v1.25.1/charts/cni/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.1/charts/cni/values.yaml b/resources/v1.25.1/charts/cni/values.yaml
deleted file mode 100644
index 5338886c7..000000000
--- a/resources/v1.25.1/charts/cni/values.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  hub: ""
-  tag: ""
-  variant: ""
-  image: install-cni
-  pullPolicy: ""
-
-  # Same as `global.logging.level`, but will override it if set
-  logging:
-    level: ""
-
-  # Configuration file to insert istio-cni plugin configuration
-  # by default this will be the first file found in the cni-conf-dir
-  # Example
-  # cniConfFileName: 10-calico.conflist
-
-  # CNI-and-platform specific path defaults.
-  # These may need to be set to platform-specific values, consult
-  # overrides for your platform in `manifests/helm-profiles/platform-*.yaml`
-  cniBinDir: /opt/cni/bin
-  cniConfDir: /etc/cni/net.d
-  cniConfFileName: ""
-  cniNetnsDir: "/var/run/netns"
-
-  excludeNamespaces:
-    - kube-system
-
-  # Allows user to set custom affinity for the DaemonSet
-  affinity: {}
-
-  # Custom annotations on pod level, if you need them
-  podAnnotations: {}
-
-  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
-  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
-  chained: true
-
-  # Custom configuration happens based on the CNI provider.
-  # Possible values: "default", "multus"
-  provider: "default"
-
-  # Configure ambient settings
-  ambient:
-    # If enabled, ambient redirection will be enabled
-    enabled: false
-    # Set ambient config dir path: defaults to /etc/ambient-config
-    configDir: ""
-    # If enabled, and ambient is enabled, DNS redirection will be enabled
-    dnsCapture: true
-    # If enabled, and ambient is enabled, enables ipv6 support
-    ipv6: true
-    # If enabled, and ambient is enabled, the CNI agent will reconcile incompatible iptables rules and chains at startup.
-    # This will eventually be enabled by default
-    reconcileIptablesOnStartup: false
-
-
-  repair:
-    enabled: true
-    hub: ""
-    tag: ""
-
-    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
-    # This defines the action the controller will take when a pod is detected as broken.
-
-    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
-    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
-    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
-    labelPods: false
-    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
-    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
-    deletePods: false
-    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
-    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
-    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
-    repairPods: true
-
-    initContainerName: "istio-validation"
-
-    brokenPodLabelKey: "cni.istio.io/uninitialized"
-    brokenPodLabelValue: "true"
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
-  seLinuxOptions: {}
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 100Mi
-
-  resourceQuotas:
-    enabled: false
-    pods: 5000
-
-  # The number of pods that can be unavailable during rolling update (see
-  # `updateStrategy.rollingUpdate.maxUnavailable` here:
-  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
-  # May be specified as a number of pods or as a percent of the total number
-  # of pods at the start of the update.
-  rollingMaxUnavailable: 1
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  global:
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-
-    # Default tag for Istio images.
-    tag: 1.25.1
-
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # change cni scope level to control logging out of istio-cni-node DaemonSet
-    logging:
-      level: info
-
-    logAsJson: false
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Default resources allocated
-    defaultResources:
-      requests:
-        cpu: 100m
-        memory: 100Mi
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
diff --git a/resources/v1.25.1/charts/gateway/Chart.yaml b/resources/v1.25.1/charts/gateway/Chart.yaml
deleted file mode 100644
index 51971e189..000000000
--- a/resources/v1.25.1/charts/gateway/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.1
-description: Helm chart for deploying Istio gateways
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- gateways
-name: gateway
-sources:
-- https://github.com/istio/istio
-type: application
-version: 1.25.1
diff --git a/resources/v1.25.1/charts/gateway/README.md b/resources/v1.25.1/charts/gateway/README.md
deleted file mode 100644
index 5c064d165..000000000
--- a/resources/v1.25.1/charts/gateway/README.md
+++ /dev/null
@@ -1,170 +0,0 @@
-# Istio Gateway Helm Chart
-
-This chart installs an Istio gateway deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-ingressgateway`:
-
-```console
-helm install istio-ingressgateway istio/gateway
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istio-ingressgateway` deployment:
-
-```console
-helm delete istio-ingressgateway
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/gateway
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### OpenShift
-
-When deploying the gateway in an OpenShift cluster, use the `openshift` profile to override the default values, for example:
-
-```console
-helm install istio-ingressgateway istio/gateway --set profile=openshift
-```
-
-### `image: auto` Information
-
-The image used by the chart, `auto`, may be unintuitive.
-This exists because the pod spec will be automatically populated at runtime, using the same mechanism as [Sidecar Injection](istio.io/latest/docs/setup/additional-setup/sidecar-injection).
-This allows the same configurations and lifecycle to apply to gateways as sidecars.
-
-Note: this does mean that the namespace the gateway is deployed in must not have the `istio-injection=disabled` label.
-See [Controlling the injection policy](https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy) for more info.
-
-### Examples
-
-#### Egress Gateway
-
-Deploying a Gateway to be used as an [Egress Gateway](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/):
-
-```yaml
-service:
-  # Egress gateways do not need an external LoadBalancer IP
-  type: ClusterIP
-```
-
-#### Multi-network/VM Gateway
-
-Deploying a Gateway to be used as a [Multi-network Gateway](https://istio.io/latest/docs/setup/install/multicluster/) for network `network-1`:
-
-```yaml
-networkGateway: network-1
-```
-
-### Migrating from other installation methods
-
-Installations from other installation methods (such as istioctl, Istio Operator, other helm charts, etc) can be migrated to use the new Helm charts
-following the guidance below.
-If you are able to, a clean installation is simpler. However, this often requires an external IP migration which can be challenging.
-
-WARNING: when installing over an existing deployment, the two deployments will be merged together by Helm, which may lead to unexpected results.
-
-#### Legacy Gateway Helm charts
-
-Istio historically offered two different charts - `manifests/charts/gateways/istio-ingress` and `manifests/charts/gateways/istio-egress`.
-These are replaced by this chart.
-While not required, it is recommended all new users use this chart, and existing users migrate when possible.
-
-This chart has the following benefits and differences:
-* Designed with Helm best practices in mind (standardized values options, values schema, values are not all nested under `gateways.istio-ingressgateway.*`, release name and namespace taken into account, etc).
-* Utilizes Gateway injection, simplifying upgrades, allowing gateways to run in any namespace, and avoiding repeating config for sidecars and gateways.
-* Published to official Istio Helm repository.
-* Single chart for all gateways (Ingress, Egress, East West).
-
-#### General concerns
-
-For a smooth migration, the resource names and `Deployment.spec.selector` labels must match.
-
-If you install with `helm install istio-gateway istio/gateway`, resources will be named `istio-gateway` and the `selector` labels set to:
-
-```yaml
-app: istio-gateway
-istio: gateway # the release name with leading istio- prefix stripped
-```
-
-If your existing installation doesn't follow these names, you can override them. For example, if you have resources named `my-custom-gateway` with `selector` labels
-`foo=bar,istio=ingressgateway`:
-
-```yaml
-name: my-custom-gateway # Override the name to match existing resources
-labels:
-  app: "" # Unset default app selector label
-  istio: ingressgateway # override default istio selector label
-  foo: bar # Add the existing custom selector label
-```
-
-#### Migrating an existing Helm release
-
-An existing helm release can be `helm upgrade`d to this chart by using the same release name. For example, if a previous
-installation was done like:
-
-```console
-helm install istio-ingress manifests/charts/gateways/istio-ingress -n istio-system
-```
-
-It could be upgraded with
-
-```console
-helm upgrade istio-ingress manifests/charts/gateway -n istio-system --set name=istio-ingressgateway --set labels.app=istio-ingressgateway --set labels.istio=ingressgateway
-```
-
-Note the name and labels are overridden to match the names of the existing installation.
-
-Warning: the helm charts here default to using port 80 and 443, while the old charts used 8080 and 8443.
-If you have AuthorizationPolicies that reference port these ports, you should update them during this process,
-or customize the ports to match the old defaults.
-See the [security advisory](https://istio.io/latest/news/security/istio-security-2021-002/) for more information.
-
-#### Other migrations
-
-If you see errors like `rendered manifests contain a resource that already exists` during installation, you may need to forcibly take ownership.
-
-The script below can handle this for you. Replace `RELEASE` and `NAMESPACE` with the name and namespace of the release:
-
-```console
-KINDS=(service deployment)
-RELEASE=istio-ingressgateway
-NAMESPACE=istio-system
-for KIND in "${KINDS[@]}"; do
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-name=$RELEASE
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-namespace=$NAMESPACE
-    kubectl --namespace $NAMESPACE --overwrite=true label $KIND $RELEASE app.kubernetes.io/managed-by=Helm
-done
-```
-
-You may ignore errors about resources not being found.
diff --git a/resources/v1.25.1/charts/gateway/files/profile-ambient.yaml b/resources/v1.25.1/charts/gateway/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.1/charts/gateway/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.1/charts/gateway/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.1/charts/gateway/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.1/charts/gateway/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/gateway/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.1/charts/gateway/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.1/charts/gateway/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/gateway/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.1/charts/gateway/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.1/charts/gateway/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/gateway/files/profile-platform-gke.yaml b/resources/v1.25.1/charts/gateway/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.1/charts/gateway/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.1/charts/gateway/files/profile-platform-k3d.yaml b/resources/v1.25.1/charts/gateway/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.1/charts/gateway/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.1/charts/gateway/files/profile-platform-microk8s.yaml b/resources/v1.25.1/charts/gateway/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.1/charts/gateway/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.1/charts/gateway/files/profile-platform-minikube.yaml b/resources/v1.25.1/charts/gateway/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.1/charts/gateway/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.1/charts/gateway/files/profile-platform-openshift.yaml b/resources/v1.25.1/charts/gateway/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.1/charts/gateway/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.1/charts/gateway/files/profile-preview.yaml b/resources/v1.25.1/charts/gateway/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.1/charts/gateway/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.1/charts/gateway/files/profile-remote.yaml b/resources/v1.25.1/charts/gateway/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.1/charts/gateway/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.1/charts/gateway/files/profile-stable.yaml b/resources/v1.25.1/charts/gateway/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.1/charts/gateway/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.1/charts/gateway/templates/NOTES.txt b/resources/v1.25.1/charts/gateway/templates/NOTES.txt
deleted file mode 100644
index fd0142911..000000000
--- a/resources/v1.25.1/charts/gateway/templates/NOTES.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-"{{ include "gateway.name" . }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
-
-Next steps:
-  * Deploy an HTTP Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/
-  * Deploy an HTTPS Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/
diff --git a/resources/v1.25.1/charts/gateway/templates/_helpers.tpl b/resources/v1.25.1/charts/gateway/templates/_helpers.tpl
deleted file mode 100644
index e5a0a9b3c..000000000
--- a/resources/v1.25.1/charts/gateway/templates/_helpers.tpl
+++ /dev/null
@@ -1,40 +0,0 @@
-{{- define "gateway.name" -}}
-{{- if eq .Release.Name "RELEASE-NAME" -}}
-  {{- .Values.name | default "istio-ingressgateway" -}}
-{{- else -}}
-  {{- .Values.name | default .Release.Name | default "istio-ingressgateway" -}}
-{{- end -}}
-{{- end }}
-
-{{- define "gateway.labels" -}}
-{{ include "gateway.selectorLabels" . }}
-{{- range $key, $val := .Values.labels }}
-{{- if and (ne $key "app") (ne $key "istio") }}
-{{ $key | quote }}: {{ $val | quote }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{- define "gateway.selectorLabels" -}}
-app: {{ (.Values.labels.app | quote) | default (include "gateway.name" .) }}
-istio: {{ (.Values.labels.istio | quote) | default (include "gateway.name" . | trimPrefix "istio-") }}
-{{- end }}
-
-{{/*
-Keep sidecar injection labels together
-https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy
-*/}}
-{{- define "gateway.sidecarInjectionLabels" -}}
-sidecar.istio.io/inject: "true"
-{{- with .Values.revision }}
-istio.io/rev: {{ . | quote }}
-{{- end }}
-{{- end }}
-
-{{- define "gateway.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create }}
-{{- .Values.serviceAccount.name | default (include "gateway.name" .)    }}
-{{- else }}
-{{- .Values.serviceAccount.name | default "default" }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/gateway/templates/deployment.yaml b/resources/v1.25.1/charts/gateway/templates/deployment.yaml
deleted file mode 100644
index 9db59d8b9..000000000
--- a/resources/v1.25.1/charts/gateway/templates/deployment.yaml
+++ /dev/null
@@ -1,128 +0,0 @@
-apiVersion: apps/v1
-kind: {{ .Values.kind | default "Deployment" }}
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  {{- with .Values.replicaCount }}
-  replicas: {{ . }}
-  {{- end }}
-  {{- end }}
-  {{- with .Values.strategy }}
-  strategy:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.minReadySeconds }}
-  minReadySeconds: {{ . }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "gateway.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
-        {{- include "gateway.selectorLabels" . | nindent 8 }}
-        app.kubernetes.io/name: {{ include "gateway.name" . }}
-        {{- include "istio.labels" .  | nindent 8}}
-        {{- range $key, $val := .Values.labels }}
-        {{- if and (ne $key "app") (ne $key "istio") }}
-        {{ $key | quote }}: {{ $val | quote }}
-        {{- end }}
-        {{- end }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
-      securityContext:
-      {{- if .Values.securityContext }}
-        {{- toYaml .Values.securityContext | nindent 8 }}
-      {{- else }}
-        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- end }}
-      {{- with .Values.volumes }}
-      volumes:
-        {{ toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: istio-proxy
-          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
-          image: auto
-          {{- with .Values.imagePullPolicy }}
-          imagePullPolicy: {{ . }}
-          {{- end }}
-          securityContext:
-          {{- if .Values.containerSecurityContext }}
-            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          {{- else }}
-            capabilities:
-              drop:
-              - ALL
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            {{- if not (eq (.Values.platform | default "") "openshift") }}
-            runAsUser: 1337
-            runAsGroup: 1337
-            {{- end }}
-            runAsNonRoot: true
-          {{- end }}
-          env:
-          {{- with .Values.networkGateway }}
-          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-            value: "{{.}}"
-          {{- end }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: {{ $val | quote }}
-          {{- end }}
-          ports:
-          - containerPort: 15090
-            protocol: TCP
-            name: http-envoy-prom
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          {{- with .Values.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.readinessProbe }}
-          readinessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
-      {{- with .Values.priorityClassName }}
-      priorityClassName: {{ . }}
-      {{- end }}
diff --git a/resources/v1.25.1/charts/gateway/templates/hpa.yaml b/resources/v1.25.1/charts/gateway/templates/hpa.yaml
deleted file mode 100644
index 64ecb6a4c..000000000
--- a/resources/v1.25.1/charts/gateway/templates/hpa.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-{{- if and (.Values.autoscaling.enabled) (eq .Values.kind "Deployment") }}
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: {{ .Values.kind | default "Deployment" }}
-    name: {{ include "gateway.name" . }}
-  minReplicas: {{ .Values.autoscaling.minReplicas }}
-  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
-  metrics:
-    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
-          type: Utilization
-    {{- end }}
-    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
-    - type: Resource
-      resource:
-        name: memory
-        target:
-          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
-          type: Utilization
-    {{- end }}
-  {{- if .Values.autoscaling.autoscaleBehavior }}
-  behavior: {{ toYaml .Values.autoscaling.autoscaleBehavior | nindent 4 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/gateway/templates/poddisruptionbudget.yaml b/resources/v1.25.1/charts/gateway/templates/poddisruptionbudget.yaml
deleted file mode 100644
index b0155cdf0..000000000
--- a/resources/v1.25.1/charts/gateway/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-{{- if .Values.podDisruptionBudget }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-spec:
-  selector:
-    matchLabels:
-  {{- include "gateway.selectorLabels" . | nindent 6 }}
-  {{- with .Values.podDisruptionBudget }}
-    {{- toYaml . | nindent 2 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/gateway/templates/role.yaml b/resources/v1.25.1/charts/gateway/templates/role.yaml
deleted file mode 100644
index 3d1607963..000000000
--- a/resources/v1.25.1/charts/gateway/templates/role.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-{{/*Set up roles for Istio Gateway. Not required for gateway-api*/}}
-{{- if .Values.rbac.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "watch", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "gateway.serviceAccountName" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ include "gateway.serviceAccountName" . }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/gateway/templates/service.yaml b/resources/v1.25.1/charts/gateway/templates/service.yaml
deleted file mode 100644
index 25ce3bcb0..000000000
--- a/resources/v1.25.1/charts/gateway/templates/service.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-{{- if not (eq .Values.service.type "None") }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-    {{- with .Values.networkGateway }}
-    topology.istio.io/network: "{{.}}"
-    {{- end }}
-  annotations:
-    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
-spec:
-{{- with .Values.service.loadBalancerIP }}
-  loadBalancerIP: "{{ . }}"
-{{- end }}
-{{- if eq .Values.service.type "LoadBalancer" }}
-  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
-  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
-  {{- end }}
-{{- end }}
-{{- if .Values.service.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.service.ipFamilies }}
-  ipFamilies:
-{{- range .Values.service.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
-{{- with .Values.service.loadBalancerSourceRanges }}
-  loadBalancerSourceRanges:
-{{ toYaml . | indent 4 }}
-{{- end }}
-{{- with .Values.service.externalTrafficPolicy }}
-  externalTrafficPolicy: "{{ . }}"
-{{- end }}
-  type: {{ .Values.service.type }}
-  ports:
-{{- if .Values.networkGateway }}
-  - name: status-port
-    port: 15021
-    targetPort: 15021
-  - name: tls
-    port: 15443
-    targetPort: 15443
-  - name: tls-istiod
-    port: 15012
-    targetPort: 15012
-  - name: tls-webhook
-    port: 15017
-    targetPort: 15017
-{{- else }}
-{{ .Values.service.ports | toYaml | indent 4 }}
-{{- end }}
-{{- if .Values.service.externalIPs }}
-  externalIPs: {{- range .Values.service.externalIPs }}
-    - {{.}}
-  {{- end }}
-{{- end }}
-  selector:
-    {{- include "gateway.selectorLabels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/gateway/templates/serviceaccount.yaml b/resources/v1.25.1/charts/gateway/templates/serviceaccount.yaml
deleted file mode 100644
index c88afeadd..000000000
--- a/resources/v1.25.1/charts/gateway/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-{{- if .Values.serviceAccount.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/gateway/templates/zzz_profile.yaml b/resources/v1.25.1/charts/gateway/templates/zzz_profile.yaml
deleted file mode 100644
index ded66c5fd..000000000
--- a/resources/v1.25.1/charts/gateway/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.1/charts/gateway/values.schema.json b/resources/v1.25.1/charts/gateway/values.schema.json
deleted file mode 100644
index 3fdaa2730..000000000
--- a/resources/v1.25.1/charts/gateway/values.schema.json
+++ /dev/null
@@ -1,330 +0,0 @@
-{
-  "$schema": "http://json-schema.org/schema#",
-  "$defs": {
-    "values": {
-      "type": "object",
-      "properties": {
-        "global": {
-          "type": "object"
-        },
-        "affinity": {
-          "type": "object"
-        },
-        "securityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "containerSecurityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "kind": {
-          "type": "string",
-          "enum": [
-            "Deployment",
-            "DaemonSet"
-          ]
-        },
-        "annotations": {
-          "additionalProperties": {
-            "type": [
-              "string",
-              "integer"
-            ]
-          },
-          "type": "object"
-        },
-        "autoscaling": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            },
-            "maxReplicas": {
-              "type": "integer"
-            },
-            "minReplicas": {
-              "type": "integer"
-            },
-            "targetCPUUtilizationPercentage": {
-              "type": "integer"
-            }
-          }
-        },
-        "env": {
-          "type": "object"
-        },
-        "strategy": {
-          "type": "object"
-        },
-        "minReadySeconds": {
-          "type": [
-            "null",
-            "integer"
-          ]
-        },
-        "readinessProbe": {
-          "type": [
-            "null",
-            "object"
-          ]
-        },
-        "labels": {
-          "type": "object"
-        },
-        "name": {
-          "type": "string"
-        },
-        "nodeSelector": {
-          "type": "object"
-        },
-        "podAnnotations": {
-          "type": "object",
-          "properties": {
-            "inject.istio.io/templates": {
-              "type": "string"
-            },
-            "prometheus.io/path": {
-              "type": "string"
-            },
-            "prometheus.io/port": {
-              "type": "string"
-            },
-            "prometheus.io/scrape": {
-              "type": "string"
-            }
-          }
-        },
-        "replicaCount": {
-          "type": [
-            "integer",
-            "null"
-          ]
-        },
-        "resources": {
-          "type": "object",
-          "properties": {
-            "limits": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            },
-            "requests": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            }
-          }
-        },
-        "revision": {
-          "type": "string"
-        },
-        "compatibilityVersion": {
-          "type": "string"
-        },
-        "runAsRoot": {
-          "type": "boolean"
-        },
-        "unprivilegedPort": {
-          "type": [
-            "string",
-            "boolean"
-          ],
-          "enum": [
-            true,
-            false,
-            "auto"
-          ]
-        },
-        "service": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "externalTrafficPolicy": {
-              "type": "string"
-            },
-            "loadBalancerIP": {
-              "type": "string"
-            },
-            "loadBalancerSourceRanges": {
-              "type": "array"
-            },
-            "ipFamilies": {
-              "items": {
-                "type": "string",
-                "enum": [
-                  "IPv4",
-                  "IPv6"
-                ]
-              }
-            },
-            "ipFamilyPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "SingleStack",
-                "PreferDualStack",
-                "RequireDualStack"
-              ]
-            },
-            "ports": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string"
-                  },
-                  "port": {
-                    "type": "integer"
-                  },
-                  "protocol": {
-                    "type": "string"
-                  },
-                  "targetPort": {
-                    "type": "integer"
-                  }
-                }
-              }
-            },
-            "type": {
-              "type": "string"
-            }
-          }
-        },
-        "serviceAccount": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "name": {
-              "type": "string"
-            },
-            "create": {
-              "type": "boolean"
-            }
-          }
-        },
-        "rbac": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            }
-          }
-        },
-        "tolerations": {
-          "type": "array"
-        },
-        "topologySpreadConstraints": {
-          "type": "array"
-        },
-        "networkGateway": {
-          "type": "string"
-        },
-        "imagePullPolicy": {
-          "type": "string",
-          "enum": [
-            "",
-            "Always",
-            "IfNotPresent",
-            "Never"
-          ]
-        },
-        "imagePullSecrets": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "name": {
-                "type": "string"
-              }
-            }
-          }
-        },
-        "podDisruptionBudget": {
-          "type": "object",
-          "properties": {
-            "minAvailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "maxUnavailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "unhealthyPodEvictionPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "IfHealthyBudget",
-                "AlwaysAllow"
-              ]
-            }
-          }
-        },
-        "terminationGracePeriodSeconds": {
-          "type": "number"
-        },
-        "volumes": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "volumeMounts": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "priorityClassName": {
-          "type": "string"
-        },
-        "_internal_defaults_do_not_set": {
-          "type": "object"
-        }
-      },
-      "additionalProperties": false
-    }
-  },
-  "defaults": {
-    "$ref": "#/$defs/values"
-  },
-  "$ref": "#/$defs/values"
-}
diff --git a/resources/v1.25.1/charts/gateway/values.yaml b/resources/v1.25.1/charts/gateway/values.yaml
deleted file mode 100644
index d8b70ec15..000000000
--- a/resources/v1.25.1/charts/gateway/values.yaml
+++ /dev/null
@@ -1,168 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Name allows overriding the release name. Generally this should not be set
-  name: ""
-  # revision declares which revision this gateway is a part of
-  revision: ""
-
-  # Controls the spec.replicas setting for the Gateway deployment if set.
-  # Otherwise defaults to Kubernetes Deployment default (1).
-  replicaCount:
-
-  kind: Deployment
-
-  rbac:
-    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
-    # when using http://gateway-api.org/.
-    enabled: true
-
-  serviceAccount:
-    # If set, a service account will be created. Otherwise, the default is used
-    create: true
-    # Annotations to add to the service account
-    annotations: {}
-    # The name of the service account to use.
-    # If not set, the release name is used
-    name: ""
-
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/stats/prometheus"
-    inject.istio.io/templates: "gateway"
-    sidecar.istio.io/inject: "true"
-
-  # Define the security context for the pod.
-  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-  securityContext: {}
-  containerSecurityContext: {}
-
-  service:
-    # Type of service. Set to "None" to disable the service entirely
-    type: LoadBalancer
-    ports:
-    - name: status-port
-      port: 15021
-      protocol: TCP
-      targetPort: 15021
-    - name: http2
-      port: 80
-      protocol: TCP
-      targetPort: 80
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
-    annotations: {}
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    externalTrafficPolicy: ""
-    externalIPs: []
-    ipFamilyPolicy: ""
-    ipFamilies: []
-    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
-    # allocateLoadBalancerNodePorts: false
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: 2000m
-      memory: 1024Mi
-
-  autoscaling:
-    enabled: true
-    minReplicas: 1
-    maxReplicas: 5
-    targetCPUUtilizationPercentage: 80
-    targetMemoryUtilizationPercentage: {}
-    autoscaleBehavior: {}
-
-  # Pod environment variables
-  env: {}
-
-  # Deployment Update strategy
-  strategy: {}
-  
-  # Sets the Deployment minReadySeconds value
-  minReadySeconds:
-  
-  # Optionally configure a custom readinessProbe. By default the control plane
-  # automatically injects the readinessProbe. If you wish to override that
-  # behavior, you may define your own readinessProbe here.
-  readinessProbe: {}
-
-  # Labels to apply to all resources
-  labels:
-    # By default, don't enroll gateways into the ambient dataplane
-    "istio.io/dataplane-mode": none
-
-  # Annotations to apply to all resources
-  annotations: {}
-
-  nodeSelector: {}
-
-  tolerations: []
-
-  topologySpreadConstraints: []
-
-  affinity: {}
-
-  # If specified, the gateway will act as a network gateway for the given network.
-  networkGateway: ""
-
-  # Specify image pull policy if default behavior isn't desired.
-  # Default behavior: latest images will be Always else IfNotPresent
-  imagePullPolicy: ""
-
-  imagePullSecrets: []
-
-  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
-  #
-  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
-  # which means that no PodDisruptionBudget resource will be created.
-  #
-  # To enable the PodDisruptionBudget, configure it by specifying the
-  # `minAvailable` or `maxUnavailable`. For example, to set the
-  # minimum number of available replicas to 1, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #
-  # Or, to allow a maximum of 1 unavailable replica, you can set:
-  #
-  # podDisruptionBudget:
-  #   maxUnavailable: 1
-  #
-  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
-  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #   unhealthyPodEvictionPolicy: AlwaysAllow
-  #
-  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
-  #
-  # podDisruptionBudget: {}
-  #
-  podDisruptionBudget: {}
-
-  # Sets the per-pod terminationGracePeriodSeconds setting.
-  terminationGracePeriodSeconds: 30
-
-  # A list of `Volumes` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumes: []
-
-  # A list of `VolumeMounts` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumeMounts: []
-
-  # Configure this to a higher priority class in order to make sure your Istio gateway pods
-  # will not be killed because of low priority class.
-  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-  # for more detail.
-  priorityClassName: ""
diff --git a/resources/v1.25.1/charts/istiod/Chart.yaml b/resources/v1.25.1/charts/istiod/Chart.yaml
deleted file mode 100644
index 72488c0f3..000000000
--- a/resources/v1.25.1/charts/istiod/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.1
-description: Helm chart for istio control plane
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- istiod
-- istio-discovery
-name: istiod
-sources:
-- https://github.com/istio/istio
-version: 1.25.1
diff --git a/resources/v1.25.1/charts/istiod/README.md b/resources/v1.25.1/charts/istiod/README.md
deleted file mode 100644
index ddbfbc8fe..000000000
--- a/resources/v1.25.1/charts/istiod/README.md
+++ /dev/null
@@ -1,73 +0,0 @@
-# Istiod Helm Chart
-
-This chart installs an Istiod deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-Before installing, ensure CRDs are installed in the cluster (from the `istio/base` chart).
-
-To install the chart with the release name `istiod`:
-
-```console
-kubectl create namespace istio-system
-helm install istiod istio/istiod --namespace istio-system
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istiod` deployment:
-
-```console
-helm delete istiod --namespace istio-system
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istiod
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Examples
-
-#### Configuring mesh configuration settings
-
-Any [Mesh Config](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/) options can be configured like below:
-
-```yaml
-meshConfig:
-  accessLogFile: /dev/stdout
-```
-
-#### Revisions
-
-Control plane revisions allow deploying multiple versions of the control plane in the same cluster.
-This allows safe [canary upgrades](https://istio.io/latest/docs/setup/upgrade/canary/)
-
-```yaml
-revision: my-revision-name
-```
diff --git a/resources/v1.25.1/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.25.1/charts/istiod/files/gateway-injection-template.yaml
deleted file mode 100644
index dbd83cc57..000000000
--- a/resources/v1.25.1/charts/istiod/files/gateway-injection-template.yaml
+++ /dev/null
@@ -1,253 +0,0 @@
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations:
-    istio.io/rev: {{ .Revision | default "default" | quote }}
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- end }}
-spec:
-  securityContext:
-  {{- if .Values.gateways.securityContext }}
-    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
-  {{- else }}
-    sysctls:
-    - name: net.ipv4.ip_unprivileged_port_start
-      value: "0"
-  {{- end }}
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - router
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- end }}
-    securityContext:
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-    env:
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-  volumes:
-  - emptyDir: {}
-    name: workload-socket
-  - emptyDir: {}
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else}}
-  - emptyDir: {}
-    name: workload-certs
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.1/charts/istiod/files/grpc-agent.yaml b/resources/v1.25.1/charts/istiod/files/grpc-agent.yaml
deleted file mode 100644
index 7290fcdca..000000000
--- a/resources/v1.25.1/charts/istiod/files/grpc-agent.yaml
+++ /dev/null
@@ -1,310 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-    sidecar.istio.io/rewriteAppHTTPProbers: "false",
-  }
-spec:
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15020
-      protocol: TCP
-      name: mesh-metrics
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-          - --url=http://localhost:15020/healthz/ready
-    env:
-    - name: ISTIO_META_GENERATOR
-      value: grpc
-    - name: OUTPUT_CERTS
-      value: /var/lib/istio/data
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    # grpc uses xds:/// to resolve – no need to resolve VIP
-    - name: ISTIO_META_DNS_CAPTURE
-      value: "false"
-    - name: DISABLE_ENVOY
-      value: "true"
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15020
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # UDS channel between istioagent and gRPC client for XDS/SDS
-    - mountPath: /etc/istio/proxy
-      name: istio-xds
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-{{- range $index, $container := .Spec.Containers  }}
-{{ if not (eq $container.Name "istio-proxy") }}
-  - name: {{ $container.Name }}
-    env:
-      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
-        value: "true"
-      - name: "GRPC_XDS_BOOTSTRAP"
-        value: "/etc/istio/proxy/grpc-bootstrap.json"
-    volumeMounts:
-      - mountPath: /var/lib/istio/data
-        name: istio-data
-      # UDS channel between istioagent and gRPC client for XDS/SDS
-      - mountPath: /etc/istio/proxy
-        name: istio-xds
-      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-        readOnly: true
-      {{- else }}
-      - name: workload-certs
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-      {{- end }}
-{{- end }}
-{{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-xds
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.1/charts/istiod/files/grpc-simple.yaml b/resources/v1.25.1/charts/istiod/files/grpc-simple.yaml
deleted file mode 100644
index 9ba0c7a46..000000000
--- a/resources/v1.25.1/charts/istiod/files/grpc-simple.yaml
+++ /dev/null
@@ -1,65 +0,0 @@
-metadata:
-  annotations:
-    sidecar.istio.io/rewriteAppHTTPProbers: "false"
-spec:
-  initContainers:
-    - name: grpc-bootstrap-init
-      image: busybox:1.28
-      volumeMounts:
-        - mountPath: /var/lib/grpc/data/
-          name: grpc-io-proxyless-bootstrap
-      env:
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: ISTIO_NAMESPACE
-          value: |
-             {{ .Values.global.istioNamespace }}
-      command:
-        - sh
-        - "-c"
-        - |-
-          NODE_ID="sidecar~${INSTANCE_IP}~${POD_NAME}.${POD_NAMESPACE}~cluster.local"
-          SERVER_URI="dns:///istiod.${ISTIO_NAMESPACE}.svc:15010"
-          echo '
-          {
-            "xds_servers": [
-              {
-                "server_uri": "'${SERVER_URI}'",
-                "channel_creds": [{"type": "insecure"}],
-                "server_features" : ["xds_v3"]
-              }
-            ],
-            "node": {
-              "id": "'${NODE_ID}'",
-              "metadata": {
-                "GENERATOR": "grpc"
-              }
-            }
-          }' > /var/lib/grpc/data/bootstrap.json
-  containers:
-  {{- range $index, $container := .Spec.Containers }}
-  - name: {{ $container.Name }}
-    env:
-      - name: GRPC_XDS_BOOTSTRAP
-        value: /var/lib/grpc/data/bootstrap.json
-      - name: GRPC_GO_LOG_VERBOSITY_LEVEL
-        value: "99"
-      - name: GRPC_GO_LOG_SEVERITY_LEVEL
-        value: info
-    volumeMounts:
-      - mountPath: /var/lib/grpc/data/
-        name: grpc-io-proxyless-bootstrap
-  {{- end }}
-  volumes:
-    - name: grpc-io-proxyless-bootstrap
-      emptyDir: {}
diff --git a/resources/v1.25.1/charts/istiod/files/injection-template.yaml b/resources/v1.25.1/charts/istiod/files/injection-template.yaml
deleted file mode 100644
index 3b3f69cd9..000000000
--- a/resources/v1.25.1/charts/istiod/files/injection-template.yaml
+++ /dev/null
@@ -1,515 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
-    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
-    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
-    {{- end }}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-{{- if .Values.pilot.cni.enabled }}
-    {{- if eq .Values.pilot.cni.provider "multus" }}
-    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
-    {{- end }}
-    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
-    traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}",
-    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
-    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
-    {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
-    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
-    {{- end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}istio.io/reroute-virtual-interfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
-{{- end }}
-  }
-spec:
-  {{- $holdProxy := and
-      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
-      (not $nativeSidecar) }}
-  initContainers:
-  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
-  {{ if .Values.pilot.cni.enabled -}}
-  - name: istio-validation
-  {{ else -}}
-  - name: istio-init
-  {{ end -}}
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    args:
-    - istio-iptables
-    - "-p"
-    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
-    - "-z"
-    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
-    - "-u"
-    - {{ .ProxyUID | default "1337" | quote }}
-    - "-m"
-    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
-    - "-i"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
-    - "-x"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
-    - "-b"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
-    - "-d"
-  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
-    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
-  {{- else }}
-    - "15090,15021"
-  {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
-    - "-q"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
-    {{ end -}}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
-    - "-o"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}"
-    {{ end -}}
-     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
-    - "-c"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
-    {{ end -}}
-    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
-    {{ if .Values.global.logAsJson -}}
-    - "--log_as_json"
-    {{ end -}}
-    {{ if .Values.pilot.cni.enabled -}}
-    - "--run-validation"
-    - "--skip-rule-apply"
-    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
-    - "--force-apply"
-    {{ end -}}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-  {{- if .ProxyConfig.ProxyMetadata }}
-    env:
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-  {{- end }}
-    resources:
-  {{ template "resources" . }}
-    securityContext:
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      privileged: {{ .Values.global.proxy.privileged }}
-      capabilities:
-    {{- if not .Values.pilot.cni.enabled }}
-        add:
-        - NET_ADMIN
-        - NET_RAW
-    {{- end }}
-        drop:
-        - ALL
-    {{- if not .Values.pilot.cni.enabled }}
-      readOnlyRootFilesystem: false
-      runAsGroup: 0
-      runAsNonRoot: false
-      runAsUser: 0
-    {{- else }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsNonRoot: true
-    {{- end }}
-  {{ end -}}
-  {{ if not $nativeSidecar }}
-  containers:
-  {{ end }}
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.outlierLogPath }}
-    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-  {{- end}}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- else if $holdProxy }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-  {{- else if $nativeSidecar }}
-    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
-    lifecycle:
-      preStop:
-        exec:
-          command:
-          - pilot-agent
-          - request
-          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
-          - POST
-          - drain
-  {{- end }}
-    env:
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- with (index .ObjectMeta.Labels `service.istio.io/workload-name` | default .DeploymentMeta.Name) }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ . }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - name: ISTIO_BOOTSTRAP_OVERRIDE
-      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
-    {{- end }}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-  {{ if .Values.global.proxy.startupProbe.enabled }}
-    startupProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: 0
-      periodSeconds: 1
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
-  {{ end }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    {{ end -}}
-    securityContext:
-      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
-      allowPrivilegeEscalation: true
-      capabilities:
-        add:
-        - NET_ADMIN
-        drop:
-        - ALL
-      privileged: true
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else }}
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      capabilities:
-        {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-        add:
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
-        - NET_ADMIN
-        {{- end }}
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
-        - NET_BIND_SERVICE
-        {{- end }}
-        {{- end }}
-        drop:
-        - ALL
-      privileged: {{ .Values.global.proxy.privileged }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else -}}
-      runAsNonRoot: true
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      {{- end }}
-      {{- end }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - mountPath: /etc/istio/custom-bootstrap
-      name: custom-bootstrap-volume
-    {{- end }}
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
-      name: lightstep-certs
-      readOnly: true
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  - emptyDir:
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-  - name: lightstep-certs
-    secret:
-      optional: true
-      secretName: lightstep.cacert
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.1/charts/istiod/files/kube-gateway.yaml b/resources/v1.25.1/charts/istiod/files/kube-gateway.yaml
deleted file mode 100644
index dbe158de1..000000000
--- a/resources/v1.25.1/charts/istiod/files/kube-gateway.yaml
+++ /dev/null
@@ -1,345 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-gateway-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": {{.Name}}
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-gateway-controller"
-          ) | nindent 8 }}
-    spec:
-      securityContext:
-      {{- if .Values.gateways.securityContext }}
-        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
-      {{- else }}
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- if .Values.gateways.seccompProfile }}
-        seccompProfile:
-      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
-      {{- end }}
-      {{- end }}
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-      {{- else }}
-        image: "{{ .ProxyImage }}"
-      {{- end }}
-        {{- if .Values.global.proxy.resources }}
-        resources:
-          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsUser: {{ .ProxyUID | default "1337" }}
-          runAsGroup: {{ .ProxyGID | default "1337" }}
-          runAsNonRoot: true
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        args:
-        - proxy
-        - router
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-      {{- if .Values.global.sts.servicePort }}
-        - --stsPort={{ .Values.global.sts.servicePort }}
-      {{- end }}
-      {{- if .Values.global.logAsJson }}
-        - --log_as_json
-      {{- end }}
-      {{- if .Values.global.proxy.lifecycle }}
-        lifecycle:
-          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
-      {{- end }}
-        env:
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        - name: ISTIO_META_POD_PORTS
-          value: "[]"
-        - name: ISTIO_META_APP_CONTAINERS
-          value: ""
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: "{{ .ProxyConfig.InterceptionMode.String }}"
-        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
-        - name: ISTIO_META_NETWORK
-          value: {{.|quote}}
-        {{- end }}
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName|quote}}
-        - name: ISTIO_META_OWNER
-          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
-        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-          value: {{.|quote}}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        volumeMounts:
-        - name: workload-socket
-          mountPath: /var/run/secrets/workload-spiffe-uds
-        - name: credential-socket
-          mountPath: /var/run/secrets/credential-uds
-        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-        - name: gke-workload-certificate
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-          readOnly: true
-        {{- else }}
-        - name: workload-certs
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-        {{- end }}
-        {{- if eq .Values.global.pilotCertProvider "istiod" }}
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        {{- end }}
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        # SDS channel between istioagent and Envoy
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - name: istio-podinfo
-          mountPath: /etc/istio/pod
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir: {}
-        name: credential-socket
-      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        csi:
-          driver: workloadcertificates.security.cloud.google.com
-      {{- else}}
-      - emptyDir: {}
-        name: workload-certs
-      {{- end }}
-      # SDS channel between istioagent and Envoy
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - name: istio-data
-        emptyDir: {}
-      - name: istio-podinfo
-        downwardAPI:
-          items:
-            - path: "labels"
-              fieldRef:
-                fieldPath: metadata.labels
-            - path: "annotations"
-              fieldRef:
-                fieldPath: metadata.annotations
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: {{ .Values.global.sds.token.aud }}
-      {{- if eq .Values.global.pilotCertProvider "istiod" }}
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: {{.UID}}
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": {{.Name}}
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.25.1/charts/istiod/files/profile-ambient.yaml b/resources/v1.25.1/charts/istiod/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.1/charts/istiod/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.1/charts/istiod/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.1/charts/istiod/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.1/charts/istiod/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/istiod/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.1/charts/istiod/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.1/charts/istiod/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/istiod/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.1/charts/istiod/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.1/charts/istiod/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/istiod/files/profile-platform-gke.yaml b/resources/v1.25.1/charts/istiod/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.1/charts/istiod/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.1/charts/istiod/files/profile-platform-k3d.yaml b/resources/v1.25.1/charts/istiod/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.1/charts/istiod/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.1/charts/istiod/files/profile-platform-microk8s.yaml b/resources/v1.25.1/charts/istiod/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.1/charts/istiod/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.1/charts/istiod/files/profile-platform-minikube.yaml b/resources/v1.25.1/charts/istiod/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.1/charts/istiod/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.1/charts/istiod/files/profile-platform-openshift.yaml b/resources/v1.25.1/charts/istiod/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.1/charts/istiod/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.1/charts/istiod/files/profile-preview.yaml b/resources/v1.25.1/charts/istiod/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.1/charts/istiod/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.1/charts/istiod/files/profile-remote.yaml b/resources/v1.25.1/charts/istiod/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.1/charts/istiod/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.1/charts/istiod/files/profile-stable.yaml b/resources/v1.25.1/charts/istiod/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.1/charts/istiod/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.1/charts/istiod/files/waypoint.yaml b/resources/v1.25.1/charts/istiod/files/waypoint.yaml
deleted file mode 100644
index 2600e98e2..000000000
--- a/resources/v1.25.1/charts/istiod/files/waypoint.yaml
+++ /dev/null
@@ -1,340 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-mesh-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": "{{.Name}}"
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "istio.io/dataplane-mode" "none"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-mesh-controller"
-          ) | nindent 8}}
-    spec:
-      {{- if .Values.global.waypoint.affinity }}
-      affinity:
-      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.topologySpreadConstraints }}
-      topologySpreadConstraints:
-      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.nodeSelector }}
-      nodeSelector:
-      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.tolerations }}
-      tolerations:
-      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: 2
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-        {{- else }}
-        image: "{{ .ProxyImage }}"
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        args:
-        - proxy
-        - waypoint
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --serviceCluster
-        - {{.ServiceAccount}}.$(POD_NAMESPACE)
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-        {{- if .Values.global.logAsJson }}
-        - --log_as_json
-        {{- end }}
-        {{- if .Values.global.proxy.outlierLogPath }}
-        - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-        {{- end}}
-        env:
-        - name: ISTIO_META_SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        {{- if .ProxyConfig.ProxyMetadata }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
-        {{- if $network }}
-        - name: ISTIO_META_NETWORK
-          value: "{{ $network }}"
-        {{- end }}
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: REDIRECT
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName}}
-        - name: ISTIO_META_OWNER
-          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- if .Values.global.waypoint.resources }}
-        resources:
-        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        securityContext:
-          privileged: false
-        {{- if not (eq .Values.global.platform "openshift") }}
-          runAsGroup: 1337
-          runAsUser: 1337
-        {{- end }}
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-            - ALL
-{{- if .Values.gateways.seccompProfile }}
-          seccompProfile:
-{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
-{{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/workload-spiffe-uds
-          name: workload-socket
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /etc/istio/pod
-          name: istio-podinfo
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - emptyDir:
-          medium: Memory
-        name: go-proxy-envoy
-      - emptyDir: {}
-        name: istio-data
-      - emptyDir: {}
-        name: go-proxy-data
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.labels
-            path: labels
-          - fieldRef:
-              fieldPath: metadata.annotations
-            path: annotations
-        name: istio-podinfo
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              audience: istio-ca
-              expirationSeconds: 43200
-              path: istio-token
-      - configMap:
-          name: istio-ca-root-cert
-        name: istiod-ca-cert
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap
-      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
-      (omit .InfrastructureAnnotations
-        "kubectl.kubernetes.io/last-applied-configuration"
-        "gateway.istio.io/name-override"
-        "gateway.istio.io/service-account"
-        "gateway.istio.io/controller-version"
-      ) | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": "{{.Name}}"
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.25.1/charts/istiod/templates/NOTES.txt b/resources/v1.25.1/charts/istiod/templates/NOTES.txt
deleted file mode 100644
index 0d07ea7f4..000000000
--- a/resources/v1.25.1/charts/istiod/templates/NOTES.txt
+++ /dev/null
@@ -1,82 +0,0 @@
-"istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
-
-Next steps:
-{{- $profile := default "" .Values.profile }}
-{{- if (eq $profile "ambient") }}
-  * Get started with ambient: https://istio.io/latest/docs/ops/ambient/getting-started/
-  * Review ambient's architecture: https://istio.io/latest/docs/ops/ambient/architecture/
-{{- else }}
-  * Deploy a Gateway: https://istio.io/latest/docs/setup/additional-setup/gateway/
-  * Try out our tasks to get started on common configurations:
-    * https://istio.io/latest/docs/tasks/traffic-management
-    * https://istio.io/latest/docs/tasks/security/
-    * https://istio.io/latest/docs/tasks/policy-enforcement/
-{{- end }}
-  * Review the list of actively supported releases, CVE publications and our hardening guide:
-    * https://istio.io/latest/docs/releases/supported-releases/
-    * https://istio.io/latest/news/security/
-    * https://istio.io/latest/docs/ops/best-practices/security/
-
-For further documentation see https://istio.io website
-
-{{-
-  $deps := dict
-    "global.outboundTrafficPolicy" "meshConfig.outboundTrafficPolicy"
-    "global.certificates" "meshConfig.certificates"
-    "global.localityLbSetting" "meshConfig.localityLbSetting"
-    "global.policyCheckFailOpen" "meshConfig.policyCheckFailOpen"
-    "global.enableTracing" "meshConfig.enableTracing"
-    "global.proxy.accessLogFormat" "meshConfig.accessLogFormat"
-    "global.proxy.accessLogFile" "meshConfig.accessLogFile"
-    "global.proxy.concurrency" "meshConfig.defaultConfig.concurrency"
-    "global.proxy.envoyAccessLogService" "meshConfig.defaultConfig.envoyAccessLogService"
-    "global.proxy.envoyAccessLogService.enabled" "meshConfig.enableEnvoyAccessLogService"
-    "global.proxy.envoyMetricsService" "meshConfig.defaultConfig.envoyMetricsService"
-    "global.proxy.protocolDetectionTimeout" "meshConfig.protocolDetectionTimeout"
-    "global.proxy.holdApplicationUntilProxyStarts" "meshConfig.defaultConfig.holdApplicationUntilProxyStarts"
-    "pilot.ingress" "meshConfig.ingressService, meshConfig.ingressControllerMode, and meshConfig.ingressClass"
-    "global.mtls.enabled" "the PeerAuthentication resource"
-    "global.mtls.auto" "meshConfig.enableAutoMtls"
-    "global.tracer.lightstep.address" "meshConfig.defaultConfig.tracing.lightstep.address"
-    "global.tracer.lightstep.accessToken" "meshConfig.defaultConfig.tracing.lightstep.accessToken"
-    "global.tracer.zipkin.address" "meshConfig.defaultConfig.tracing.zipkin.address"
-    "global.tracer.datadog.address" "meshConfig.defaultConfig.tracing.datadog.address"
-    "global.meshExpansion.enabled" "Gateway and other Istio networking resources, such as in samples/multicluster/"
-    "istiocoredns.enabled" "the in-proxy DNS capturing (ISTIO_META_DNS_CAPTURE)"
-}}
-{{- range $dep, $replace := $deps }}
-{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
-{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
-{{- if not (eq $res "")}}
-WARNING: {{$dep|quote}} is deprecated; use {{$replace|quote}} instead.
-{{- end }}
-{{- end }}
-{{-
-  $failDeps := dict
-    "telemetry.v2.prometheus.configOverride"
-    "telemetry.v2.stackdriver.configOverride"
-    "telemetry.v2.stackdriver.disableOutbound"
-    "telemetry.v2.stackdriver.outboundAccessLogging"
-    "global.tracer.stackdriver.debug" "meshConfig.defaultConfig.tracing.stackdriver.debug"
-    "global.tracer.stackdriver.maxNumberOfAttributes" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes"
-    "global.tracer.stackdriver.maxNumberOfAnnotations" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations"
-    "global.tracer.stackdriver.maxNumberOfMessageEvents" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents"
-    "meshConfig.defaultConfig.tracing.stackdriver.debug" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents" "Istio supported tracers"
-}}
-{{- range $dep, $replace := $failDeps }}
-{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
-{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
-{{- if not (eq $res "")}}
-{{fail (print $dep " is removed")}}
-{{- end }}
-{{- end }}
-{{- if eq $.Values.global.pilotCertProvider "kubernetes" }}
-{{- fail "pilotCertProvider=kubernetes is not supported" }}
-{{- end }}
\ No newline at end of file
diff --git a/resources/v1.25.1/charts/istiod/templates/_helpers.tpl b/resources/v1.25.1/charts/istiod/templates/_helpers.tpl
deleted file mode 100644
index 042c92538..000000000
--- a/resources/v1.25.1/charts/istiod/templates/_helpers.tpl
+++ /dev/null
@@ -1,23 +0,0 @@
-{{/* Default Prometheus is enabled if its enabled and there are no config overrides set */}}
-{{ define "default-prometheus" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.prometheus.enabled
-}}
-{{- end }}
-
-{{/* SD has metrics and logging split. Default metrics are enabled if SD is enabled */}}
-{{ define "default-sd-metrics" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
-}}
-{{- end }}
-
-{{/* SD has metrics and logging split. */}}
-{{ define "default-sd-logs" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
-}}
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/autoscale.yaml b/resources/v1.25.1/charts/istiod/templates/autoscale.yaml
deleted file mode 100644
index 09cd6258c..000000000
--- a/resources/v1.25.1/charts/istiod/templates/autoscale.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if and .Values.autoscaleEnabled .Values.autoscaleMin .Values.autoscaleMax }}
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  maxReplicas: {{ .Values.autoscaleMax }}
-  minReplicas: {{ .Values.autoscaleMin }}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  metrics:
-  - type: Resource
-    resource:
-      name: cpu
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.cpu.targetAverageUtilization }}
-  {{- if .Values.memory.targetAverageUtilization }}
-  - type: Resource
-    resource:
-      name: memory
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.memory.targetAverageUtilization }}
-  {{- end }}
-  {{- if .Values.autoscaleBehavior }}
-  behavior: {{ toYaml .Values.autoscaleBehavior | nindent 4 }}
-  {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/clusterrole.yaml b/resources/v1.25.1/charts/istiod/templates/clusterrole.yaml
deleted file mode 100644
index 0c340b5b3..000000000
--- a/resources/v1.25.1/charts/istiod/templates/clusterrole.yaml
+++ /dev/null
@@ -1,187 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  # sidecar injection controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-
-  # configuration validation webhook controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-
-  # istio configuration
-  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
-  # please proceed with caution
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["get", "watch", "list"]
-    resources: ["*"]
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["update", "patch"]
-    resources:
-    - authorizationpolicies/status
-    - destinationrules/status
-    - envoyfilters/status
-    - gateways/status
-    - peerauthentications/status
-    - proxyconfigs/status
-    - requestauthentications/status
-    - serviceentries/status
-    - sidecars/status
-    - telemetries/status
-    - virtualservices/status
-    - wasmplugins/status
-    - workloadentries/status
-    - workloadgroups/status
-{{- end }}
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries/status",  "serviceentries/status" ]
-  - apiGroups: ["security.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "authorizationpolicies/status" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services/status" ]
-
-  # auto-detect installed CRD definitions
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-
-  # discovery and routing
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-
-{{- if .Values.taint.enabled }}
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["patch"]
-{{- end }}
-
-  # ingress controller
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-{{- end}}
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses", "ingressclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-
-  # required for CA's namespace controller
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-
-  # Istiod and bootstrap.
-{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
-{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "certificatesigningrequests"
-      - "certificatesigningrequests/approval"
-      - "certificatesigningrequests/status"
-    verbs: ["update", "create", "get", "delete", "watch"]
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "signers"
-    resourceNames:
-{{- range .Values.global.certSigners }}
-    - {{ . | quote }}
-{{- end }}
-    verbs: ["approve"]
-{{- end}}
-
-  # Used by Istiod to verify the JWT tokens
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-
-  # Used by Istiod to verify gateway SDS
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-
-  # Use for Kubernetes Service APIs
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources:
-    - backendtlspolicies/status
-    - gatewayclasses/status
-    - gateways/status
-    - grpcroutes/status
-    - httproutes/status
-    - referencegrants/status
-    - tcproutes/status
-    - tlsroutes/status
-    - udproutes/status
-    verbs: ["update", "patch"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["gatewayclasses"]
-    verbs: ["create", "update", "patch", "delete"]
-
-  # Needed for multicluster secret reading, possibly ingress certs in the future
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "watch", "list"]
-
-  # Used for MCS serviceexport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: [ "get", "watch", "list", "create", "delete"]
-
-  # Used for MCS serviceimport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "watch", "list"]
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: ["apps"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "deployments" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "serviceaccounts"]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.25.1/charts/istiod/templates/clusterrolebinding.yaml
deleted file mode 100644
index 10781b407..000000000
--- a/resources/v1.25.1/charts/istiod/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-- kind: ServiceAccount
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.25.1/charts/istiod/templates/configmap-jwks.yaml
deleted file mode 100644
index 3505d2822..000000000
--- a/resources/v1.25.1/charts/istiod/templates/configmap-jwks.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.jwksResolverExtraRootCA }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  extra.pem: {{ .Values.jwksResolverExtraRootCA | quote }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/configmap-values.yaml b/resources/v1.25.1/charts/istiod/templates/configmap-values.yaml
deleted file mode 100644
index a7e60369d..000000000
--- a/resources/v1.25.1/charts/istiod/templates/configmap-values.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  original-values: |-
-{{ .Values._original | toPrettyJson | indent 4 }}
-{{- $_ := unset $.Values "_original" }}
-  merged-values: |-
-{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.25.1/charts/istiod/templates/deployment.yaml b/resources/v1.25.1/charts/istiod/templates/deployment.yaml
deleted file mode 100644
index cd48ab757..000000000
--- a/resources/v1.25.1/charts/istiod/templates/deployment.yaml
+++ /dev/null
@@ -1,290 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- range $key, $val := .Values.deploymentLabels }}
-    {{ $key }}: "{{ $val }}"
-{{- end }}
-spec:
-{{- if not .Values.autoscaleEnabled }}
-{{- if .Values.replicaCount }}
-  replicas: {{ .Values.replicaCount }}
-{{- end }}
-{{- end }}
-  strategy:
-    rollingUpdate:
-      maxSurge: {{ .Values.rollingMaxSurge }}
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  selector:
-    matchLabels:
-      {{- if ne .Values.revision "" }}
-      app: istiod
-      istio.io/rev: {{ .Values.revision | default "default" | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
-  template:
-    metadata:
-      labels:
-        app: istiod
-        istio.io/rev: {{ .Values.revision | default "default" | quote }}
-        sidecar.istio.io/inject: "false"
-        operator.istio.io/component: "Pilot"
-        {{- if ne .Values.revision "" }}
-        istio: istiod
-        {{- else }}
-        istio: pilot
-        {{- end }}
-        {{- range $key, $val := .Values.podLabels }}
-        {{ $key }}: "{{ $val }}"
-        {{- end }}
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: "istiod"
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        prometheus.io/port: "15014"
-        prometheus.io/scrape: "true"
-        sidecar.istio.io/inject: "false"
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{- if .Values.nodeSelector }}
-      nodeSelector:
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- with .Values.affinity }}
-      affinity:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      tolerations:
-        - key: cni.istio.io/not-ready
-          operator: "Exists"
-{{- with .Values.tolerations }}
-{{- toYaml . | nindent 8 }}
-{{- end }}
-{{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- if .Values.global.priorityClassName }}
-      priorityClassName: "{{ .Values.global.priorityClassName }}"
-{{- end }}
-{{- with .Values.initContainers }}
-      initContainers:
-        {{- tpl (toYaml .) $ | nindent 8 }}
-{{- end }}
-      containers:
-        - name: discovery
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
-{{- end }}
-{{- if .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
-{{- end }}
-          args:
-          - "discovery"
-          - --monitoringAddr=:15014
-{{- if .Values.global.logging.level }}
-          - --log_output_level={{ .Values.global.logging.level }}
-{{- end}}
-{{- if .Values.global.logAsJson }}
-          - --log_as_json
-{{- end }}
-          - --domain
-          - {{ .Values.global.proxy.clusterDomain }}
-{{- if .Values.taint.namespace }}
-          - --cniNamespace={{ .Values.taint.namespace }}
-{{- end }}
-          - --keepaliveMaxServerConnectionAge
-          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
-{{- if .Values.extraContainerArgs }}
-          {{- with .Values.extraContainerArgs }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-{{- end }}
-          ports:
-          - containerPort: 8080
-            protocol: TCP
-            name: http-debug
-          - containerPort: 15010
-            protocol: TCP
-            name: grpc-xds
-          - containerPort: 15012
-            protocol: TCP
-            name: tls-xds
-          - containerPort: 15017
-            protocol: TCP
-            name: https-webhooks
-          - containerPort: 15014
-            protocol: TCP
-            name: http-monitoring
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 8080
-            initialDelaySeconds: 1
-            periodSeconds: 3
-            timeoutSeconds: 5
-          env:
-          - name: REVISION
-            value: "{{ .Values.revision | default `default` }}"
-          - name: PILOT_CERT_PROVIDER
-            value: {{ .Values.global.pilotCertProvider }}
-          - name: POD_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.name
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.namespace
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: spec.serviceAccountName
-          - name: KUBECONFIG
-            value: /var/run/secrets/remote/config
-          # If you explicitly told us where ztunnel lives, use that.
-          # Otherwise, assume it lives in our namespace
-          # Also, check for an explicit ENV override (legacy approach) and prefer that
-          # if present
-          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
-          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
-          - name: CA_TRUSTED_NODE_ACCOUNTS
-            value: "{{ $ztTrustedNS }}/ztunnel"
-          {{- end }}
-          {{- if .Values.env }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: "{{ $val }}"
-          {{- end }}
-          {{- end }}
-{{- if .Values.traceSampling }}
-          - name: PILOT_TRACE_SAMPLING
-            value: "{{ .Values.traceSampling }}"
-{{- end }}
-# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
-# don't set it here to avoid duplication.
-# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
-{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
-          - name: EXTERNAL_ISTIOD
-            value: "{{ .Values.global.externalIstiod }}"
-{{- end }}
-          - name: PILOT_ENABLE_ANALYSIS
-            value: "{{ .Values.global.istiod.enableAnalysis }}"
-          - name: CLUSTER_ID
-            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
-          - name: GOMEMLIMIT
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.memory
-          - name: GOMAXPROCS
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.cpu
-                divisor: "1"
-          - name: PLATFORM
-            value: "{{ coalesce .Values.global.platform .Values.platform }}"
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-              - ALL
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          volumeMounts:
-          - name: istio-token
-            mountPath: /var/run/secrets/tokens
-            readOnly: true
-          - name: local-certs
-            mountPath: /var/run/secrets/istio-dns
-          - name: cacerts
-            mountPath: /etc/cacerts
-            readOnly: true
-          - name: istio-kubeconfig
-            mountPath: /var/run/secrets/remote
-            readOnly: true
-          {{- if .Values.jwksResolverExtraRootCA }}
-          - name: extracacerts
-            mountPath: /cacerts
-          {{- end }}
-          - name: istio-csr-dns-cert
-            mountPath: /var/run/secrets/istiod/tls
-            readOnly: true
-          - name: istio-csr-ca-configmap
-            mountPath: /var/run/secrets/istiod/ca
-            readOnly: true
-          {{- with .Values.volumeMounts }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-      volumes:
-      # Technically not needed on this pod - but it helps debugging/testing SDS
-      # Should be removed after everything works.
-      - emptyDir:
-          medium: Memory
-        name: local-certs
-      - name: istio-token
-        projected:
-          sources:
-            - serviceAccountToken:
-                audience: {{ .Values.global.sds.token.aud }}
-                expirationSeconds: 43200
-                path: istio-token
-      # Optional: user-generated root
-      - name: cacerts
-        secret:
-          secretName: cacerts
-          optional: true
-      - name: istio-kubeconfig
-        secret:
-          secretName: istio-kubeconfig
-          optional: true
-      # Optional: istio-csr dns pilot certs
-      - name: istio-csr-dns-cert
-        secret:
-          secretName: istiod-tls
-          optional: true
-      - name: istio-csr-ca-configmap
-        configMap:
-          name: istio-ca-root-cert
-          defaultMode: 420
-          optional: true
-  {{- if .Values.jwksResolverExtraRootCA }}
-      - name: extracacerts
-        configMap:
-          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  {{- end }}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
-
----
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.25.1/charts/istiod/templates/istiod-injector-configmap.yaml
deleted file mode 100644
index 560c284ff..000000000
--- a/resources/v1.25.1/charts/istiod/templates/istiod-injector-configmap.yaml
+++ /dev/null
@@ -1,81 +0,0 @@
-{{- if not .Values.global.omitSidecarInjectorConfigMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
-  values: |-
-{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
-{{ $pilotVals := pick .Values "cni" -}}
-{{ $vals = set $vals "pilot" $pilotVals -}}
-{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
-{{ $vals = set $vals "gateways" $gatewayVals -}}
-{{ $vals | toPrettyJson | indent 4 }}
-
-  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
-  # and istiod webhook functionality.
-  #
-  # New fields should not use Values - it is a 'primary' config object, users should be able
-  # to fine tune it or use it with kube-inject.
-  config: |-
-    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
-    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
-    defaultTemplates:
-{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
-    - {{ . }}
-{{- end }}
-    {{- else }}
-    defaultTemplates: [sidecar]
-    {{- end }}
-    policy: {{ .Values.global.proxy.autoInject }}
-    alwaysInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
-    neverInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
-    injectedAnnotations:
-      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
-      "{{ $key }}": {{ $val | quote }}
-      {{- end }}
-    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
-         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
-         This should make it obvious that their installation is broken.
-     */}}
-    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
-    templates:
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
-      sidecar: |
-{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
-      gateway: |
-{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
-      grpc-simple: |
-{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
-      grpc-agent: |
-{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
-      waypoint: |
-{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
-      kube-gateway: |
-{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
-{{- end }}
-{{- with .Values.sidecarInjectorWebhook.templates }}
-{{ toYaml . | trim | indent 6 }}
-{{- end }}
-
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.25.1/charts/istiod/templates/mutatingwebhook.yaml
deleted file mode 100644
index 22160f70a..000000000
--- a/resources/v1.25.1/charts/istiod/templates/mutatingwebhook.yaml
+++ /dev/null
@@ -1,164 +0,0 @@
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- /* Core defines the common configuration used by all webhook segments */}}
-{{/* Copy just what we need to avoid expensive deepCopy */}}
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "caBundle" .Values.istiodRemote.injectionCABundle
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-    {{- if .caBundle }}
-    caBundle: "{{ .caBundle }}"
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  reinvocationPolicy: "{{ .reinvocationPolicy }}"
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
-{{- if not .Values.global.operatorManageWebhooks }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq .Release.Namespace "istio-system"}}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- else }}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
-
-{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
-{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-
-
-{{- /* Webhooks for default revision */}}
-{{- if (eq .Values.revision "") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.25.1/charts/istiod/templates/poddisruptionbudget.yaml
deleted file mode 100644
index 1eacf16e6..000000000
--- a/resources/v1.25.1/charts/istiod/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    istio: pilot
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app: istiod
-      {{- if ne .Values.revision "" }}
-      istio.io/rev: {{ .Values.revision | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.25.1/charts/istiod/templates/reader-clusterrole.yaml
deleted file mode 100644
index dbaa80503..000000000
--- a/resources/v1.25.1/charts/istiod/templates/reader-clusterrole.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - "config.istio.io"
-      - "security.istio.io"
-      - "networking.istio.io"
-      - "authentication.istio.io"
-      - "rbac.istio.io"
-      - "telemetry.istio.io"
-      - "extensions.istio.io"
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
-    resources: ["gateways"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: ["get", "list", "watch", "create", "delete"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["apps"]
-    resources: ["replicasets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-{{- if .Values.istiodRemote.enabled }}
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-{{- end}}
diff --git a/resources/v1.25.1/charts/istiod/templates/reader-clusterrolebinding.yaml b/resources/v1.25.1/charts/istiod/templates/reader-clusterrolebinding.yaml
deleted file mode 100644
index aea9f01f7..000000000
--- a/resources/v1.25.1/charts/istiod/templates/reader-clusterrolebinding.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istio-reader-service-account
-    namespace: {{ .Values.global.istioNamespace }}
diff --git a/resources/v1.25.1/charts/istiod/templates/remote-istiod-endpoints.yaml b/resources/v1.25.1/charts/istiod/templates/remote-istiod-endpoints.yaml
deleted file mode 100644
index a6de571da..000000000
--- a/resources/v1.25.1/charts/istiod/templates/remote-istiod-endpoints.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-# if the remotePilotAddress is an IP addr
-{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-subsets:
-- addresses:
-  - ip: {{ .Values.global.remotePilotAddress }}
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 15017
-    name: tcp-webhook
-    protocol: TCP
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/revision-tags.yaml b/resources/v1.25.1/charts/istiod/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.25.1/charts/istiod/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/role.yaml b/resources/v1.25.1/charts/istiod/templates/role.yaml
deleted file mode 100644
index 10d89e8d1..000000000
--- a/resources/v1.25.1/charts/istiod/templates/role.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-# permissions to verify the webhook is ready and rejecting
-# invalid config. We use --server-dry-run so no config is persisted.
-- apiGroups: ["networking.istio.io"]
-  verbs: ["create"]
-  resources: ["gateways"]
-
-# For storing CA secret
-- apiGroups: [""]
-  resources: ["secrets"]
-  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
-  verbs: ["create", "get", "watch", "list", "update", "delete"]
-
-# For status controller, so it can delete the distribution report configmap
-- apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["delete"]
-
-# For gateway deployment controller
-- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
-  verbs: ["get", "update", "patch", "create"]
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/rolebinding.yaml b/resources/v1.25.1/charts/istiod/templates/rolebinding.yaml
deleted file mode 100644
index a42f4ec44..000000000
--- a/resources/v1.25.1/charts/istiod/templates/rolebinding.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/service.yaml b/resources/v1.25.1/charts/istiod/templates/service.yaml
deleted file mode 100644
index 30d5b8912..000000000
--- a/resources/v1.25.1/charts/istiod/templates/service.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  {{- if .Values.serviceAnnotations }}
-  annotations:
-{{ toYaml .Values.serviceAnnotations | indent 4 }}
-  {{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: istiod
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-    - port: 15010
-      name: grpc-xds # plaintext
-      protocol: TCP
-    - port: 15012
-      name: https-dns # mTLS with k8s-signed cert
-      protocol: TCP
-    - port: 443
-      name: https-webhook # validation and injection
-      targetPort: 15017
-      protocol: TCP
-    - port: 15014
-      name: http-monitoring # prometheus stats
-      protocol: TCP
-  selector:
-    app: istiod
-    {{- if ne .Values.revision "" }}
-    istio.io/rev: {{ .Values.revision | quote }}
-    {{- else }}
-    # Label used by the 'default' service. For versioned deployments we match with app and version.
-    # This avoids default deployment picking the canary
-    istio: pilot
-    {{- end }}
-  {{- if .Values.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.ipFamilyPolicy }}
-  {{- end }}
-  {{- if .Values.ipFamilies }}
-  ipFamilies:
-  {{- range .Values.ipFamilies }}
-  - {{ . }}
-  {{- end }}
-  {{- end }}
----
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/serviceaccount.yaml b/resources/v1.25.1/charts/istiod/templates/serviceaccount.yaml
deleted file mode 100644
index a673a4d07..000000000
--- a/resources/v1.25.1/charts/istiod/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-  {{- if .Values.serviceAccountAnnotations }}
-  annotations:
-{{- toYaml .Values.serviceAccountAnnotations | nindent 4 }}
-  {{- end }}
-{{- end }}
----
diff --git a/resources/v1.25.1/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.25.1/charts/istiod/templates/validatingadmissionpolicy.yaml
deleted file mode 100644
index d36eef68e..000000000
--- a/resources/v1.25.1/charts/istiod/templates/validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.experimental.stableValidationPolicy }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-policy-binding{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-spec:
-  policyName: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  validationActions: [Deny]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.25.1/charts/istiod/templates/validatingwebhookconfiguration.yaml
deleted file mode 100644
index fb28836a0..000000000
--- a/resources/v1.25.1/charts/istiod/templates/validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,68 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.global.configValidation }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  # Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
-  # are rejecting invalid configs on a per-revision basis.
-  - name: rev.validation.istio.io
-    clientConfig:
-      # Should change from base but cannot for API compat
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/istiod/templates/zzy_descope_legacy.yaml b/resources/v1.25.1/charts/istiod/templates/zzy_descope_legacy.yaml
deleted file mode 100644
index ae8fced29..000000000
--- a/resources/v1.25.1/charts/istiod/templates/zzy_descope_legacy.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-{{/* Copy anything under `.pilot` to `.`, to avoid the need to specify a redundant prefix.
-Due to the file naming, this always happens after zzz_profile.yaml */}}
-{{- $_ := mustMergeOverwrite $.Values (index $.Values "pilot") }}
\ No newline at end of file
diff --git a/resources/v1.25.1/charts/istiod/values.yaml b/resources/v1.25.1/charts/istiod/values.yaml
deleted file mode 100644
index e8e62cbad..000000000
--- a/resources/v1.25.1/charts/istiod/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.25.1
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.25.1/charts/revisiontags/Chart.yaml b/resources/v1.25.1/charts/revisiontags/Chart.yaml
deleted file mode 100644
index 4511f95a7..000000000
--- a/resources/v1.25.1/charts/revisiontags/Chart.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.1
-description: Helm chart for istio revision tags
-name: revisiontags
-sources:
-- https://github.com/istio-ecosystem/sail-operator
-version: 0.1.0
-
diff --git a/resources/v1.25.1/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.25.1/charts/revisiontags/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.1/charts/revisiontags/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.1/charts/revisiontags/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.1/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.1/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/revisiontags/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.1/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.1/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/revisiontags/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.1/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.1/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/revisiontags/files/profile-platform-gke.yaml b/resources/v1.25.1/charts/revisiontags/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.1/charts/revisiontags/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.1/charts/revisiontags/files/profile-platform-k3d.yaml b/resources/v1.25.1/charts/revisiontags/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.1/charts/revisiontags/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.1/charts/revisiontags/files/profile-platform-microk8s.yaml b/resources/v1.25.1/charts/revisiontags/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.1/charts/revisiontags/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.1/charts/revisiontags/files/profile-platform-minikube.yaml b/resources/v1.25.1/charts/revisiontags/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.1/charts/revisiontags/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.1/charts/revisiontags/files/profile-platform-openshift.yaml b/resources/v1.25.1/charts/revisiontags/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.1/charts/revisiontags/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.1/charts/revisiontags/files/profile-preview.yaml b/resources/v1.25.1/charts/revisiontags/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.1/charts/revisiontags/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.1/charts/revisiontags/files/profile-remote.yaml b/resources/v1.25.1/charts/revisiontags/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.1/charts/revisiontags/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.1/charts/revisiontags/files/profile-stable.yaml b/resources/v1.25.1/charts/revisiontags/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.1/charts/revisiontags/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.1/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.25.1/charts/revisiontags/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.25.1/charts/revisiontags/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.1/charts/revisiontags/values.yaml b/resources/v1.25.1/charts/revisiontags/values.yaml
deleted file mode 100644
index e8e62cbad..000000000
--- a/resources/v1.25.1/charts/revisiontags/values.yaml
+++ /dev/null
@@ -1,539 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.25.1
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.25.1/charts/ztunnel/Chart.yaml b/resources/v1.25.1/charts/ztunnel/Chart.yaml
deleted file mode 100644
index 567c295c3..000000000
--- a/resources/v1.25.1/charts/ztunnel/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.1
-description: Helm chart for istio ztunnel components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-ztunnel
-- istio
-name: ztunnel
-sources:
-- https://github.com/istio/istio
-version: 1.25.1
diff --git a/resources/v1.25.1/charts/ztunnel/README.md b/resources/v1.25.1/charts/ztunnel/README.md
deleted file mode 100644
index ffe0b94fe..000000000
--- a/resources/v1.25.1/charts/ztunnel/README.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# Istio Ztunnel Helm Chart
-
-This chart installs an Istio ztunnel.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart:
-
-```console
-helm install ztunnel istio/ztunnel
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the chart:
-
-```console
-helm delete ztunnel
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/ztunnel
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.25.1/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.25.1/charts/ztunnel/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.1/charts/ztunnel/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.1/charts/ztunnel/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.1/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.1/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/ztunnel/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.1/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.1/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/ztunnel/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.1/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.1/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.1/charts/ztunnel/files/profile-platform-gke.yaml b/resources/v1.25.1/charts/ztunnel/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.1/charts/ztunnel/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.1/charts/ztunnel/files/profile-platform-k3d.yaml b/resources/v1.25.1/charts/ztunnel/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.1/charts/ztunnel/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.1/charts/ztunnel/files/profile-platform-microk8s.yaml b/resources/v1.25.1/charts/ztunnel/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.1/charts/ztunnel/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.1/charts/ztunnel/files/profile-platform-minikube.yaml b/resources/v1.25.1/charts/ztunnel/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.1/charts/ztunnel/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.1/charts/ztunnel/files/profile-platform-openshift.yaml b/resources/v1.25.1/charts/ztunnel/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.1/charts/ztunnel/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.1/charts/ztunnel/files/profile-preview.yaml b/resources/v1.25.1/charts/ztunnel/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.1/charts/ztunnel/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.1/charts/ztunnel/files/profile-remote.yaml b/resources/v1.25.1/charts/ztunnel/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.1/charts/ztunnel/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.1/charts/ztunnel/files/profile-stable.yaml b/resources/v1.25.1/charts/ztunnel/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.1/charts/ztunnel/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.1/charts/ztunnel/templates/NOTES.txt b/resources/v1.25.1/charts/ztunnel/templates/NOTES.txt
deleted file mode 100644
index 244f59db0..000000000
--- a/resources/v1.25.1/charts/ztunnel/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-ztunnel successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.25.1/charts/ztunnel/templates/_helpers.tpl b/resources/v1.25.1/charts/ztunnel/templates/_helpers.tpl
deleted file mode 100644
index 82740e441..000000000
--- a/resources/v1.25.1/charts/ztunnel/templates/_helpers.tpl
+++ /dev/null
@@ -1 +0,0 @@
-{{ define "ztunnel.release-name" }}{{ .Values.resourceName| default .Release.Name }}{{ end }}
diff --git a/resources/v1.25.1/charts/ztunnel/templates/daemonset.yaml b/resources/v1.25.1/charts/ztunnel/templates/daemonset.yaml
deleted file mode 100644
index ee5775d70..000000000
--- a/resources/v1.25.1/charts/ztunnel/templates/daemonset.yaml
+++ /dev/null
@@ -1,197 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: {{ include "ztunnel.release-name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-spec:
-  updateStrategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app: ztunnel
-  template:
-    metadata:
-      labels:
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app: ztunnel
-        app.kubernetes.io/name: ztunnel
-        {{- include "istio.labels" . | nindent 8}}
-{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-{{- if .Values.revision }}
-        istio.io/rev: {{ .Values.revision }}
-{{- end }}
-{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-{{- if .Values.nodeSelector }}
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- if .Values.affinity }}
-      affinity:
-{{ toYaml .Values.affinity | trim | indent 8 }}
-{{- end }}
-      serviceAccountName: {{ include "ztunnel.release-name" . }}
-      tolerations:
-        - effect: NoSchedule
-          operator: Exists
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      containers:
-      - name: istio-proxy
-{{- if contains "/" .Values.image }}
-        image: "{{ .Values.image }}"
-{{- else }}
-        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
-{{- end }}
-        ports:
-        - containerPort: 15020
-          name: ztunnel-stats
-          protocol: TCP
-        resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 10 }}
-{{- end }}
-{{- with .Values.imagePullPolicy }}
-        imagePullPolicy: {{ . }}
-{{- end }}
-        securityContext:
-          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
-          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
-          allowPrivilegeEscalation: true
-          privileged: false
-          capabilities:
-            drop:
-            - ALL
-            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
-            - NET_ADMIN # Required for TPROXY and setsockopt
-            - SYS_ADMIN # Required for `setns` - doing things in other netns
-            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
-          readOnlyRootFilesystem: true
-          runAsGroup: 1337
-          runAsNonRoot: false
-          runAsUser: 0
-{{- if .Values.seLinuxOptions }}
-          seLinuxOptions:
-{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
-{{- end }}
-        readinessProbe:
-          httpGet:
-            port: 15021
-            path: /healthz/ready
-        args:
-        - proxy
-        - ztunnel
-        env:
-        - name: CA_ADDRESS
-        {{- if .Values.caAddress }}
-          value: {{ .Values.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: XDS_ADDRESS
-        {{- if .Values.xdsAddress }}
-          value: {{ .Values.xdsAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        {{- if .Values.logAsJson }}
-        - name: LOG_FORMAT
-          value: json
-        {{- end}}
-        - name: RUST_LOG
-          value: {{ .Values.logLevel | quote }}
-        - name: RUST_BACKTRACE
-          value: "1"
-        - name: ISTIO_META_CLUSTER_ID
-          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
-        - name: INPOD_ENABLED
-          value: "true"
-        - name: TERMINATION_GRACE_PERIOD_SECONDS
-          value: "{{ .Values.terminationGracePeriodSeconds }}"
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
-        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        {{- with .Values.env }}
-        {{- range $key, $val := . }}
-        - name: {{ $key }}
-          value: "{{ $val }}"
-        {{- end }}
-        {{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /var/run/ztunnel
-          name: cni-ztunnel-sock-dir
-        - mountPath: /tmp
-          name: tmp
-        {{- with .Values.volumeMounts }}
-          {{- toYaml . | nindent 8 }}
-        {{- end }}
-      priorityClassName: system-node-critical
-      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
-      volumes:
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: istio-ca
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      - name: cni-ztunnel-sock-dir
-        hostPath:
-          path: /var/run/ztunnel
-          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
-      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
-      - name: tmp
-        emptyDir: {}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
diff --git a/resources/v1.25.1/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.25.1/charts/ztunnel/templates/zzz_profile.yaml
deleted file mode 100644
index ded66c5fd..000000000
--- a/resources/v1.25.1/charts/ztunnel/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.1/charts/ztunnel/values.yaml b/resources/v1.25.1/charts/ztunnel/values.yaml
deleted file mode 100644
index 85ef971d7..000000000
--- a/resources/v1.25.1/charts/ztunnel/values.yaml
+++ /dev/null
@@ -1,102 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
-  hub: gcr.io/istio-release
-  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
-  tag: 1.25.1
-  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
-  variant: ""
-
-  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
-  # If Image contains a "/", it will replace the entire `image` in the pod.
-  image: ztunnel
-
-  # resourceName, if set, will override the naming of resources. If not set, will default to the release name.
-  # It is recommended to not set this; this is primarily for backwards compatibility.
-  resourceName: ""
-
-  # Labels to apply to all top level resources
-  labels: {}
-  # Annotations to apply to all top level resources
-  annotations: {}
-
-  # Additional volumeMounts to the ztunnel container
-  volumeMounts: []
-
-  # Additional volumes to the ztunnel pod
-  volumes: []
-
-  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-
-  # Additional labels to apply on the pod level
-  podLabels: {}
-
-  # Pod resource configuration
-  resources:
-    requests:
-      cpu: 200m
-      # Ztunnel memory scales with the size of the cluster and traffic load
-      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
-      memory: 512Mi
-
-  # List of secret names to add to the service account as image pull secrets
-  imagePullSecrets: []
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
-
-  # Override for the pod imagePullPolicy
-  imagePullPolicy: ""
-
-  # Settings for multicluster
-  multiCluster:
-    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
-    # with Istiod configuration.
-    clusterName: ""
-
-  # meshConfig defines runtime configuration of components.
-  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
-  # components.
-  # TODO: https://github.com/istio/istio/issues/43248
-  meshConfig:
-    defaultConfig:
-      proxyMetadata: {}
-
-  # This value defines:
-  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
-  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
-  # Default K8S value is 30 seconds
-  terminationGracePeriodSeconds: 30
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
-  revision: ""
-
-  # The customized CA address to retrieve certificates for the pods in the cluster.
-  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-  caAddress: ""
-
-  # The customized XDS address to retrieve configuration.
-  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
-  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
-  xdsAddress: ""
-
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
-  istioNamespace: istio-system
-
-  # Configuration log level of ztunnel binary, default is info.
-  # Valid values are: trace, debug, info, warn, error
-  logLevel: info
-
-  # To output all logs in json format
-  logAsJson: false
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seLinuxOptions: {}
-  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
-  #seLinuxOptions:
-  #  type: spc_t
diff --git a/resources/v1.25.1/cni-1.25.1.tgz.etag b/resources/v1.25.1/cni-1.25.1.tgz.etag
deleted file mode 100644
index fc0730dfa..000000000
--- a/resources/v1.25.1/cni-1.25.1.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-a928d08135e1c796c377333e08d67119
diff --git a/resources/v1.25.1/commit b/resources/v1.25.1/commit
deleted file mode 100644
index d905a6d1d..000000000
--- a/resources/v1.25.1/commit
+++ /dev/null
@@ -1 +0,0 @@
-1.25.1
diff --git a/resources/v1.25.1/gateway-1.25.1.tgz.etag b/resources/v1.25.1/gateway-1.25.1.tgz.etag
deleted file mode 100644
index f31c6bebd..000000000
--- a/resources/v1.25.1/gateway-1.25.1.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-9c341b8dcf6607e60969f2e19d35c557
diff --git a/resources/v1.25.1/istiod-1.25.1.tgz.etag b/resources/v1.25.1/istiod-1.25.1.tgz.etag
deleted file mode 100644
index 468ce30e1..000000000
--- a/resources/v1.25.1/istiod-1.25.1.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-9ee0b4548de4d7ed148744812a069a9f
diff --git a/resources/v1.25.1/profiles/ambient.yaml b/resources/v1.25.1/profiles/ambient.yaml
deleted file mode 100644
index 71ea784a8..000000000
--- a/resources/v1.25.1/profiles/ambient.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: ambient
diff --git a/resources/v1.25.1/profiles/demo.yaml b/resources/v1.25.1/profiles/demo.yaml
deleted file mode 100644
index 53c4b4163..000000000
--- a/resources/v1.25.1/profiles/demo.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: demo
diff --git a/resources/v1.25.1/profiles/empty.yaml b/resources/v1.25.1/profiles/empty.yaml
deleted file mode 100644
index 4477cb1fe..000000000
--- a/resources/v1.25.1/profiles/empty.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-# The empty profile has everything disabled
-# This is useful as a base for custom user configuration
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec: {}
diff --git a/resources/v1.25.1/profiles/openshift-ambient.yaml b/resources/v1.25.1/profiles/openshift-ambient.yaml
deleted file mode 100644
index 76edf00cd..000000000
--- a/resources/v1.25.1/profiles/openshift-ambient.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: ambient
-    global:
-      platform: openshift
diff --git a/resources/v1.25.1/profiles/openshift.yaml b/resources/v1.25.1/profiles/openshift.yaml
deleted file mode 100644
index 41492660f..000000000
--- a/resources/v1.25.1/profiles/openshift.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    global:
-      platform: openshift
diff --git a/resources/v1.25.1/profiles/preview.yaml b/resources/v1.25.1/profiles/preview.yaml
deleted file mode 100644
index 59d545c84..000000000
--- a/resources/v1.25.1/profiles/preview.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: preview
diff --git a/resources/v1.25.1/profiles/remote.yaml b/resources/v1.25.1/profiles/remote.yaml
deleted file mode 100644
index 54c65c8ba..000000000
--- a/resources/v1.25.1/profiles/remote.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# The remote profile is used to configure a mesh cluster without a locally deployed control plane.
-# Only the injector mutating webhook configuration is installed.
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: remote
diff --git a/resources/v1.25.1/profiles/stable.yaml b/resources/v1.25.1/profiles/stable.yaml
deleted file mode 100644
index 285feba24..000000000
--- a/resources/v1.25.1/profiles/stable.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: stable
diff --git a/resources/v1.25.1/ztunnel-1.25.1.tgz.etag b/resources/v1.25.1/ztunnel-1.25.1.tgz.etag
deleted file mode 100644
index 5b9a1b858..000000000
--- a/resources/v1.25.1/ztunnel-1.25.1.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-10ccb1d26bd050b7d4eaf70cacecb3c0
diff --git a/resources/v1.25.2/base-1.25.2.tgz.etag b/resources/v1.25.2/base-1.25.2.tgz.etag
deleted file mode 100644
index 2bd29e458..000000000
--- a/resources/v1.25.2/base-1.25.2.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-2ec3f84787f5ba2895e3a5c3185b1afe
diff --git a/resources/v1.25.2/charts/base/Chart.yaml b/resources/v1.25.2/charts/base/Chart.yaml
deleted file mode 100644
index c9da4186f..000000000
--- a/resources/v1.25.2/charts/base/Chart.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.2
-description: Helm chart for deploying Istio cluster resources and CRDs
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-name: base
-sources:
-- https://github.com/istio/istio
-version: 1.25.2
diff --git a/resources/v1.25.2/charts/base/README.md b/resources/v1.25.2/charts/base/README.md
deleted file mode 100644
index ae8f6d5b0..000000000
--- a/resources/v1.25.2/charts/base/README.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Istio base Helm Chart
-
-This chart installs resources shared by all Istio revisions. This includes Istio CRDs.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-base`:
-
-```console
-kubectl create namespace istio-system
-helm install istio-base istio/base -n istio-system
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.25.2/charts/base/files/profile-ambient.yaml b/resources/v1.25.2/charts/base/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.2/charts/base/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.2/charts/base/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.2/charts/base/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.2/charts/base/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/base/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.2/charts/base/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.2/charts/base/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/base/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.2/charts/base/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.2/charts/base/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/base/files/profile-platform-gke.yaml b/resources/v1.25.2/charts/base/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.2/charts/base/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.2/charts/base/files/profile-platform-k3d.yaml b/resources/v1.25.2/charts/base/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.2/charts/base/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.2/charts/base/files/profile-platform-microk8s.yaml b/resources/v1.25.2/charts/base/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.2/charts/base/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.2/charts/base/files/profile-platform-minikube.yaml b/resources/v1.25.2/charts/base/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.2/charts/base/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.2/charts/base/files/profile-platform-openshift.yaml b/resources/v1.25.2/charts/base/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.2/charts/base/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.2/charts/base/files/profile-preview.yaml b/resources/v1.25.2/charts/base/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.2/charts/base/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.2/charts/base/files/profile-remote.yaml b/resources/v1.25.2/charts/base/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.2/charts/base/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.2/charts/base/files/profile-stable.yaml b/resources/v1.25.2/charts/base/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.2/charts/base/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.2/charts/base/templates/NOTES.txt b/resources/v1.25.2/charts/base/templates/NOTES.txt
deleted file mode 100644
index f12616f57..000000000
--- a/resources/v1.25.2/charts/base/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-Istio base successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.25.2/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml b/resources/v1.25.2/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
deleted file mode 100644
index 2616b09c9..000000000
--- a/resources/v1.25.2/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,53 +0,0 @@
-{{- if and .Values.experimental.stableValidationPolicy (not (eq .Values.defaultRevision "")) }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-default-policy.istio.io"
-  labels:
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision }}
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-default-policy-binding.istio.io"
-spec:
-  policyName: "stable-channel-default-policy.istio.io"
-  validationActions: [Deny]
-{{- end }}
diff --git a/resources/v1.25.2/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml b/resources/v1.25.2/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
deleted file mode 100644
index 8cb76fd77..000000000
--- a/resources/v1.25.2/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-{{- if not (eq .Values.defaultRevision "") }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istiod-default-validator
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  - name: validation.istio.io
-    clientConfig:
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        {{- if (eq .Values.defaultRevision "default") }}
-        name: istiod
-        {{- else }}
-        name: istiod-{{ .Values.defaultRevision }}
-        {{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-{{- end }}
diff --git a/resources/v1.25.2/charts/base/templates/reader-serviceaccount.yaml b/resources/v1.25.2/charts/base/templates/reader-serviceaccount.yaml
deleted file mode 100644
index ba829a6bf..000000000
--- a/resources/v1.25.2/charts/base/templates/reader-serviceaccount.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-# This singleton service account aggregates reader permissions for the revisions in a given cluster
-# ATM this is a singleton per cluster with Istio installed, and is not revisioned. It maybe should be,
-# as otherwise compromising the token for this SA would give you access to *every* installed revision.
-# Should be used for remote secret creation.
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-    {{- end }}
-    {{- end }}
-metadata:
-  name: istio-reader-service-account
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.25.2/charts/base/templates/zzz_profile.yaml b/resources/v1.25.2/charts/base/templates/zzz_profile.yaml
deleted file mode 100644
index 9c2119b9a..000000000
--- a/resources/v1.25.2/charts/base/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.2/charts/cni/Chart.yaml b/resources/v1.25.2/charts/cni/Chart.yaml
deleted file mode 100644
index fef8b07a7..000000000
--- a/resources/v1.25.2/charts/cni/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.2
-description: Helm chart for istio-cni components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-cni
-- istio
-name: cni
-sources:
-- https://github.com/istio/istio
-version: 1.25.2
diff --git a/resources/v1.25.2/charts/cni/README.md b/resources/v1.25.2/charts/cni/README.md
deleted file mode 100644
index a8b78d5bd..000000000
--- a/resources/v1.25.2/charts/cni/README.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# Istio CNI Helm Chart
-
-This chart installs the Istio CNI Plugin. See the [CNI installation guide](https://istio.io/latest/docs/setup/additional-setup/cni/)
-for more information.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-cni`:
-
-```console
-helm install istio-cni istio/cni -n kube-system
-```
-
-Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
-`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
-'system-node-critical' outside of kube-system.
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istio-cni
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Ambient
-
-To enable ambient, you can use the ambient profile: `--set profile=ambient`.
-
-#### Calico
-
-For Calico, you must also modify the settings to allow source spoofing:
-
-- if deployed by operator,  `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`
-- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )
-
-### GKE notes
-
-On GKE, 'kube-system' is required.
-
-If using `helm template`, `--set cni.cniBinDir=/home/kubernetes/bin` is required - with `helm install`
-it is auto-detected.
diff --git a/resources/v1.25.2/charts/cni/files/profile-ambient.yaml b/resources/v1.25.2/charts/cni/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.2/charts/cni/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.2/charts/cni/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.2/charts/cni/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.2/charts/cni/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/cni/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.2/charts/cni/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.2/charts/cni/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/cni/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.2/charts/cni/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.2/charts/cni/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/cni/files/profile-platform-gke.yaml b/resources/v1.25.2/charts/cni/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.2/charts/cni/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.2/charts/cni/files/profile-platform-k3d.yaml b/resources/v1.25.2/charts/cni/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.2/charts/cni/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.2/charts/cni/files/profile-platform-microk8s.yaml b/resources/v1.25.2/charts/cni/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.2/charts/cni/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.2/charts/cni/files/profile-platform-minikube.yaml b/resources/v1.25.2/charts/cni/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.2/charts/cni/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.2/charts/cni/files/profile-platform-openshift.yaml b/resources/v1.25.2/charts/cni/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.2/charts/cni/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.2/charts/cni/files/profile-preview.yaml b/resources/v1.25.2/charts/cni/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.2/charts/cni/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.2/charts/cni/files/profile-remote.yaml b/resources/v1.25.2/charts/cni/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.2/charts/cni/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.2/charts/cni/files/profile-stable.yaml b/resources/v1.25.2/charts/cni/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.2/charts/cni/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.2/charts/cni/templates/NOTES.txt b/resources/v1.25.2/charts/cni/templates/NOTES.txt
deleted file mode 100644
index fb35525b9..000000000
--- a/resources/v1.25.2/charts/cni/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-"{{ .Release.Name }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.25.2/charts/cni/templates/_helpers.tpl b/resources/v1.25.2/charts/cni/templates/_helpers.tpl
deleted file mode 100644
index 73cc17b2f..000000000
--- a/resources/v1.25.2/charts/cni/templates/_helpers.tpl
+++ /dev/null
@@ -1,8 +0,0 @@
-{{- define "name" -}}
-    istio-cni
-{{- end }}
-
-
-{{- define "istio-tag" -}}
-    {{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}
-{{- end }}
diff --git a/resources/v1.25.2/charts/cni/templates/clusterrolebinding.yaml b/resources/v1.25.2/charts/cni/templates/clusterrolebinding.yaml
deleted file mode 100644
index 42fedab1f..000000000
--- a/resources/v1.25.2/charts/cni/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-repair-rolebinding
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-repair-role
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "name" . }}
-    namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-ambient
-{{- end }}
diff --git a/resources/v1.25.2/charts/cni/templates/daemonset.yaml b/resources/v1.25.2/charts/cni/templates/daemonset.yaml
deleted file mode 100644
index d83c77fce..000000000
--- a/resources/v1.25.2/charts/cni/templates/daemonset.yaml
+++ /dev/null
@@ -1,241 +0,0 @@
-# This manifest installs the Istio install-cni container, as well
-# as the Istio CNI plugin and config on
-# each master and worker node in a Kubernetes cluster.
-#
-# $detectedBinDir exists to support a GKE-specific platform override,
-# and is deprecated in favor of using the explicit `gke` platform profile.
-{{- $detectedBinDir := (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
-    "/home/kubernetes/bin"
-    "/opt/cni/bin"
-}}
-{{- if .Values.cniBinDir }}
-{{ $detectedBinDir = .Values.cniBinDir }}
-{{- end }}
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  # Note that this is templated but evaluates to a fixed name
-  # which the CNI plugin may fall back onto in some failsafe scenarios.
-  # if this name is changed, CNI plugin logic that checks for this name
-  # format should also be updated.
-  name: {{ template "name" . }}-node
-  namespace: {{ .Release.Namespace }}
-  labels:
-    k8s-app: {{ template "name" . }}-node
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  selector:
-    matchLabels:
-      k8s-app: {{ template "name" . }}-node
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  template:
-    metadata:
-      labels:
-        k8s-app: {{ template "name" . }}-node
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: {{ template "name" . }}
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-        # Add Prometheus Scrape annotations
-        prometheus.io/scrape: 'true'
-        prometheus.io/port: "15014"
-        prometheus.io/path: '/metrics'
-        # Add AppArmor annotation
-        # This is required to avoid conflicts with AppArmor profiles which block certain
-        # privileged pod capabilities.
-        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
-        # securityContext which is otherwise preferred.
-        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
-        # Custom annotations
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{if .Values.ambient.enabled }}
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-{{ end }}
-      nodeSelector:
-        kubernetes.io/os: linux
-      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      tolerations:
-        # Make sure istio-cni-node gets scheduled on all nodes.
-        - effect: NoSchedule
-          operator: Exists
-        # Mark the pod as a critical add-on for rescheduling.
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      priorityClassName: system-node-critical
-      serviceAccountName: {{ template "name" . }}
-      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
-      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
-      terminationGracePeriodSeconds: 5
-      containers:
-        # This container installs the Istio CNI binaries
-        # and CNI network config file on each node.
-        - name: install-cni
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
-{{- end }}
-{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
-{{- end }}
-          ports:
-          - containerPort: 15014
-            name: metrics
-            protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8000
-          securityContext:
-            privileged: false
-            runAsGroup: 0
-            runAsUser: 0
-            runAsNonRoot: false
-            # Both ambient and sidecar repair mode require elevated node privileges to function.
-            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
-            # add capabilities based on feature.
-            capabilities:
-              drop:
-              - ALL
-              add:
-              # CAP_NET_ADMIN is required to allow ipset and route table access
-              - NET_ADMIN
-              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
-              - NET_RAW
-              # CAP_SYS_PTRACE is required for repair and ambient mode to describe
-              # the pod's network namespace.
-              - SYS_PTRACE
-              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
-              # network namespaces in `/proc` to obtain descriptors for entering pod network
-              # namespaces. There does not appear to be a more granular capability for this.
-              - SYS_ADMIN
-              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
-              # the typical ability to read/write to folders owned by others.
-              # This can cause problems if the hostPath mounts we use, which we require write access into,
-              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
-              - DAC_OVERRIDE
-{{- if .Values.seLinuxOptions }}
-{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
-            seLinuxOptions:
-{{ toYaml . | trim | indent 14 }}
-{{- end }}
-{{- end }}
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          command: ["install-cni"]
-          args:
-            {{- if or .Values.logging.level .Values.global.logging.level }}
-            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
-            {{- end}}
-            {{- if .Values.global.logAsJson }}
-            - --log_as_json
-            {{- end}}
-          envFrom:
-            - configMapRef:
-                name: {{ template "name" . }}-config
-          env:
-            - name: REPAIR_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: REPAIR_RUN_AS_DAEMON
-              value: "true"
-            - name: REPAIR_SIDECAR_ANNOTATION
-              value: "sidecar.istio.io/status"
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  apiVersion: v1
-                  fieldPath: spec.nodeName
-            - name: GOMEMLIMIT
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.memory
-            - name: GOMAXPROCS
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.cpu
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          volumeMounts:
-            - mountPath: /host/opt/cni/bin
-              name: cni-bin-dir
-            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-            - mountPath: /host/proc
-              name: cni-host-procfs
-              readOnly: true
-            {{- end }}
-            - mountPath: /host/etc/cni/net.d
-              name: cni-net-dir
-            - mountPath: /var/run/istio-cni
-              name: cni-socket-dir
-            {{- if .Values.ambient.enabled }}
-            - mountPath: /host/var/run/netns
-              mountPropagation: HostToContainer
-              name: cni-netns-dir
-            - mountPath: /var/run/ztunnel
-              name: cni-ztunnel-sock-dir
-            {{ end }}
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-      volumes:
-        # Used to install CNI.
-        - name: cni-bin-dir
-          hostPath:
-            path: {{ $detectedBinDir }}
-        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-        - name: cni-host-procfs
-          hostPath:
-            path: /proc
-            type: Directory
-        {{- end }}
-        {{- if .Values.ambient.enabled }}
-        - name: cni-ztunnel-sock-dir
-          hostPath:
-            path: /var/run/ztunnel
-            type: DirectoryOrCreate
-        {{- end }}
-        - name: cni-net-dir
-          hostPath:
-            path: {{ .Values.cniConfDir }}
-        # Used for UDS sockets for logging, ambient eventing
-        - name: cni-socket-dir
-          hostPath:
-            path: /var/run/istio-cni
-        - name: cni-netns-dir
-          hostPath:
-            path: {{ .Values.cniNetnsDir }}
-            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
-            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
-            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.25.2/charts/cni/templates/network-attachment-definition.yaml b/resources/v1.25.2/charts/cni/templates/network-attachment-definition.yaml
deleted file mode 100644
index 86a2eb7c0..000000000
--- a/resources/v1.25.2/charts/cni/templates/network-attachment-definition.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-{{- if eq .Values.provider "multus" }}
-apiVersion: k8s.cni.cncf.io/v1
-kind: NetworkAttachmentDefinition
-metadata:
-  name: {{ template "name" . }}
-  namespace: default
-  labels:
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/cni/templates/resourcequota.yaml b/resources/v1.25.2/charts/cni/templates/resourcequota.yaml
deleted file mode 100644
index 9a6d61ff9..000000000
--- a/resources/v1.25.2/charts/cni/templates/resourcequota.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-{{- if .Values.resourceQuotas.enabled }}
-apiVersion: v1
-kind: ResourceQuota
-metadata:
-  name: {{ template "name" . }}-resource-quota
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  hard:
-    pods: {{ .Values.resourceQuotas.pods | quote }}
-  scopeSelector:
-    matchExpressions:
-    - operator: In
-      scopeName: PriorityClass
-      values:
-      - system-node-critical
-{{- end }}
diff --git a/resources/v1.25.2/charts/cni/templates/serviceaccount.yaml b/resources/v1.25.2/charts/cni/templates/serviceaccount.yaml
deleted file mode 100644
index 3193d7b74..000000000
--- a/resources/v1.25.2/charts/cni/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-{{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-{{- end }}
-{{- end }}
-metadata:
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.25.2/charts/cni/templates/zzy_descope_legacy.yaml b/resources/v1.25.2/charts/cni/templates/zzy_descope_legacy.yaml
deleted file mode 100644
index a9584ac29..000000000
--- a/resources/v1.25.2/charts/cni/templates/zzy_descope_legacy.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-{{/* Copy anything under `.cni` to `.`, to avoid the need to specify a redundant prefix.
-Due to the file naming, this always happens after zzz_profile.yaml */}}
-{{- $_ := mustMergeOverwrite $.Values (index $.Values "cni") }}
\ No newline at end of file
diff --git a/resources/v1.25.2/charts/cni/templates/zzz_profile.yaml b/resources/v1.25.2/charts/cni/templates/zzz_profile.yaml
deleted file mode 100644
index 9c2119b9a..000000000
--- a/resources/v1.25.2/charts/cni/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.2/charts/cni/values.yaml b/resources/v1.25.2/charts/cni/values.yaml
deleted file mode 100644
index 6d94fcd17..000000000
--- a/resources/v1.25.2/charts/cni/values.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  hub: ""
-  tag: ""
-  variant: ""
-  image: install-cni
-  pullPolicy: ""
-
-  # Same as `global.logging.level`, but will override it if set
-  logging:
-    level: ""
-
-  # Configuration file to insert istio-cni plugin configuration
-  # by default this will be the first file found in the cni-conf-dir
-  # Example
-  # cniConfFileName: 10-calico.conflist
-
-  # CNI-and-platform specific path defaults.
-  # These may need to be set to platform-specific values, consult
-  # overrides for your platform in `manifests/helm-profiles/platform-*.yaml`
-  cniBinDir: /opt/cni/bin
-  cniConfDir: /etc/cni/net.d
-  cniConfFileName: ""
-  cniNetnsDir: "/var/run/netns"
-
-  excludeNamespaces:
-    - kube-system
-
-  # Allows user to set custom affinity for the DaemonSet
-  affinity: {}
-
-  # Custom annotations on pod level, if you need them
-  podAnnotations: {}
-
-  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
-  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
-  chained: true
-
-  # Custom configuration happens based on the CNI provider.
-  # Possible values: "default", "multus"
-  provider: "default"
-
-  # Configure ambient settings
-  ambient:
-    # If enabled, ambient redirection will be enabled
-    enabled: false
-    # Set ambient config dir path: defaults to /etc/ambient-config
-    configDir: ""
-    # If enabled, and ambient is enabled, DNS redirection will be enabled
-    dnsCapture: true
-    # If enabled, and ambient is enabled, enables ipv6 support
-    ipv6: true
-    # If enabled, and ambient is enabled, the CNI agent will reconcile incompatible iptables rules and chains at startup.
-    # This will eventually be enabled by default
-    reconcileIptablesOnStartup: false
-
-
-  repair:
-    enabled: true
-    hub: ""
-    tag: ""
-
-    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
-    # This defines the action the controller will take when a pod is detected as broken.
-
-    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
-    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
-    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
-    labelPods: false
-    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
-    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
-    deletePods: false
-    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
-    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
-    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
-    repairPods: true
-
-    initContainerName: "istio-validation"
-
-    brokenPodLabelKey: "cni.istio.io/uninitialized"
-    brokenPodLabelValue: "true"
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
-  seLinuxOptions: {}
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 100Mi
-
-  resourceQuotas:
-    enabled: false
-    pods: 5000
-
-  # The number of pods that can be unavailable during rolling update (see
-  # `updateStrategy.rollingUpdate.maxUnavailable` here:
-  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
-  # May be specified as a number of pods or as a percent of the total number
-  # of pods at the start of the update.
-  rollingMaxUnavailable: 1
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  global:
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-
-    # Default tag for Istio images.
-    tag: 1.25.2
-
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # change cni scope level to control logging out of istio-cni-node DaemonSet
-    logging:
-      level: info
-
-    logAsJson: false
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Default resources allocated
-    defaultResources:
-      requests:
-        cpu: 100m
-        memory: 100Mi
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
diff --git a/resources/v1.25.2/charts/gateway/Chart.yaml b/resources/v1.25.2/charts/gateway/Chart.yaml
deleted file mode 100644
index 7f6adec88..000000000
--- a/resources/v1.25.2/charts/gateway/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.2
-description: Helm chart for deploying Istio gateways
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- gateways
-name: gateway
-sources:
-- https://github.com/istio/istio
-type: application
-version: 1.25.2
diff --git a/resources/v1.25.2/charts/gateway/README.md b/resources/v1.25.2/charts/gateway/README.md
deleted file mode 100644
index 5c064d165..000000000
--- a/resources/v1.25.2/charts/gateway/README.md
+++ /dev/null
@@ -1,170 +0,0 @@
-# Istio Gateway Helm Chart
-
-This chart installs an Istio gateway deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-ingressgateway`:
-
-```console
-helm install istio-ingressgateway istio/gateway
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istio-ingressgateway` deployment:
-
-```console
-helm delete istio-ingressgateway
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/gateway
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### OpenShift
-
-When deploying the gateway in an OpenShift cluster, use the `openshift` profile to override the default values, for example:
-
-```console
-helm install istio-ingressgateway istio/gateway --set profile=openshift
-```
-
-### `image: auto` Information
-
-The image used by the chart, `auto`, may be unintuitive.
-This exists because the pod spec will be automatically populated at runtime, using the same mechanism as [Sidecar Injection](istio.io/latest/docs/setup/additional-setup/sidecar-injection).
-This allows the same configurations and lifecycle to apply to gateways as sidecars.
-
-Note: this does mean that the namespace the gateway is deployed in must not have the `istio-injection=disabled` label.
-See [Controlling the injection policy](https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy) for more info.
-
-### Examples
-
-#### Egress Gateway
-
-Deploying a Gateway to be used as an [Egress Gateway](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/):
-
-```yaml
-service:
-  # Egress gateways do not need an external LoadBalancer IP
-  type: ClusterIP
-```
-
-#### Multi-network/VM Gateway
-
-Deploying a Gateway to be used as a [Multi-network Gateway](https://istio.io/latest/docs/setup/install/multicluster/) for network `network-1`:
-
-```yaml
-networkGateway: network-1
-```
-
-### Migrating from other installation methods
-
-Installations from other installation methods (such as istioctl, Istio Operator, other helm charts, etc) can be migrated to use the new Helm charts
-following the guidance below.
-If you are able to, a clean installation is simpler. However, this often requires an external IP migration which can be challenging.
-
-WARNING: when installing over an existing deployment, the two deployments will be merged together by Helm, which may lead to unexpected results.
-
-#### Legacy Gateway Helm charts
-
-Istio historically offered two different charts - `manifests/charts/gateways/istio-ingress` and `manifests/charts/gateways/istio-egress`.
-These are replaced by this chart.
-While not required, it is recommended all new users use this chart, and existing users migrate when possible.
-
-This chart has the following benefits and differences:
-* Designed with Helm best practices in mind (standardized values options, values schema, values are not all nested under `gateways.istio-ingressgateway.*`, release name and namespace taken into account, etc).
-* Utilizes Gateway injection, simplifying upgrades, allowing gateways to run in any namespace, and avoiding repeating config for sidecars and gateways.
-* Published to official Istio Helm repository.
-* Single chart for all gateways (Ingress, Egress, East West).
-
-#### General concerns
-
-For a smooth migration, the resource names and `Deployment.spec.selector` labels must match.
-
-If you install with `helm install istio-gateway istio/gateway`, resources will be named `istio-gateway` and the `selector` labels set to:
-
-```yaml
-app: istio-gateway
-istio: gateway # the release name with leading istio- prefix stripped
-```
-
-If your existing installation doesn't follow these names, you can override them. For example, if you have resources named `my-custom-gateway` with `selector` labels
-`foo=bar,istio=ingressgateway`:
-
-```yaml
-name: my-custom-gateway # Override the name to match existing resources
-labels:
-  app: "" # Unset default app selector label
-  istio: ingressgateway # override default istio selector label
-  foo: bar # Add the existing custom selector label
-```
-
-#### Migrating an existing Helm release
-
-An existing helm release can be `helm upgrade`d to this chart by using the same release name. For example, if a previous
-installation was done like:
-
-```console
-helm install istio-ingress manifests/charts/gateways/istio-ingress -n istio-system
-```
-
-It could be upgraded with
-
-```console
-helm upgrade istio-ingress manifests/charts/gateway -n istio-system --set name=istio-ingressgateway --set labels.app=istio-ingressgateway --set labels.istio=ingressgateway
-```
-
-Note the name and labels are overridden to match the names of the existing installation.
-
-Warning: the helm charts here default to using port 80 and 443, while the old charts used 8080 and 8443.
-If you have AuthorizationPolicies that reference port these ports, you should update them during this process,
-or customize the ports to match the old defaults.
-See the [security advisory](https://istio.io/latest/news/security/istio-security-2021-002/) for more information.
-
-#### Other migrations
-
-If you see errors like `rendered manifests contain a resource that already exists` during installation, you may need to forcibly take ownership.
-
-The script below can handle this for you. Replace `RELEASE` and `NAMESPACE` with the name and namespace of the release:
-
-```console
-KINDS=(service deployment)
-RELEASE=istio-ingressgateway
-NAMESPACE=istio-system
-for KIND in "${KINDS[@]}"; do
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-name=$RELEASE
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-namespace=$NAMESPACE
-    kubectl --namespace $NAMESPACE --overwrite=true label $KIND $RELEASE app.kubernetes.io/managed-by=Helm
-done
-```
-
-You may ignore errors about resources not being found.
diff --git a/resources/v1.25.2/charts/gateway/files/profile-ambient.yaml b/resources/v1.25.2/charts/gateway/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.2/charts/gateway/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.2/charts/gateway/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.2/charts/gateway/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.2/charts/gateway/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/gateway/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.2/charts/gateway/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.2/charts/gateway/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/gateway/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.2/charts/gateway/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.2/charts/gateway/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/gateway/files/profile-platform-gke.yaml b/resources/v1.25.2/charts/gateway/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.2/charts/gateway/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.2/charts/gateway/files/profile-platform-k3d.yaml b/resources/v1.25.2/charts/gateway/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.2/charts/gateway/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.2/charts/gateway/files/profile-platform-microk8s.yaml b/resources/v1.25.2/charts/gateway/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.2/charts/gateway/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.2/charts/gateway/files/profile-platform-minikube.yaml b/resources/v1.25.2/charts/gateway/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.2/charts/gateway/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.2/charts/gateway/files/profile-platform-openshift.yaml b/resources/v1.25.2/charts/gateway/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.2/charts/gateway/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.2/charts/gateway/files/profile-preview.yaml b/resources/v1.25.2/charts/gateway/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.2/charts/gateway/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.2/charts/gateway/files/profile-remote.yaml b/resources/v1.25.2/charts/gateway/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.2/charts/gateway/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.2/charts/gateway/files/profile-stable.yaml b/resources/v1.25.2/charts/gateway/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.2/charts/gateway/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.2/charts/gateway/templates/NOTES.txt b/resources/v1.25.2/charts/gateway/templates/NOTES.txt
deleted file mode 100644
index fd0142911..000000000
--- a/resources/v1.25.2/charts/gateway/templates/NOTES.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-"{{ include "gateway.name" . }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
-
-Next steps:
-  * Deploy an HTTP Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/
-  * Deploy an HTTPS Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/
diff --git a/resources/v1.25.2/charts/gateway/templates/_helpers.tpl b/resources/v1.25.2/charts/gateway/templates/_helpers.tpl
deleted file mode 100644
index e5a0a9b3c..000000000
--- a/resources/v1.25.2/charts/gateway/templates/_helpers.tpl
+++ /dev/null
@@ -1,40 +0,0 @@
-{{- define "gateway.name" -}}
-{{- if eq .Release.Name "RELEASE-NAME" -}}
-  {{- .Values.name | default "istio-ingressgateway" -}}
-{{- else -}}
-  {{- .Values.name | default .Release.Name | default "istio-ingressgateway" -}}
-{{- end -}}
-{{- end }}
-
-{{- define "gateway.labels" -}}
-{{ include "gateway.selectorLabels" . }}
-{{- range $key, $val := .Values.labels }}
-{{- if and (ne $key "app") (ne $key "istio") }}
-{{ $key | quote }}: {{ $val | quote }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{- define "gateway.selectorLabels" -}}
-app: {{ (.Values.labels.app | quote) | default (include "gateway.name" .) }}
-istio: {{ (.Values.labels.istio | quote) | default (include "gateway.name" . | trimPrefix "istio-") }}
-{{- end }}
-
-{{/*
-Keep sidecar injection labels together
-https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy
-*/}}
-{{- define "gateway.sidecarInjectionLabels" -}}
-sidecar.istio.io/inject: "true"
-{{- with .Values.revision }}
-istio.io/rev: {{ . | quote }}
-{{- end }}
-{{- end }}
-
-{{- define "gateway.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create }}
-{{- .Values.serviceAccount.name | default (include "gateway.name" .)    }}
-{{- else }}
-{{- .Values.serviceAccount.name | default "default" }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/gateway/templates/deployment.yaml b/resources/v1.25.2/charts/gateway/templates/deployment.yaml
deleted file mode 100644
index 9db59d8b9..000000000
--- a/resources/v1.25.2/charts/gateway/templates/deployment.yaml
+++ /dev/null
@@ -1,128 +0,0 @@
-apiVersion: apps/v1
-kind: {{ .Values.kind | default "Deployment" }}
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  {{- with .Values.replicaCount }}
-  replicas: {{ . }}
-  {{- end }}
-  {{- end }}
-  {{- with .Values.strategy }}
-  strategy:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.minReadySeconds }}
-  minReadySeconds: {{ . }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "gateway.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
-        {{- include "gateway.selectorLabels" . | nindent 8 }}
-        app.kubernetes.io/name: {{ include "gateway.name" . }}
-        {{- include "istio.labels" .  | nindent 8}}
-        {{- range $key, $val := .Values.labels }}
-        {{- if and (ne $key "app") (ne $key "istio") }}
-        {{ $key | quote }}: {{ $val | quote }}
-        {{- end }}
-        {{- end }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
-      securityContext:
-      {{- if .Values.securityContext }}
-        {{- toYaml .Values.securityContext | nindent 8 }}
-      {{- else }}
-        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- end }}
-      {{- with .Values.volumes }}
-      volumes:
-        {{ toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: istio-proxy
-          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
-          image: auto
-          {{- with .Values.imagePullPolicy }}
-          imagePullPolicy: {{ . }}
-          {{- end }}
-          securityContext:
-          {{- if .Values.containerSecurityContext }}
-            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          {{- else }}
-            capabilities:
-              drop:
-              - ALL
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            {{- if not (eq (.Values.platform | default "") "openshift") }}
-            runAsUser: 1337
-            runAsGroup: 1337
-            {{- end }}
-            runAsNonRoot: true
-          {{- end }}
-          env:
-          {{- with .Values.networkGateway }}
-          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-            value: "{{.}}"
-          {{- end }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: {{ $val | quote }}
-          {{- end }}
-          ports:
-          - containerPort: 15090
-            protocol: TCP
-            name: http-envoy-prom
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          {{- with .Values.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.readinessProbe }}
-          readinessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
-      {{- with .Values.priorityClassName }}
-      priorityClassName: {{ . }}
-      {{- end }}
diff --git a/resources/v1.25.2/charts/gateway/templates/hpa.yaml b/resources/v1.25.2/charts/gateway/templates/hpa.yaml
deleted file mode 100644
index 64ecb6a4c..000000000
--- a/resources/v1.25.2/charts/gateway/templates/hpa.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-{{- if and (.Values.autoscaling.enabled) (eq .Values.kind "Deployment") }}
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: {{ .Values.kind | default "Deployment" }}
-    name: {{ include "gateway.name" . }}
-  minReplicas: {{ .Values.autoscaling.minReplicas }}
-  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
-  metrics:
-    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
-          type: Utilization
-    {{- end }}
-    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
-    - type: Resource
-      resource:
-        name: memory
-        target:
-          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
-          type: Utilization
-    {{- end }}
-  {{- if .Values.autoscaling.autoscaleBehavior }}
-  behavior: {{ toYaml .Values.autoscaling.autoscaleBehavior | nindent 4 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/gateway/templates/poddisruptionbudget.yaml b/resources/v1.25.2/charts/gateway/templates/poddisruptionbudget.yaml
deleted file mode 100644
index b0155cdf0..000000000
--- a/resources/v1.25.2/charts/gateway/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-{{- if .Values.podDisruptionBudget }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-spec:
-  selector:
-    matchLabels:
-  {{- include "gateway.selectorLabels" . | nindent 6 }}
-  {{- with .Values.podDisruptionBudget }}
-    {{- toYaml . | nindent 2 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/gateway/templates/role.yaml b/resources/v1.25.2/charts/gateway/templates/role.yaml
deleted file mode 100644
index 3d1607963..000000000
--- a/resources/v1.25.2/charts/gateway/templates/role.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-{{/*Set up roles for Istio Gateway. Not required for gateway-api*/}}
-{{- if .Values.rbac.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "watch", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "gateway.serviceAccountName" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ include "gateway.serviceAccountName" . }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/gateway/templates/service.yaml b/resources/v1.25.2/charts/gateway/templates/service.yaml
deleted file mode 100644
index 25ce3bcb0..000000000
--- a/resources/v1.25.2/charts/gateway/templates/service.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-{{- if not (eq .Values.service.type "None") }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-    {{- with .Values.networkGateway }}
-    topology.istio.io/network: "{{.}}"
-    {{- end }}
-  annotations:
-    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
-spec:
-{{- with .Values.service.loadBalancerIP }}
-  loadBalancerIP: "{{ . }}"
-{{- end }}
-{{- if eq .Values.service.type "LoadBalancer" }}
-  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
-  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
-  {{- end }}
-{{- end }}
-{{- if .Values.service.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.service.ipFamilies }}
-  ipFamilies:
-{{- range .Values.service.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
-{{- with .Values.service.loadBalancerSourceRanges }}
-  loadBalancerSourceRanges:
-{{ toYaml . | indent 4 }}
-{{- end }}
-{{- with .Values.service.externalTrafficPolicy }}
-  externalTrafficPolicy: "{{ . }}"
-{{- end }}
-  type: {{ .Values.service.type }}
-  ports:
-{{- if .Values.networkGateway }}
-  - name: status-port
-    port: 15021
-    targetPort: 15021
-  - name: tls
-    port: 15443
-    targetPort: 15443
-  - name: tls-istiod
-    port: 15012
-    targetPort: 15012
-  - name: tls-webhook
-    port: 15017
-    targetPort: 15017
-{{- else }}
-{{ .Values.service.ports | toYaml | indent 4 }}
-{{- end }}
-{{- if .Values.service.externalIPs }}
-  externalIPs: {{- range .Values.service.externalIPs }}
-    - {{.}}
-  {{- end }}
-{{- end }}
-  selector:
-    {{- include "gateway.selectorLabels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/gateway/templates/serviceaccount.yaml b/resources/v1.25.2/charts/gateway/templates/serviceaccount.yaml
deleted file mode 100644
index c88afeadd..000000000
--- a/resources/v1.25.2/charts/gateway/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-{{- if .Values.serviceAccount.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/gateway/templates/zzz_profile.yaml b/resources/v1.25.2/charts/gateway/templates/zzz_profile.yaml
deleted file mode 100644
index ded66c5fd..000000000
--- a/resources/v1.25.2/charts/gateway/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.2/charts/gateway/values.schema.json b/resources/v1.25.2/charts/gateway/values.schema.json
deleted file mode 100644
index 3fdaa2730..000000000
--- a/resources/v1.25.2/charts/gateway/values.schema.json
+++ /dev/null
@@ -1,330 +0,0 @@
-{
-  "$schema": "http://json-schema.org/schema#",
-  "$defs": {
-    "values": {
-      "type": "object",
-      "properties": {
-        "global": {
-          "type": "object"
-        },
-        "affinity": {
-          "type": "object"
-        },
-        "securityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "containerSecurityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "kind": {
-          "type": "string",
-          "enum": [
-            "Deployment",
-            "DaemonSet"
-          ]
-        },
-        "annotations": {
-          "additionalProperties": {
-            "type": [
-              "string",
-              "integer"
-            ]
-          },
-          "type": "object"
-        },
-        "autoscaling": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            },
-            "maxReplicas": {
-              "type": "integer"
-            },
-            "minReplicas": {
-              "type": "integer"
-            },
-            "targetCPUUtilizationPercentage": {
-              "type": "integer"
-            }
-          }
-        },
-        "env": {
-          "type": "object"
-        },
-        "strategy": {
-          "type": "object"
-        },
-        "minReadySeconds": {
-          "type": [
-            "null",
-            "integer"
-          ]
-        },
-        "readinessProbe": {
-          "type": [
-            "null",
-            "object"
-          ]
-        },
-        "labels": {
-          "type": "object"
-        },
-        "name": {
-          "type": "string"
-        },
-        "nodeSelector": {
-          "type": "object"
-        },
-        "podAnnotations": {
-          "type": "object",
-          "properties": {
-            "inject.istio.io/templates": {
-              "type": "string"
-            },
-            "prometheus.io/path": {
-              "type": "string"
-            },
-            "prometheus.io/port": {
-              "type": "string"
-            },
-            "prometheus.io/scrape": {
-              "type": "string"
-            }
-          }
-        },
-        "replicaCount": {
-          "type": [
-            "integer",
-            "null"
-          ]
-        },
-        "resources": {
-          "type": "object",
-          "properties": {
-            "limits": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            },
-            "requests": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            }
-          }
-        },
-        "revision": {
-          "type": "string"
-        },
-        "compatibilityVersion": {
-          "type": "string"
-        },
-        "runAsRoot": {
-          "type": "boolean"
-        },
-        "unprivilegedPort": {
-          "type": [
-            "string",
-            "boolean"
-          ],
-          "enum": [
-            true,
-            false,
-            "auto"
-          ]
-        },
-        "service": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "externalTrafficPolicy": {
-              "type": "string"
-            },
-            "loadBalancerIP": {
-              "type": "string"
-            },
-            "loadBalancerSourceRanges": {
-              "type": "array"
-            },
-            "ipFamilies": {
-              "items": {
-                "type": "string",
-                "enum": [
-                  "IPv4",
-                  "IPv6"
-                ]
-              }
-            },
-            "ipFamilyPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "SingleStack",
-                "PreferDualStack",
-                "RequireDualStack"
-              ]
-            },
-            "ports": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string"
-                  },
-                  "port": {
-                    "type": "integer"
-                  },
-                  "protocol": {
-                    "type": "string"
-                  },
-                  "targetPort": {
-                    "type": "integer"
-                  }
-                }
-              }
-            },
-            "type": {
-              "type": "string"
-            }
-          }
-        },
-        "serviceAccount": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "name": {
-              "type": "string"
-            },
-            "create": {
-              "type": "boolean"
-            }
-          }
-        },
-        "rbac": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            }
-          }
-        },
-        "tolerations": {
-          "type": "array"
-        },
-        "topologySpreadConstraints": {
-          "type": "array"
-        },
-        "networkGateway": {
-          "type": "string"
-        },
-        "imagePullPolicy": {
-          "type": "string",
-          "enum": [
-            "",
-            "Always",
-            "IfNotPresent",
-            "Never"
-          ]
-        },
-        "imagePullSecrets": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "name": {
-                "type": "string"
-              }
-            }
-          }
-        },
-        "podDisruptionBudget": {
-          "type": "object",
-          "properties": {
-            "minAvailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "maxUnavailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "unhealthyPodEvictionPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "IfHealthyBudget",
-                "AlwaysAllow"
-              ]
-            }
-          }
-        },
-        "terminationGracePeriodSeconds": {
-          "type": "number"
-        },
-        "volumes": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "volumeMounts": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "priorityClassName": {
-          "type": "string"
-        },
-        "_internal_defaults_do_not_set": {
-          "type": "object"
-        }
-      },
-      "additionalProperties": false
-    }
-  },
-  "defaults": {
-    "$ref": "#/$defs/values"
-  },
-  "$ref": "#/$defs/values"
-}
diff --git a/resources/v1.25.2/charts/gateway/values.yaml b/resources/v1.25.2/charts/gateway/values.yaml
deleted file mode 100644
index d8b70ec15..000000000
--- a/resources/v1.25.2/charts/gateway/values.yaml
+++ /dev/null
@@ -1,168 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Name allows overriding the release name. Generally this should not be set
-  name: ""
-  # revision declares which revision this gateway is a part of
-  revision: ""
-
-  # Controls the spec.replicas setting for the Gateway deployment if set.
-  # Otherwise defaults to Kubernetes Deployment default (1).
-  replicaCount:
-
-  kind: Deployment
-
-  rbac:
-    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
-    # when using http://gateway-api.org/.
-    enabled: true
-
-  serviceAccount:
-    # If set, a service account will be created. Otherwise, the default is used
-    create: true
-    # Annotations to add to the service account
-    annotations: {}
-    # The name of the service account to use.
-    # If not set, the release name is used
-    name: ""
-
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/stats/prometheus"
-    inject.istio.io/templates: "gateway"
-    sidecar.istio.io/inject: "true"
-
-  # Define the security context for the pod.
-  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-  securityContext: {}
-  containerSecurityContext: {}
-
-  service:
-    # Type of service. Set to "None" to disable the service entirely
-    type: LoadBalancer
-    ports:
-    - name: status-port
-      port: 15021
-      protocol: TCP
-      targetPort: 15021
-    - name: http2
-      port: 80
-      protocol: TCP
-      targetPort: 80
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
-    annotations: {}
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    externalTrafficPolicy: ""
-    externalIPs: []
-    ipFamilyPolicy: ""
-    ipFamilies: []
-    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
-    # allocateLoadBalancerNodePorts: false
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: 2000m
-      memory: 1024Mi
-
-  autoscaling:
-    enabled: true
-    minReplicas: 1
-    maxReplicas: 5
-    targetCPUUtilizationPercentage: 80
-    targetMemoryUtilizationPercentage: {}
-    autoscaleBehavior: {}
-
-  # Pod environment variables
-  env: {}
-
-  # Deployment Update strategy
-  strategy: {}
-  
-  # Sets the Deployment minReadySeconds value
-  minReadySeconds:
-  
-  # Optionally configure a custom readinessProbe. By default the control plane
-  # automatically injects the readinessProbe. If you wish to override that
-  # behavior, you may define your own readinessProbe here.
-  readinessProbe: {}
-
-  # Labels to apply to all resources
-  labels:
-    # By default, don't enroll gateways into the ambient dataplane
-    "istio.io/dataplane-mode": none
-
-  # Annotations to apply to all resources
-  annotations: {}
-
-  nodeSelector: {}
-
-  tolerations: []
-
-  topologySpreadConstraints: []
-
-  affinity: {}
-
-  # If specified, the gateway will act as a network gateway for the given network.
-  networkGateway: ""
-
-  # Specify image pull policy if default behavior isn't desired.
-  # Default behavior: latest images will be Always else IfNotPresent
-  imagePullPolicy: ""
-
-  imagePullSecrets: []
-
-  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
-  #
-  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
-  # which means that no PodDisruptionBudget resource will be created.
-  #
-  # To enable the PodDisruptionBudget, configure it by specifying the
-  # `minAvailable` or `maxUnavailable`. For example, to set the
-  # minimum number of available replicas to 1, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #
-  # Or, to allow a maximum of 1 unavailable replica, you can set:
-  #
-  # podDisruptionBudget:
-  #   maxUnavailable: 1
-  #
-  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
-  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #   unhealthyPodEvictionPolicy: AlwaysAllow
-  #
-  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
-  #
-  # podDisruptionBudget: {}
-  #
-  podDisruptionBudget: {}
-
-  # Sets the per-pod terminationGracePeriodSeconds setting.
-  terminationGracePeriodSeconds: 30
-
-  # A list of `Volumes` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumes: []
-
-  # A list of `VolumeMounts` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumeMounts: []
-
-  # Configure this to a higher priority class in order to make sure your Istio gateway pods
-  # will not be killed because of low priority class.
-  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-  # for more detail.
-  priorityClassName: ""
diff --git a/resources/v1.25.2/charts/istiod/Chart.yaml b/resources/v1.25.2/charts/istiod/Chart.yaml
deleted file mode 100644
index 3b8e2f333..000000000
--- a/resources/v1.25.2/charts/istiod/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.2
-description: Helm chart for istio control plane
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- istiod
-- istio-discovery
-name: istiod
-sources:
-- https://github.com/istio/istio
-version: 1.25.2
diff --git a/resources/v1.25.2/charts/istiod/README.md b/resources/v1.25.2/charts/istiod/README.md
deleted file mode 100644
index ddbfbc8fe..000000000
--- a/resources/v1.25.2/charts/istiod/README.md
+++ /dev/null
@@ -1,73 +0,0 @@
-# Istiod Helm Chart
-
-This chart installs an Istiod deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-Before installing, ensure CRDs are installed in the cluster (from the `istio/base` chart).
-
-To install the chart with the release name `istiod`:
-
-```console
-kubectl create namespace istio-system
-helm install istiod istio/istiod --namespace istio-system
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istiod` deployment:
-
-```console
-helm delete istiod --namespace istio-system
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istiod
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Examples
-
-#### Configuring mesh configuration settings
-
-Any [Mesh Config](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/) options can be configured like below:
-
-```yaml
-meshConfig:
-  accessLogFile: /dev/stdout
-```
-
-#### Revisions
-
-Control plane revisions allow deploying multiple versions of the control plane in the same cluster.
-This allows safe [canary upgrades](https://istio.io/latest/docs/setup/upgrade/canary/)
-
-```yaml
-revision: my-revision-name
-```
diff --git a/resources/v1.25.2/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.25.2/charts/istiod/files/gateway-injection-template.yaml
deleted file mode 100644
index dbd83cc57..000000000
--- a/resources/v1.25.2/charts/istiod/files/gateway-injection-template.yaml
+++ /dev/null
@@ -1,253 +0,0 @@
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations:
-    istio.io/rev: {{ .Revision | default "default" | quote }}
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- end }}
-spec:
-  securityContext:
-  {{- if .Values.gateways.securityContext }}
-    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
-  {{- else }}
-    sysctls:
-    - name: net.ipv4.ip_unprivileged_port_start
-      value: "0"
-  {{- end }}
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - router
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- end }}
-    securityContext:
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-    env:
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-  volumes:
-  - emptyDir: {}
-    name: workload-socket
-  - emptyDir: {}
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else}}
-  - emptyDir: {}
-    name: workload-certs
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.2/charts/istiod/files/grpc-agent.yaml b/resources/v1.25.2/charts/istiod/files/grpc-agent.yaml
deleted file mode 100644
index 7290fcdca..000000000
--- a/resources/v1.25.2/charts/istiod/files/grpc-agent.yaml
+++ /dev/null
@@ -1,310 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-    sidecar.istio.io/rewriteAppHTTPProbers: "false",
-  }
-spec:
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15020
-      protocol: TCP
-      name: mesh-metrics
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-          - --url=http://localhost:15020/healthz/ready
-    env:
-    - name: ISTIO_META_GENERATOR
-      value: grpc
-    - name: OUTPUT_CERTS
-      value: /var/lib/istio/data
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    # grpc uses xds:/// to resolve – no need to resolve VIP
-    - name: ISTIO_META_DNS_CAPTURE
-      value: "false"
-    - name: DISABLE_ENVOY
-      value: "true"
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15020
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # UDS channel between istioagent and gRPC client for XDS/SDS
-    - mountPath: /etc/istio/proxy
-      name: istio-xds
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-{{- range $index, $container := .Spec.Containers  }}
-{{ if not (eq $container.Name "istio-proxy") }}
-  - name: {{ $container.Name }}
-    env:
-      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
-        value: "true"
-      - name: "GRPC_XDS_BOOTSTRAP"
-        value: "/etc/istio/proxy/grpc-bootstrap.json"
-    volumeMounts:
-      - mountPath: /var/lib/istio/data
-        name: istio-data
-      # UDS channel between istioagent and gRPC client for XDS/SDS
-      - mountPath: /etc/istio/proxy
-        name: istio-xds
-      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-        readOnly: true
-      {{- else }}
-      - name: workload-certs
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-      {{- end }}
-{{- end }}
-{{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-xds
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.2/charts/istiod/files/grpc-simple.yaml b/resources/v1.25.2/charts/istiod/files/grpc-simple.yaml
deleted file mode 100644
index 9ba0c7a46..000000000
--- a/resources/v1.25.2/charts/istiod/files/grpc-simple.yaml
+++ /dev/null
@@ -1,65 +0,0 @@
-metadata:
-  annotations:
-    sidecar.istio.io/rewriteAppHTTPProbers: "false"
-spec:
-  initContainers:
-    - name: grpc-bootstrap-init
-      image: busybox:1.28
-      volumeMounts:
-        - mountPath: /var/lib/grpc/data/
-          name: grpc-io-proxyless-bootstrap
-      env:
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: ISTIO_NAMESPACE
-          value: |
-             {{ .Values.global.istioNamespace }}
-      command:
-        - sh
-        - "-c"
-        - |-
-          NODE_ID="sidecar~${INSTANCE_IP}~${POD_NAME}.${POD_NAMESPACE}~cluster.local"
-          SERVER_URI="dns:///istiod.${ISTIO_NAMESPACE}.svc:15010"
-          echo '
-          {
-            "xds_servers": [
-              {
-                "server_uri": "'${SERVER_URI}'",
-                "channel_creds": [{"type": "insecure"}],
-                "server_features" : ["xds_v3"]
-              }
-            ],
-            "node": {
-              "id": "'${NODE_ID}'",
-              "metadata": {
-                "GENERATOR": "grpc"
-              }
-            }
-          }' > /var/lib/grpc/data/bootstrap.json
-  containers:
-  {{- range $index, $container := .Spec.Containers }}
-  - name: {{ $container.Name }}
-    env:
-      - name: GRPC_XDS_BOOTSTRAP
-        value: /var/lib/grpc/data/bootstrap.json
-      - name: GRPC_GO_LOG_VERBOSITY_LEVEL
-        value: "99"
-      - name: GRPC_GO_LOG_SEVERITY_LEVEL
-        value: info
-    volumeMounts:
-      - mountPath: /var/lib/grpc/data/
-        name: grpc-io-proxyless-bootstrap
-  {{- end }}
-  volumes:
-    - name: grpc-io-proxyless-bootstrap
-      emptyDir: {}
diff --git a/resources/v1.25.2/charts/istiod/files/injection-template.yaml b/resources/v1.25.2/charts/istiod/files/injection-template.yaml
deleted file mode 100644
index 3b3f69cd9..000000000
--- a/resources/v1.25.2/charts/istiod/files/injection-template.yaml
+++ /dev/null
@@ -1,515 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
-    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
-    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
-    {{- end }}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-{{- if .Values.pilot.cni.enabled }}
-    {{- if eq .Values.pilot.cni.provider "multus" }}
-    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
-    {{- end }}
-    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
-    traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}",
-    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
-    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
-    {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
-    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
-    {{- end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}istio.io/reroute-virtual-interfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
-{{- end }}
-  }
-spec:
-  {{- $holdProxy := and
-      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
-      (not $nativeSidecar) }}
-  initContainers:
-  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
-  {{ if .Values.pilot.cni.enabled -}}
-  - name: istio-validation
-  {{ else -}}
-  - name: istio-init
-  {{ end -}}
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    args:
-    - istio-iptables
-    - "-p"
-    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
-    - "-z"
-    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
-    - "-u"
-    - {{ .ProxyUID | default "1337" | quote }}
-    - "-m"
-    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
-    - "-i"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
-    - "-x"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
-    - "-b"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
-    - "-d"
-  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
-    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
-  {{- else }}
-    - "15090,15021"
-  {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
-    - "-q"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
-    {{ end -}}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
-    - "-o"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}"
-    {{ end -}}
-     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
-    - "-c"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
-    {{ end -}}
-    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
-    {{ if .Values.global.logAsJson -}}
-    - "--log_as_json"
-    {{ end -}}
-    {{ if .Values.pilot.cni.enabled -}}
-    - "--run-validation"
-    - "--skip-rule-apply"
-    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
-    - "--force-apply"
-    {{ end -}}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-  {{- if .ProxyConfig.ProxyMetadata }}
-    env:
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-  {{- end }}
-    resources:
-  {{ template "resources" . }}
-    securityContext:
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      privileged: {{ .Values.global.proxy.privileged }}
-      capabilities:
-    {{- if not .Values.pilot.cni.enabled }}
-        add:
-        - NET_ADMIN
-        - NET_RAW
-    {{- end }}
-        drop:
-        - ALL
-    {{- if not .Values.pilot.cni.enabled }}
-      readOnlyRootFilesystem: false
-      runAsGroup: 0
-      runAsNonRoot: false
-      runAsUser: 0
-    {{- else }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsNonRoot: true
-    {{- end }}
-  {{ end -}}
-  {{ if not $nativeSidecar }}
-  containers:
-  {{ end }}
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.outlierLogPath }}
-    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-  {{- end}}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- else if $holdProxy }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-  {{- else if $nativeSidecar }}
-    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
-    lifecycle:
-      preStop:
-        exec:
-          command:
-          - pilot-agent
-          - request
-          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
-          - POST
-          - drain
-  {{- end }}
-    env:
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- with (index .ObjectMeta.Labels `service.istio.io/workload-name` | default .DeploymentMeta.Name) }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ . }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - name: ISTIO_BOOTSTRAP_OVERRIDE
-      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
-    {{- end }}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-  {{ if .Values.global.proxy.startupProbe.enabled }}
-    startupProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: 0
-      periodSeconds: 1
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
-  {{ end }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    {{ end -}}
-    securityContext:
-      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
-      allowPrivilegeEscalation: true
-      capabilities:
-        add:
-        - NET_ADMIN
-        drop:
-        - ALL
-      privileged: true
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else }}
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      capabilities:
-        {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-        add:
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
-        - NET_ADMIN
-        {{- end }}
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
-        - NET_BIND_SERVICE
-        {{- end }}
-        {{- end }}
-        drop:
-        - ALL
-      privileged: {{ .Values.global.proxy.privileged }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else -}}
-      runAsNonRoot: true
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      {{- end }}
-      {{- end }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - mountPath: /etc/istio/custom-bootstrap
-      name: custom-bootstrap-volume
-    {{- end }}
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
-      name: lightstep-certs
-      readOnly: true
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  - emptyDir:
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-  - name: lightstep-certs
-    secret:
-      optional: true
-      secretName: lightstep.cacert
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.2/charts/istiod/files/kube-gateway.yaml b/resources/v1.25.2/charts/istiod/files/kube-gateway.yaml
deleted file mode 100644
index dbe158de1..000000000
--- a/resources/v1.25.2/charts/istiod/files/kube-gateway.yaml
+++ /dev/null
@@ -1,345 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-gateway-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": {{.Name}}
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-gateway-controller"
-          ) | nindent 8 }}
-    spec:
-      securityContext:
-      {{- if .Values.gateways.securityContext }}
-        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
-      {{- else }}
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- if .Values.gateways.seccompProfile }}
-        seccompProfile:
-      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
-      {{- end }}
-      {{- end }}
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-      {{- else }}
-        image: "{{ .ProxyImage }}"
-      {{- end }}
-        {{- if .Values.global.proxy.resources }}
-        resources:
-          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsUser: {{ .ProxyUID | default "1337" }}
-          runAsGroup: {{ .ProxyGID | default "1337" }}
-          runAsNonRoot: true
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        args:
-        - proxy
-        - router
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-      {{- if .Values.global.sts.servicePort }}
-        - --stsPort={{ .Values.global.sts.servicePort }}
-      {{- end }}
-      {{- if .Values.global.logAsJson }}
-        - --log_as_json
-      {{- end }}
-      {{- if .Values.global.proxy.lifecycle }}
-        lifecycle:
-          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
-      {{- end }}
-        env:
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        - name: ISTIO_META_POD_PORTS
-          value: "[]"
-        - name: ISTIO_META_APP_CONTAINERS
-          value: ""
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: "{{ .ProxyConfig.InterceptionMode.String }}"
-        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
-        - name: ISTIO_META_NETWORK
-          value: {{.|quote}}
-        {{- end }}
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName|quote}}
-        - name: ISTIO_META_OWNER
-          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
-        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-          value: {{.|quote}}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        volumeMounts:
-        - name: workload-socket
-          mountPath: /var/run/secrets/workload-spiffe-uds
-        - name: credential-socket
-          mountPath: /var/run/secrets/credential-uds
-        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-        - name: gke-workload-certificate
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-          readOnly: true
-        {{- else }}
-        - name: workload-certs
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-        {{- end }}
-        {{- if eq .Values.global.pilotCertProvider "istiod" }}
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        {{- end }}
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        # SDS channel between istioagent and Envoy
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - name: istio-podinfo
-          mountPath: /etc/istio/pod
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir: {}
-        name: credential-socket
-      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        csi:
-          driver: workloadcertificates.security.cloud.google.com
-      {{- else}}
-      - emptyDir: {}
-        name: workload-certs
-      {{- end }}
-      # SDS channel between istioagent and Envoy
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - name: istio-data
-        emptyDir: {}
-      - name: istio-podinfo
-        downwardAPI:
-          items:
-            - path: "labels"
-              fieldRef:
-                fieldPath: metadata.labels
-            - path: "annotations"
-              fieldRef:
-                fieldPath: metadata.annotations
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: {{ .Values.global.sds.token.aud }}
-      {{- if eq .Values.global.pilotCertProvider "istiod" }}
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: {{.UID}}
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": {{.Name}}
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.25.2/charts/istiod/files/profile-ambient.yaml b/resources/v1.25.2/charts/istiod/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.2/charts/istiod/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.2/charts/istiod/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.2/charts/istiod/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.2/charts/istiod/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/istiod/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.2/charts/istiod/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.2/charts/istiod/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/istiod/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.2/charts/istiod/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.2/charts/istiod/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/istiod/files/profile-platform-gke.yaml b/resources/v1.25.2/charts/istiod/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.2/charts/istiod/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.2/charts/istiod/files/profile-platform-k3d.yaml b/resources/v1.25.2/charts/istiod/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.2/charts/istiod/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.2/charts/istiod/files/profile-platform-microk8s.yaml b/resources/v1.25.2/charts/istiod/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.2/charts/istiod/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.2/charts/istiod/files/profile-platform-minikube.yaml b/resources/v1.25.2/charts/istiod/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.2/charts/istiod/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.2/charts/istiod/files/profile-platform-openshift.yaml b/resources/v1.25.2/charts/istiod/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.2/charts/istiod/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.2/charts/istiod/files/profile-preview.yaml b/resources/v1.25.2/charts/istiod/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.2/charts/istiod/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.2/charts/istiod/files/profile-remote.yaml b/resources/v1.25.2/charts/istiod/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.2/charts/istiod/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.2/charts/istiod/files/profile-stable.yaml b/resources/v1.25.2/charts/istiod/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.2/charts/istiod/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.2/charts/istiod/files/waypoint.yaml b/resources/v1.25.2/charts/istiod/files/waypoint.yaml
deleted file mode 100644
index 2600e98e2..000000000
--- a/resources/v1.25.2/charts/istiod/files/waypoint.yaml
+++ /dev/null
@@ -1,340 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-mesh-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": "{{.Name}}"
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "istio.io/dataplane-mode" "none"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-mesh-controller"
-          ) | nindent 8}}
-    spec:
-      {{- if .Values.global.waypoint.affinity }}
-      affinity:
-      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.topologySpreadConstraints }}
-      topologySpreadConstraints:
-      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.nodeSelector }}
-      nodeSelector:
-      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.tolerations }}
-      tolerations:
-      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: 2
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-        {{- else }}
-        image: "{{ .ProxyImage }}"
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        args:
-        - proxy
-        - waypoint
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --serviceCluster
-        - {{.ServiceAccount}}.$(POD_NAMESPACE)
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-        {{- if .Values.global.logAsJson }}
-        - --log_as_json
-        {{- end }}
-        {{- if .Values.global.proxy.outlierLogPath }}
-        - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-        {{- end}}
-        env:
-        - name: ISTIO_META_SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        {{- if .ProxyConfig.ProxyMetadata }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
-        {{- if $network }}
-        - name: ISTIO_META_NETWORK
-          value: "{{ $network }}"
-        {{- end }}
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: REDIRECT
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName}}
-        - name: ISTIO_META_OWNER
-          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- if .Values.global.waypoint.resources }}
-        resources:
-        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        securityContext:
-          privileged: false
-        {{- if not (eq .Values.global.platform "openshift") }}
-          runAsGroup: 1337
-          runAsUser: 1337
-        {{- end }}
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-            - ALL
-{{- if .Values.gateways.seccompProfile }}
-          seccompProfile:
-{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
-{{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/workload-spiffe-uds
-          name: workload-socket
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /etc/istio/pod
-          name: istio-podinfo
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - emptyDir:
-          medium: Memory
-        name: go-proxy-envoy
-      - emptyDir: {}
-        name: istio-data
-      - emptyDir: {}
-        name: go-proxy-data
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.labels
-            path: labels
-          - fieldRef:
-              fieldPath: metadata.annotations
-            path: annotations
-        name: istio-podinfo
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              audience: istio-ca
-              expirationSeconds: 43200
-              path: istio-token
-      - configMap:
-          name: istio-ca-root-cert
-        name: istiod-ca-cert
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap
-      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
-      (omit .InfrastructureAnnotations
-        "kubectl.kubernetes.io/last-applied-configuration"
-        "gateway.istio.io/name-override"
-        "gateway.istio.io/service-account"
-        "gateway.istio.io/controller-version"
-      ) | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": "{{.Name}}"
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.25.2/charts/istiod/templates/NOTES.txt b/resources/v1.25.2/charts/istiod/templates/NOTES.txt
deleted file mode 100644
index 0d07ea7f4..000000000
--- a/resources/v1.25.2/charts/istiod/templates/NOTES.txt
+++ /dev/null
@@ -1,82 +0,0 @@
-"istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
-
-Next steps:
-{{- $profile := default "" .Values.profile }}
-{{- if (eq $profile "ambient") }}
-  * Get started with ambient: https://istio.io/latest/docs/ops/ambient/getting-started/
-  * Review ambient's architecture: https://istio.io/latest/docs/ops/ambient/architecture/
-{{- else }}
-  * Deploy a Gateway: https://istio.io/latest/docs/setup/additional-setup/gateway/
-  * Try out our tasks to get started on common configurations:
-    * https://istio.io/latest/docs/tasks/traffic-management
-    * https://istio.io/latest/docs/tasks/security/
-    * https://istio.io/latest/docs/tasks/policy-enforcement/
-{{- end }}
-  * Review the list of actively supported releases, CVE publications and our hardening guide:
-    * https://istio.io/latest/docs/releases/supported-releases/
-    * https://istio.io/latest/news/security/
-    * https://istio.io/latest/docs/ops/best-practices/security/
-
-For further documentation see https://istio.io website
-
-{{-
-  $deps := dict
-    "global.outboundTrafficPolicy" "meshConfig.outboundTrafficPolicy"
-    "global.certificates" "meshConfig.certificates"
-    "global.localityLbSetting" "meshConfig.localityLbSetting"
-    "global.policyCheckFailOpen" "meshConfig.policyCheckFailOpen"
-    "global.enableTracing" "meshConfig.enableTracing"
-    "global.proxy.accessLogFormat" "meshConfig.accessLogFormat"
-    "global.proxy.accessLogFile" "meshConfig.accessLogFile"
-    "global.proxy.concurrency" "meshConfig.defaultConfig.concurrency"
-    "global.proxy.envoyAccessLogService" "meshConfig.defaultConfig.envoyAccessLogService"
-    "global.proxy.envoyAccessLogService.enabled" "meshConfig.enableEnvoyAccessLogService"
-    "global.proxy.envoyMetricsService" "meshConfig.defaultConfig.envoyMetricsService"
-    "global.proxy.protocolDetectionTimeout" "meshConfig.protocolDetectionTimeout"
-    "global.proxy.holdApplicationUntilProxyStarts" "meshConfig.defaultConfig.holdApplicationUntilProxyStarts"
-    "pilot.ingress" "meshConfig.ingressService, meshConfig.ingressControllerMode, and meshConfig.ingressClass"
-    "global.mtls.enabled" "the PeerAuthentication resource"
-    "global.mtls.auto" "meshConfig.enableAutoMtls"
-    "global.tracer.lightstep.address" "meshConfig.defaultConfig.tracing.lightstep.address"
-    "global.tracer.lightstep.accessToken" "meshConfig.defaultConfig.tracing.lightstep.accessToken"
-    "global.tracer.zipkin.address" "meshConfig.defaultConfig.tracing.zipkin.address"
-    "global.tracer.datadog.address" "meshConfig.defaultConfig.tracing.datadog.address"
-    "global.meshExpansion.enabled" "Gateway and other Istio networking resources, such as in samples/multicluster/"
-    "istiocoredns.enabled" "the in-proxy DNS capturing (ISTIO_META_DNS_CAPTURE)"
-}}
-{{- range $dep, $replace := $deps }}
-{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
-{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
-{{- if not (eq $res "")}}
-WARNING: {{$dep|quote}} is deprecated; use {{$replace|quote}} instead.
-{{- end }}
-{{- end }}
-{{-
-  $failDeps := dict
-    "telemetry.v2.prometheus.configOverride"
-    "telemetry.v2.stackdriver.configOverride"
-    "telemetry.v2.stackdriver.disableOutbound"
-    "telemetry.v2.stackdriver.outboundAccessLogging"
-    "global.tracer.stackdriver.debug" "meshConfig.defaultConfig.tracing.stackdriver.debug"
-    "global.tracer.stackdriver.maxNumberOfAttributes" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes"
-    "global.tracer.stackdriver.maxNumberOfAnnotations" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations"
-    "global.tracer.stackdriver.maxNumberOfMessageEvents" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents"
-    "meshConfig.defaultConfig.tracing.stackdriver.debug" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents" "Istio supported tracers"
-}}
-{{- range $dep, $replace := $failDeps }}
-{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
-{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
-{{- if not (eq $res "")}}
-{{fail (print $dep " is removed")}}
-{{- end }}
-{{- end }}
-{{- if eq $.Values.global.pilotCertProvider "kubernetes" }}
-{{- fail "pilotCertProvider=kubernetes is not supported" }}
-{{- end }}
\ No newline at end of file
diff --git a/resources/v1.25.2/charts/istiod/templates/_helpers.tpl b/resources/v1.25.2/charts/istiod/templates/_helpers.tpl
deleted file mode 100644
index 042c92538..000000000
--- a/resources/v1.25.2/charts/istiod/templates/_helpers.tpl
+++ /dev/null
@@ -1,23 +0,0 @@
-{{/* Default Prometheus is enabled if its enabled and there are no config overrides set */}}
-{{ define "default-prometheus" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.prometheus.enabled
-}}
-{{- end }}
-
-{{/* SD has metrics and logging split. Default metrics are enabled if SD is enabled */}}
-{{ define "default-sd-metrics" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
-}}
-{{- end }}
-
-{{/* SD has metrics and logging split. */}}
-{{ define "default-sd-logs" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
-}}
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/autoscale.yaml b/resources/v1.25.2/charts/istiod/templates/autoscale.yaml
deleted file mode 100644
index 09cd6258c..000000000
--- a/resources/v1.25.2/charts/istiod/templates/autoscale.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if and .Values.autoscaleEnabled .Values.autoscaleMin .Values.autoscaleMax }}
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  maxReplicas: {{ .Values.autoscaleMax }}
-  minReplicas: {{ .Values.autoscaleMin }}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  metrics:
-  - type: Resource
-    resource:
-      name: cpu
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.cpu.targetAverageUtilization }}
-  {{- if .Values.memory.targetAverageUtilization }}
-  - type: Resource
-    resource:
-      name: memory
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.memory.targetAverageUtilization }}
-  {{- end }}
-  {{- if .Values.autoscaleBehavior }}
-  behavior: {{ toYaml .Values.autoscaleBehavior | nindent 4 }}
-  {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/clusterrole.yaml b/resources/v1.25.2/charts/istiod/templates/clusterrole.yaml
deleted file mode 100644
index 0c340b5b3..000000000
--- a/resources/v1.25.2/charts/istiod/templates/clusterrole.yaml
+++ /dev/null
@@ -1,187 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  # sidecar injection controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-
-  # configuration validation webhook controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-
-  # istio configuration
-  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
-  # please proceed with caution
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["get", "watch", "list"]
-    resources: ["*"]
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["update", "patch"]
-    resources:
-    - authorizationpolicies/status
-    - destinationrules/status
-    - envoyfilters/status
-    - gateways/status
-    - peerauthentications/status
-    - proxyconfigs/status
-    - requestauthentications/status
-    - serviceentries/status
-    - sidecars/status
-    - telemetries/status
-    - virtualservices/status
-    - wasmplugins/status
-    - workloadentries/status
-    - workloadgroups/status
-{{- end }}
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries/status",  "serviceentries/status" ]
-  - apiGroups: ["security.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "authorizationpolicies/status" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services/status" ]
-
-  # auto-detect installed CRD definitions
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-
-  # discovery and routing
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-
-{{- if .Values.taint.enabled }}
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["patch"]
-{{- end }}
-
-  # ingress controller
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-{{- end}}
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses", "ingressclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-
-  # required for CA's namespace controller
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-
-  # Istiod and bootstrap.
-{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
-{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "certificatesigningrequests"
-      - "certificatesigningrequests/approval"
-      - "certificatesigningrequests/status"
-    verbs: ["update", "create", "get", "delete", "watch"]
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "signers"
-    resourceNames:
-{{- range .Values.global.certSigners }}
-    - {{ . | quote }}
-{{- end }}
-    verbs: ["approve"]
-{{- end}}
-
-  # Used by Istiod to verify the JWT tokens
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-
-  # Used by Istiod to verify gateway SDS
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-
-  # Use for Kubernetes Service APIs
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources:
-    - backendtlspolicies/status
-    - gatewayclasses/status
-    - gateways/status
-    - grpcroutes/status
-    - httproutes/status
-    - referencegrants/status
-    - tcproutes/status
-    - tlsroutes/status
-    - udproutes/status
-    verbs: ["update", "patch"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["gatewayclasses"]
-    verbs: ["create", "update", "patch", "delete"]
-
-  # Needed for multicluster secret reading, possibly ingress certs in the future
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "watch", "list"]
-
-  # Used for MCS serviceexport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: [ "get", "watch", "list", "create", "delete"]
-
-  # Used for MCS serviceimport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "watch", "list"]
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: ["apps"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "deployments" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "serviceaccounts"]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.25.2/charts/istiod/templates/clusterrolebinding.yaml
deleted file mode 100644
index 10781b407..000000000
--- a/resources/v1.25.2/charts/istiod/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-- kind: ServiceAccount
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.25.2/charts/istiod/templates/configmap-jwks.yaml
deleted file mode 100644
index 3505d2822..000000000
--- a/resources/v1.25.2/charts/istiod/templates/configmap-jwks.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.jwksResolverExtraRootCA }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  extra.pem: {{ .Values.jwksResolverExtraRootCA | quote }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/configmap-values.yaml b/resources/v1.25.2/charts/istiod/templates/configmap-values.yaml
deleted file mode 100644
index a7e60369d..000000000
--- a/resources/v1.25.2/charts/istiod/templates/configmap-values.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  original-values: |-
-{{ .Values._original | toPrettyJson | indent 4 }}
-{{- $_ := unset $.Values "_original" }}
-  merged-values: |-
-{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.25.2/charts/istiod/templates/deployment.yaml b/resources/v1.25.2/charts/istiod/templates/deployment.yaml
deleted file mode 100644
index 5380805e9..000000000
--- a/resources/v1.25.2/charts/istiod/templates/deployment.yaml
+++ /dev/null
@@ -1,291 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- range $key, $val := .Values.deploymentLabels }}
-    {{ $key }}: "{{ $val }}"
-{{- end }}
-spec:
-{{- if not .Values.autoscaleEnabled }}
-{{- if .Values.replicaCount }}
-  replicas: {{ .Values.replicaCount }}
-{{- end }}
-{{- end }}
-  strategy:
-    rollingUpdate:
-      maxSurge: {{ .Values.rollingMaxSurge }}
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  selector:
-    matchLabels:
-      {{- if ne .Values.revision "" }}
-      app: istiod
-      istio.io/rev: {{ .Values.revision | default "default" | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
-  template:
-    metadata:
-      labels:
-        app: istiod
-        istio.io/rev: {{ .Values.revision | default "default" | quote }}
-        sidecar.istio.io/inject: "false"
-        operator.istio.io/component: "Pilot"
-        {{- if ne .Values.revision "" }}
-        istio: istiod
-        {{- else }}
-        istio: pilot
-        {{- end }}
-        {{- range $key, $val := .Values.podLabels }}
-        {{ $key }}: "{{ $val }}"
-        {{- end }}
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: "istiod"
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        prometheus.io/port: "15014"
-        prometheus.io/scrape: "true"
-        sidecar.istio.io/inject: "false"
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{- if .Values.nodeSelector }}
-      nodeSelector:
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- with .Values.affinity }}
-      affinity:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      tolerations:
-        - key: cni.istio.io/not-ready
-          operator: "Exists"
-{{- with .Values.tolerations }}
-{{- toYaml . | nindent 8 }}
-{{- end }}
-{{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- if .Values.global.priorityClassName }}
-      priorityClassName: "{{ .Values.global.priorityClassName }}"
-{{- end }}
-{{- with .Values.initContainers }}
-      initContainers:
-        {{- tpl (toYaml .) $ | nindent 8 }}
-{{- end }}
-      containers:
-        - name: discovery
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
-{{- end }}
-{{- if .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
-{{- end }}
-          args:
-          - "discovery"
-          - --monitoringAddr=:15014
-{{- if .Values.global.logging.level }}
-          - --log_output_level={{ .Values.global.logging.level }}
-{{- end}}
-{{- if .Values.global.logAsJson }}
-          - --log_as_json
-{{- end }}
-          - --domain
-          - {{ .Values.global.proxy.clusterDomain }}
-{{- if .Values.taint.namespace }}
-          - --cniNamespace={{ .Values.taint.namespace }}
-{{- end }}
-          - --keepaliveMaxServerConnectionAge
-          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
-{{- if .Values.extraContainerArgs }}
-          {{- with .Values.extraContainerArgs }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-{{- end }}
-          ports:
-          - containerPort: 8080
-            protocol: TCP
-            name: http-debug
-          - containerPort: 15010
-            protocol: TCP
-            name: grpc-xds
-          - containerPort: 15012
-            protocol: TCP
-            name: tls-xds
-          - containerPort: 15017
-            protocol: TCP
-            name: https-webhooks
-          - containerPort: 15014
-            protocol: TCP
-            name: http-monitoring
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 8080
-            initialDelaySeconds: 1
-            periodSeconds: 3
-            timeoutSeconds: 5
-          env:
-          - name: REVISION
-            value: "{{ .Values.revision | default `default` }}"
-          - name: PILOT_CERT_PROVIDER
-            value: {{ .Values.global.pilotCertProvider }}
-          - name: POD_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.name
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.namespace
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: spec.serviceAccountName
-          - name: KUBECONFIG
-            value: /var/run/secrets/remote/config
-          # If you explicitly told us where ztunnel lives, use that.
-          # Otherwise, assume it lives in our namespace
-          # Also, check for an explicit ENV override (legacy approach) and prefer that
-          # if present
-          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
-          {{ $ztTrustedName := or .Values.trustedZtunnelName "ztunnel" }}
-          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
-          - name: CA_TRUSTED_NODE_ACCOUNTS
-            value: "{{ $ztTrustedNS }}/{{ $ztTrustedName }}"
-          {{- end }}
-          {{- if .Values.env }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: "{{ $val }}"
-          {{- end }}
-          {{- end }}
-{{- if .Values.traceSampling }}
-          - name: PILOT_TRACE_SAMPLING
-            value: "{{ .Values.traceSampling }}"
-{{- end }}
-# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
-# don't set it here to avoid duplication.
-# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
-{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
-          - name: EXTERNAL_ISTIOD
-            value: "{{ .Values.global.externalIstiod }}"
-{{- end }}
-          - name: PILOT_ENABLE_ANALYSIS
-            value: "{{ .Values.global.istiod.enableAnalysis }}"
-          - name: CLUSTER_ID
-            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
-          - name: GOMEMLIMIT
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.memory
-          - name: GOMAXPROCS
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.cpu
-                divisor: "1"
-          - name: PLATFORM
-            value: "{{ coalesce .Values.global.platform .Values.platform }}"
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-              - ALL
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          volumeMounts:
-          - name: istio-token
-            mountPath: /var/run/secrets/tokens
-            readOnly: true
-          - name: local-certs
-            mountPath: /var/run/secrets/istio-dns
-          - name: cacerts
-            mountPath: /etc/cacerts
-            readOnly: true
-          - name: istio-kubeconfig
-            mountPath: /var/run/secrets/remote
-            readOnly: true
-          {{- if .Values.jwksResolverExtraRootCA }}
-          - name: extracacerts
-            mountPath: /cacerts
-          {{- end }}
-          - name: istio-csr-dns-cert
-            mountPath: /var/run/secrets/istiod/tls
-            readOnly: true
-          - name: istio-csr-ca-configmap
-            mountPath: /var/run/secrets/istiod/ca
-            readOnly: true
-          {{- with .Values.volumeMounts }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-      volumes:
-      # Technically not needed on this pod - but it helps debugging/testing SDS
-      # Should be removed after everything works.
-      - emptyDir:
-          medium: Memory
-        name: local-certs
-      - name: istio-token
-        projected:
-          sources:
-            - serviceAccountToken:
-                audience: {{ .Values.global.sds.token.aud }}
-                expirationSeconds: 43200
-                path: istio-token
-      # Optional: user-generated root
-      - name: cacerts
-        secret:
-          secretName: cacerts
-          optional: true
-      - name: istio-kubeconfig
-        secret:
-          secretName: istio-kubeconfig
-          optional: true
-      # Optional: istio-csr dns pilot certs
-      - name: istio-csr-dns-cert
-        secret:
-          secretName: istiod-tls
-          optional: true
-      - name: istio-csr-ca-configmap
-        configMap:
-          name: istio-ca-root-cert
-          defaultMode: 420
-          optional: true
-  {{- if .Values.jwksResolverExtraRootCA }}
-      - name: extracacerts
-        configMap:
-          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  {{- end }}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
-
----
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.25.2/charts/istiod/templates/istiod-injector-configmap.yaml
deleted file mode 100644
index 560c284ff..000000000
--- a/resources/v1.25.2/charts/istiod/templates/istiod-injector-configmap.yaml
+++ /dev/null
@@ -1,81 +0,0 @@
-{{- if not .Values.global.omitSidecarInjectorConfigMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
-  values: |-
-{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
-{{ $pilotVals := pick .Values "cni" -}}
-{{ $vals = set $vals "pilot" $pilotVals -}}
-{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
-{{ $vals = set $vals "gateways" $gatewayVals -}}
-{{ $vals | toPrettyJson | indent 4 }}
-
-  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
-  # and istiod webhook functionality.
-  #
-  # New fields should not use Values - it is a 'primary' config object, users should be able
-  # to fine tune it or use it with kube-inject.
-  config: |-
-    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
-    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
-    defaultTemplates:
-{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
-    - {{ . }}
-{{- end }}
-    {{- else }}
-    defaultTemplates: [sidecar]
-    {{- end }}
-    policy: {{ .Values.global.proxy.autoInject }}
-    alwaysInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
-    neverInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
-    injectedAnnotations:
-      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
-      "{{ $key }}": {{ $val | quote }}
-      {{- end }}
-    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
-         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
-         This should make it obvious that their installation is broken.
-     */}}
-    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
-    templates:
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
-      sidecar: |
-{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
-      gateway: |
-{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
-      grpc-simple: |
-{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
-      grpc-agent: |
-{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
-      waypoint: |
-{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
-      kube-gateway: |
-{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
-{{- end }}
-{{- with .Values.sidecarInjectorWebhook.templates }}
-{{ toYaml . | trim | indent 6 }}
-{{- end }}
-
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.25.2/charts/istiod/templates/mutatingwebhook.yaml
deleted file mode 100644
index 22160f70a..000000000
--- a/resources/v1.25.2/charts/istiod/templates/mutatingwebhook.yaml
+++ /dev/null
@@ -1,164 +0,0 @@
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- /* Core defines the common configuration used by all webhook segments */}}
-{{/* Copy just what we need to avoid expensive deepCopy */}}
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "caBundle" .Values.istiodRemote.injectionCABundle
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-    {{- if .caBundle }}
-    caBundle: "{{ .caBundle }}"
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  reinvocationPolicy: "{{ .reinvocationPolicy }}"
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
-{{- if not .Values.global.operatorManageWebhooks }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq .Release.Namespace "istio-system"}}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- else }}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
-
-{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
-{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-
-
-{{- /* Webhooks for default revision */}}
-{{- if (eq .Values.revision "") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.25.2/charts/istiod/templates/poddisruptionbudget.yaml
deleted file mode 100644
index 1eacf16e6..000000000
--- a/resources/v1.25.2/charts/istiod/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    istio: pilot
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app: istiod
-      {{- if ne .Values.revision "" }}
-      istio.io/rev: {{ .Values.revision | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.25.2/charts/istiod/templates/reader-clusterrole.yaml
deleted file mode 100644
index dbaa80503..000000000
--- a/resources/v1.25.2/charts/istiod/templates/reader-clusterrole.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - "config.istio.io"
-      - "security.istio.io"
-      - "networking.istio.io"
-      - "authentication.istio.io"
-      - "rbac.istio.io"
-      - "telemetry.istio.io"
-      - "extensions.istio.io"
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
-    resources: ["gateways"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: ["get", "list", "watch", "create", "delete"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["apps"]
-    resources: ["replicasets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-{{- if .Values.istiodRemote.enabled }}
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-{{- end}}
diff --git a/resources/v1.25.2/charts/istiod/templates/reader-clusterrolebinding.yaml b/resources/v1.25.2/charts/istiod/templates/reader-clusterrolebinding.yaml
deleted file mode 100644
index aea9f01f7..000000000
--- a/resources/v1.25.2/charts/istiod/templates/reader-clusterrolebinding.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istio-reader-service-account
-    namespace: {{ .Values.global.istioNamespace }}
diff --git a/resources/v1.25.2/charts/istiod/templates/remote-istiod-endpoints.yaml b/resources/v1.25.2/charts/istiod/templates/remote-istiod-endpoints.yaml
deleted file mode 100644
index a6de571da..000000000
--- a/resources/v1.25.2/charts/istiod/templates/remote-istiod-endpoints.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-# if the remotePilotAddress is an IP addr
-{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-subsets:
-- addresses:
-  - ip: {{ .Values.global.remotePilotAddress }}
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 15017
-    name: tcp-webhook
-    protocol: TCP
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/revision-tags.yaml b/resources/v1.25.2/charts/istiod/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.25.2/charts/istiod/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/role.yaml b/resources/v1.25.2/charts/istiod/templates/role.yaml
deleted file mode 100644
index 10d89e8d1..000000000
--- a/resources/v1.25.2/charts/istiod/templates/role.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-# permissions to verify the webhook is ready and rejecting
-# invalid config. We use --server-dry-run so no config is persisted.
-- apiGroups: ["networking.istio.io"]
-  verbs: ["create"]
-  resources: ["gateways"]
-
-# For storing CA secret
-- apiGroups: [""]
-  resources: ["secrets"]
-  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
-  verbs: ["create", "get", "watch", "list", "update", "delete"]
-
-# For status controller, so it can delete the distribution report configmap
-- apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["delete"]
-
-# For gateway deployment controller
-- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
-  verbs: ["get", "update", "patch", "create"]
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/rolebinding.yaml b/resources/v1.25.2/charts/istiod/templates/rolebinding.yaml
deleted file mode 100644
index a42f4ec44..000000000
--- a/resources/v1.25.2/charts/istiod/templates/rolebinding.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/service.yaml b/resources/v1.25.2/charts/istiod/templates/service.yaml
deleted file mode 100644
index 30d5b8912..000000000
--- a/resources/v1.25.2/charts/istiod/templates/service.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  {{- if .Values.serviceAnnotations }}
-  annotations:
-{{ toYaml .Values.serviceAnnotations | indent 4 }}
-  {{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: istiod
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-    - port: 15010
-      name: grpc-xds # plaintext
-      protocol: TCP
-    - port: 15012
-      name: https-dns # mTLS with k8s-signed cert
-      protocol: TCP
-    - port: 443
-      name: https-webhook # validation and injection
-      targetPort: 15017
-      protocol: TCP
-    - port: 15014
-      name: http-monitoring # prometheus stats
-      protocol: TCP
-  selector:
-    app: istiod
-    {{- if ne .Values.revision "" }}
-    istio.io/rev: {{ .Values.revision | quote }}
-    {{- else }}
-    # Label used by the 'default' service. For versioned deployments we match with app and version.
-    # This avoids default deployment picking the canary
-    istio: pilot
-    {{- end }}
-  {{- if .Values.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.ipFamilyPolicy }}
-  {{- end }}
-  {{- if .Values.ipFamilies }}
-  ipFamilies:
-  {{- range .Values.ipFamilies }}
-  - {{ . }}
-  {{- end }}
-  {{- end }}
----
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/serviceaccount.yaml b/resources/v1.25.2/charts/istiod/templates/serviceaccount.yaml
deleted file mode 100644
index a673a4d07..000000000
--- a/resources/v1.25.2/charts/istiod/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-  {{- if .Values.serviceAccountAnnotations }}
-  annotations:
-{{- toYaml .Values.serviceAccountAnnotations | nindent 4 }}
-  {{- end }}
-{{- end }}
----
diff --git a/resources/v1.25.2/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.25.2/charts/istiod/templates/validatingadmissionpolicy.yaml
deleted file mode 100644
index d36eef68e..000000000
--- a/resources/v1.25.2/charts/istiod/templates/validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.experimental.stableValidationPolicy }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-policy-binding{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-spec:
-  policyName: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  validationActions: [Deny]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.25.2/charts/istiod/templates/validatingwebhookconfiguration.yaml
deleted file mode 100644
index fb28836a0..000000000
--- a/resources/v1.25.2/charts/istiod/templates/validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,68 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.global.configValidation }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  # Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
-  # are rejecting invalid configs on a per-revision basis.
-  - name: rev.validation.istio.io
-    clientConfig:
-      # Should change from base but cannot for API compat
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/istiod/templates/zzy_descope_legacy.yaml b/resources/v1.25.2/charts/istiod/templates/zzy_descope_legacy.yaml
deleted file mode 100644
index ae8fced29..000000000
--- a/resources/v1.25.2/charts/istiod/templates/zzy_descope_legacy.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-{{/* Copy anything under `.pilot` to `.`, to avoid the need to specify a redundant prefix.
-Due to the file naming, this always happens after zzz_profile.yaml */}}
-{{- $_ := mustMergeOverwrite $.Values (index $.Values "pilot") }}
\ No newline at end of file
diff --git a/resources/v1.25.2/charts/istiod/values.yaml b/resources/v1.25.2/charts/istiod/values.yaml
deleted file mode 100644
index 749d384bf..000000000
--- a/resources/v1.25.2/charts/istiod/values.yaml
+++ /dev/null
@@ -1,541 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-  # Set this if you install ztunnel with a name different from the default.
-  trustedZtunnelName: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.25.2
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.25.2/charts/revisiontags/Chart.yaml b/resources/v1.25.2/charts/revisiontags/Chart.yaml
deleted file mode 100644
index 9bb182e5f..000000000
--- a/resources/v1.25.2/charts/revisiontags/Chart.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.2
-description: Helm chart for istio revision tags
-name: revisiontags
-sources:
-- https://github.com/istio-ecosystem/sail-operator
-version: 0.1.0
-
diff --git a/resources/v1.25.2/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.25.2/charts/revisiontags/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.2/charts/revisiontags/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.2/charts/revisiontags/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.2/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.2/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/revisiontags/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.2/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.2/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/revisiontags/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.2/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.2/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/revisiontags/files/profile-platform-gke.yaml b/resources/v1.25.2/charts/revisiontags/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.2/charts/revisiontags/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.2/charts/revisiontags/files/profile-platform-k3d.yaml b/resources/v1.25.2/charts/revisiontags/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.2/charts/revisiontags/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.2/charts/revisiontags/files/profile-platform-microk8s.yaml b/resources/v1.25.2/charts/revisiontags/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.2/charts/revisiontags/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.2/charts/revisiontags/files/profile-platform-minikube.yaml b/resources/v1.25.2/charts/revisiontags/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.2/charts/revisiontags/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.2/charts/revisiontags/files/profile-platform-openshift.yaml b/resources/v1.25.2/charts/revisiontags/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.2/charts/revisiontags/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.2/charts/revisiontags/files/profile-preview.yaml b/resources/v1.25.2/charts/revisiontags/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.2/charts/revisiontags/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.2/charts/revisiontags/files/profile-remote.yaml b/resources/v1.25.2/charts/revisiontags/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.2/charts/revisiontags/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.2/charts/revisiontags/files/profile-stable.yaml b/resources/v1.25.2/charts/revisiontags/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.2/charts/revisiontags/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.2/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.25.2/charts/revisiontags/templates/revision-tags.yaml
deleted file mode 100644
index 325ef24ef..000000000
--- a/resources/v1.25.2/charts/revisiontags/templates/revision-tags.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.2/charts/revisiontags/values.yaml b/resources/v1.25.2/charts/revisiontags/values.yaml
deleted file mode 100644
index 749d384bf..000000000
--- a/resources/v1.25.2/charts/revisiontags/values.yaml
+++ /dev/null
@@ -1,541 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-  # Set this if you install ztunnel with a name different from the default.
-  trustedZtunnelName: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.25.2
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.25.2/charts/ztunnel/Chart.yaml b/resources/v1.25.2/charts/ztunnel/Chart.yaml
deleted file mode 100644
index 5dff978cd..000000000
--- a/resources/v1.25.2/charts/ztunnel/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.2
-description: Helm chart for istio ztunnel components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-ztunnel
-- istio
-name: ztunnel
-sources:
-- https://github.com/istio/istio
-version: 1.25.2
diff --git a/resources/v1.25.2/charts/ztunnel/README.md b/resources/v1.25.2/charts/ztunnel/README.md
deleted file mode 100644
index ffe0b94fe..000000000
--- a/resources/v1.25.2/charts/ztunnel/README.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# Istio Ztunnel Helm Chart
-
-This chart installs an Istio ztunnel.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart:
-
-```console
-helm install ztunnel istio/ztunnel
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the chart:
-
-```console
-helm delete ztunnel
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/ztunnel
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.25.2/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.25.2/charts/ztunnel/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.2/charts/ztunnel/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.2/charts/ztunnel/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.2/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.2/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/ztunnel/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.2/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.2/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/ztunnel/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.2/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.2/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.2/charts/ztunnel/files/profile-platform-gke.yaml b/resources/v1.25.2/charts/ztunnel/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.2/charts/ztunnel/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.2/charts/ztunnel/files/profile-platform-k3d.yaml b/resources/v1.25.2/charts/ztunnel/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.2/charts/ztunnel/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.2/charts/ztunnel/files/profile-platform-microk8s.yaml b/resources/v1.25.2/charts/ztunnel/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.2/charts/ztunnel/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.2/charts/ztunnel/files/profile-platform-minikube.yaml b/resources/v1.25.2/charts/ztunnel/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.2/charts/ztunnel/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.2/charts/ztunnel/files/profile-platform-openshift.yaml b/resources/v1.25.2/charts/ztunnel/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.2/charts/ztunnel/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.2/charts/ztunnel/files/profile-preview.yaml b/resources/v1.25.2/charts/ztunnel/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.2/charts/ztunnel/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.2/charts/ztunnel/files/profile-remote.yaml b/resources/v1.25.2/charts/ztunnel/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.2/charts/ztunnel/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.2/charts/ztunnel/files/profile-stable.yaml b/resources/v1.25.2/charts/ztunnel/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.2/charts/ztunnel/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.2/charts/ztunnel/templates/NOTES.txt b/resources/v1.25.2/charts/ztunnel/templates/NOTES.txt
deleted file mode 100644
index 244f59db0..000000000
--- a/resources/v1.25.2/charts/ztunnel/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-ztunnel successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.25.2/charts/ztunnel/templates/_helpers.tpl b/resources/v1.25.2/charts/ztunnel/templates/_helpers.tpl
deleted file mode 100644
index 82740e441..000000000
--- a/resources/v1.25.2/charts/ztunnel/templates/_helpers.tpl
+++ /dev/null
@@ -1 +0,0 @@
-{{ define "ztunnel.release-name" }}{{ .Values.resourceName| default .Release.Name }}{{ end }}
diff --git a/resources/v1.25.2/charts/ztunnel/templates/daemonset.yaml b/resources/v1.25.2/charts/ztunnel/templates/daemonset.yaml
deleted file mode 100644
index ee5775d70..000000000
--- a/resources/v1.25.2/charts/ztunnel/templates/daemonset.yaml
+++ /dev/null
@@ -1,197 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: {{ include "ztunnel.release-name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-spec:
-  updateStrategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app: ztunnel
-  template:
-    metadata:
-      labels:
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app: ztunnel
-        app.kubernetes.io/name: ztunnel
-        {{- include "istio.labels" . | nindent 8}}
-{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-{{- if .Values.revision }}
-        istio.io/rev: {{ .Values.revision }}
-{{- end }}
-{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-{{- if .Values.nodeSelector }}
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- if .Values.affinity }}
-      affinity:
-{{ toYaml .Values.affinity | trim | indent 8 }}
-{{- end }}
-      serviceAccountName: {{ include "ztunnel.release-name" . }}
-      tolerations:
-        - effect: NoSchedule
-          operator: Exists
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      containers:
-      - name: istio-proxy
-{{- if contains "/" .Values.image }}
-        image: "{{ .Values.image }}"
-{{- else }}
-        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
-{{- end }}
-        ports:
-        - containerPort: 15020
-          name: ztunnel-stats
-          protocol: TCP
-        resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 10 }}
-{{- end }}
-{{- with .Values.imagePullPolicy }}
-        imagePullPolicy: {{ . }}
-{{- end }}
-        securityContext:
-          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
-          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
-          allowPrivilegeEscalation: true
-          privileged: false
-          capabilities:
-            drop:
-            - ALL
-            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
-            - NET_ADMIN # Required for TPROXY and setsockopt
-            - SYS_ADMIN # Required for `setns` - doing things in other netns
-            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
-          readOnlyRootFilesystem: true
-          runAsGroup: 1337
-          runAsNonRoot: false
-          runAsUser: 0
-{{- if .Values.seLinuxOptions }}
-          seLinuxOptions:
-{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
-{{- end }}
-        readinessProbe:
-          httpGet:
-            port: 15021
-            path: /healthz/ready
-        args:
-        - proxy
-        - ztunnel
-        env:
-        - name: CA_ADDRESS
-        {{- if .Values.caAddress }}
-          value: {{ .Values.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: XDS_ADDRESS
-        {{- if .Values.xdsAddress }}
-          value: {{ .Values.xdsAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        {{- if .Values.logAsJson }}
-        - name: LOG_FORMAT
-          value: json
-        {{- end}}
-        - name: RUST_LOG
-          value: {{ .Values.logLevel | quote }}
-        - name: RUST_BACKTRACE
-          value: "1"
-        - name: ISTIO_META_CLUSTER_ID
-          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
-        - name: INPOD_ENABLED
-          value: "true"
-        - name: TERMINATION_GRACE_PERIOD_SECONDS
-          value: "{{ .Values.terminationGracePeriodSeconds }}"
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
-        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        {{- with .Values.env }}
-        {{- range $key, $val := . }}
-        - name: {{ $key }}
-          value: "{{ $val }}"
-        {{- end }}
-        {{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /var/run/ztunnel
-          name: cni-ztunnel-sock-dir
-        - mountPath: /tmp
-          name: tmp
-        {{- with .Values.volumeMounts }}
-          {{- toYaml . | nindent 8 }}
-        {{- end }}
-      priorityClassName: system-node-critical
-      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
-      volumes:
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: istio-ca
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      - name: cni-ztunnel-sock-dir
-        hostPath:
-          path: /var/run/ztunnel
-          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
-      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
-      - name: tmp
-        emptyDir: {}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
diff --git a/resources/v1.25.2/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.25.2/charts/ztunnel/templates/zzz_profile.yaml
deleted file mode 100644
index ded66c5fd..000000000
--- a/resources/v1.25.2/charts/ztunnel/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.2/charts/ztunnel/values.yaml b/resources/v1.25.2/charts/ztunnel/values.yaml
deleted file mode 100644
index b7c2c61dd..000000000
--- a/resources/v1.25.2/charts/ztunnel/values.yaml
+++ /dev/null
@@ -1,102 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
-  hub: gcr.io/istio-release
-  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
-  tag: 1.25.2
-  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
-  variant: ""
-
-  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
-  # If Image contains a "/", it will replace the entire `image` in the pod.
-  image: ztunnel
-
-  # resourceName, if set, will override the naming of resources. If not set, will default to the release name.
-  # It is recommended to not set this; this is primarily for backwards compatibility.
-  resourceName: ""
-
-  # Labels to apply to all top level resources
-  labels: {}
-  # Annotations to apply to all top level resources
-  annotations: {}
-
-  # Additional volumeMounts to the ztunnel container
-  volumeMounts: []
-
-  # Additional volumes to the ztunnel pod
-  volumes: []
-
-  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-
-  # Additional labels to apply on the pod level
-  podLabels: {}
-
-  # Pod resource configuration
-  resources:
-    requests:
-      cpu: 200m
-      # Ztunnel memory scales with the size of the cluster and traffic load
-      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
-      memory: 512Mi
-
-  # List of secret names to add to the service account as image pull secrets
-  imagePullSecrets: []
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
-
-  # Override for the pod imagePullPolicy
-  imagePullPolicy: ""
-
-  # Settings for multicluster
-  multiCluster:
-    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
-    # with Istiod configuration.
-    clusterName: ""
-
-  # meshConfig defines runtime configuration of components.
-  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
-  # components.
-  # TODO: https://github.com/istio/istio/issues/43248
-  meshConfig:
-    defaultConfig:
-      proxyMetadata: {}
-
-  # This value defines:
-  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
-  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
-  # Default K8S value is 30 seconds
-  terminationGracePeriodSeconds: 30
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
-  revision: ""
-
-  # The customized CA address to retrieve certificates for the pods in the cluster.
-  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-  caAddress: ""
-
-  # The customized XDS address to retrieve configuration.
-  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
-  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
-  xdsAddress: ""
-
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
-  istioNamespace: istio-system
-
-  # Configuration log level of ztunnel binary, default is info.
-  # Valid values are: trace, debug, info, warn, error
-  logLevel: info
-
-  # To output all logs in json format
-  logAsJson: false
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seLinuxOptions: {}
-  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
-  #seLinuxOptions:
-  #  type: spc_t
diff --git a/resources/v1.25.2/cni-1.25.2.tgz.etag b/resources/v1.25.2/cni-1.25.2.tgz.etag
deleted file mode 100644
index af3f9d4c5..000000000
--- a/resources/v1.25.2/cni-1.25.2.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-62e682552f9735c008647179e79b72e0
diff --git a/resources/v1.25.2/commit b/resources/v1.25.2/commit
deleted file mode 100644
index 61b813d5e..000000000
--- a/resources/v1.25.2/commit
+++ /dev/null
@@ -1 +0,0 @@
-1.25.2
diff --git a/resources/v1.25.2/gateway-1.25.2.tgz.etag b/resources/v1.25.2/gateway-1.25.2.tgz.etag
deleted file mode 100644
index 20e258534..000000000
--- a/resources/v1.25.2/gateway-1.25.2.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-caee3530de2a7c83070add6b2609e122
diff --git a/resources/v1.25.2/istiod-1.25.2.tgz.etag b/resources/v1.25.2/istiod-1.25.2.tgz.etag
deleted file mode 100644
index 5824bda16..000000000
--- a/resources/v1.25.2/istiod-1.25.2.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-cd878b6072f9789083c7fef9c22dc20b
diff --git a/resources/v1.25.2/profiles/ambient.yaml b/resources/v1.25.2/profiles/ambient.yaml
deleted file mode 100644
index 71ea784a8..000000000
--- a/resources/v1.25.2/profiles/ambient.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: ambient
diff --git a/resources/v1.25.2/profiles/demo.yaml b/resources/v1.25.2/profiles/demo.yaml
deleted file mode 100644
index 53c4b4163..000000000
--- a/resources/v1.25.2/profiles/demo.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: demo
diff --git a/resources/v1.25.2/profiles/empty.yaml b/resources/v1.25.2/profiles/empty.yaml
deleted file mode 100644
index 4477cb1fe..000000000
--- a/resources/v1.25.2/profiles/empty.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-# The empty profile has everything disabled
-# This is useful as a base for custom user configuration
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec: {}
diff --git a/resources/v1.25.2/profiles/openshift-ambient.yaml b/resources/v1.25.2/profiles/openshift-ambient.yaml
deleted file mode 100644
index 76edf00cd..000000000
--- a/resources/v1.25.2/profiles/openshift-ambient.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: ambient
-    global:
-      platform: openshift
diff --git a/resources/v1.25.2/profiles/openshift.yaml b/resources/v1.25.2/profiles/openshift.yaml
deleted file mode 100644
index 41492660f..000000000
--- a/resources/v1.25.2/profiles/openshift.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    global:
-      platform: openshift
diff --git a/resources/v1.25.2/profiles/preview.yaml b/resources/v1.25.2/profiles/preview.yaml
deleted file mode 100644
index 59d545c84..000000000
--- a/resources/v1.25.2/profiles/preview.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: preview
diff --git a/resources/v1.25.2/profiles/remote.yaml b/resources/v1.25.2/profiles/remote.yaml
deleted file mode 100644
index 54c65c8ba..000000000
--- a/resources/v1.25.2/profiles/remote.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# The remote profile is used to configure a mesh cluster without a locally deployed control plane.
-# Only the injector mutating webhook configuration is installed.
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: remote
diff --git a/resources/v1.25.2/profiles/stable.yaml b/resources/v1.25.2/profiles/stable.yaml
deleted file mode 100644
index 285feba24..000000000
--- a/resources/v1.25.2/profiles/stable.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: stable
diff --git a/resources/v1.25.2/ztunnel-1.25.2.tgz.etag b/resources/v1.25.2/ztunnel-1.25.2.tgz.etag
deleted file mode 100644
index 678a024ff..000000000
--- a/resources/v1.25.2/ztunnel-1.25.2.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-059e847bbb80fe81c488d5bb1b7903f9
diff --git a/resources/v1.25.3/base-1.25.3.tgz.etag b/resources/v1.25.3/base-1.25.3.tgz.etag
deleted file mode 100644
index bd58403cc..000000000
--- a/resources/v1.25.3/base-1.25.3.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-7caff3616b06390f5f399800b38f0f05
diff --git a/resources/v1.25.3/charts/base/Chart.yaml b/resources/v1.25.3/charts/base/Chart.yaml
deleted file mode 100644
index 9fef2061a..000000000
--- a/resources/v1.25.3/charts/base/Chart.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.3
-description: Helm chart for deploying Istio cluster resources and CRDs
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-name: base
-sources:
-- https://github.com/istio/istio
-version: 1.25.3
diff --git a/resources/v1.25.3/charts/base/README.md b/resources/v1.25.3/charts/base/README.md
deleted file mode 100644
index ae8f6d5b0..000000000
--- a/resources/v1.25.3/charts/base/README.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Istio base Helm Chart
-
-This chart installs resources shared by all Istio revisions. This includes Istio CRDs.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-base`:
-
-```console
-kubectl create namespace istio-system
-helm install istio-base istio/base -n istio-system
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.25.3/charts/base/files/profile-ambient.yaml b/resources/v1.25.3/charts/base/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.3/charts/base/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.3/charts/base/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.3/charts/base/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.3/charts/base/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/base/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.3/charts/base/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.3/charts/base/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/base/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.3/charts/base/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.3/charts/base/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/base/files/profile-platform-gke.yaml b/resources/v1.25.3/charts/base/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.3/charts/base/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.3/charts/base/files/profile-platform-k3d.yaml b/resources/v1.25.3/charts/base/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.3/charts/base/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.3/charts/base/files/profile-platform-microk8s.yaml b/resources/v1.25.3/charts/base/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.3/charts/base/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.3/charts/base/files/profile-platform-minikube.yaml b/resources/v1.25.3/charts/base/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.3/charts/base/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.3/charts/base/files/profile-platform-openshift.yaml b/resources/v1.25.3/charts/base/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.3/charts/base/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.3/charts/base/files/profile-preview.yaml b/resources/v1.25.3/charts/base/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.3/charts/base/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.3/charts/base/files/profile-remote.yaml b/resources/v1.25.3/charts/base/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.3/charts/base/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.3/charts/base/files/profile-stable.yaml b/resources/v1.25.3/charts/base/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.3/charts/base/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.3/charts/base/templates/NOTES.txt b/resources/v1.25.3/charts/base/templates/NOTES.txt
deleted file mode 100644
index f12616f57..000000000
--- a/resources/v1.25.3/charts/base/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-Istio base successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.25.3/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml b/resources/v1.25.3/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
deleted file mode 100644
index 2616b09c9..000000000
--- a/resources/v1.25.3/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,53 +0,0 @@
-{{- if and .Values.experimental.stableValidationPolicy (not (eq .Values.defaultRevision "")) }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-default-policy.istio.io"
-  labels:
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision }}
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-default-policy-binding.istio.io"
-spec:
-  policyName: "stable-channel-default-policy.istio.io"
-  validationActions: [Deny]
-{{- end }}
diff --git a/resources/v1.25.3/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml b/resources/v1.25.3/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
deleted file mode 100644
index 8cb76fd77..000000000
--- a/resources/v1.25.3/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-{{- if not (eq .Values.defaultRevision "") }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istiod-default-validator
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  - name: validation.istio.io
-    clientConfig:
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        {{- if (eq .Values.defaultRevision "default") }}
-        name: istiod
-        {{- else }}
-        name: istiod-{{ .Values.defaultRevision }}
-        {{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-{{- end }}
diff --git a/resources/v1.25.3/charts/base/templates/reader-serviceaccount.yaml b/resources/v1.25.3/charts/base/templates/reader-serviceaccount.yaml
deleted file mode 100644
index ba829a6bf..000000000
--- a/resources/v1.25.3/charts/base/templates/reader-serviceaccount.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-# This singleton service account aggregates reader permissions for the revisions in a given cluster
-# ATM this is a singleton per cluster with Istio installed, and is not revisioned. It maybe should be,
-# as otherwise compromising the token for this SA would give you access to *every* installed revision.
-# Should be used for remote secret creation.
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-    {{- end }}
-    {{- end }}
-metadata:
-  name: istio-reader-service-account
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.25.3/charts/base/templates/zzz_profile.yaml b/resources/v1.25.3/charts/base/templates/zzz_profile.yaml
deleted file mode 100644
index 9c2119b9a..000000000
--- a/resources/v1.25.3/charts/base/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.3/charts/cni/Chart.yaml b/resources/v1.25.3/charts/cni/Chart.yaml
deleted file mode 100644
index 61f8eaecd..000000000
--- a/resources/v1.25.3/charts/cni/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.3
-description: Helm chart for istio-cni components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-cni
-- istio
-name: cni
-sources:
-- https://github.com/istio/istio
-version: 1.25.3
diff --git a/resources/v1.25.3/charts/cni/README.md b/resources/v1.25.3/charts/cni/README.md
deleted file mode 100644
index a8b78d5bd..000000000
--- a/resources/v1.25.3/charts/cni/README.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# Istio CNI Helm Chart
-
-This chart installs the Istio CNI Plugin. See the [CNI installation guide](https://istio.io/latest/docs/setup/additional-setup/cni/)
-for more information.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-cni`:
-
-```console
-helm install istio-cni istio/cni -n kube-system
-```
-
-Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
-`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
-'system-node-critical' outside of kube-system.
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istio-cni
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Ambient
-
-To enable ambient, you can use the ambient profile: `--set profile=ambient`.
-
-#### Calico
-
-For Calico, you must also modify the settings to allow source spoofing:
-
-- if deployed by operator,  `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`
-- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )
-
-### GKE notes
-
-On GKE, 'kube-system' is required.
-
-If using `helm template`, `--set cni.cniBinDir=/home/kubernetes/bin` is required - with `helm install`
-it is auto-detected.
diff --git a/resources/v1.25.3/charts/cni/files/profile-ambient.yaml b/resources/v1.25.3/charts/cni/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.3/charts/cni/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.3/charts/cni/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.3/charts/cni/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.3/charts/cni/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/cni/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.3/charts/cni/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.3/charts/cni/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/cni/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.3/charts/cni/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.3/charts/cni/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/cni/files/profile-platform-gke.yaml b/resources/v1.25.3/charts/cni/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.3/charts/cni/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.3/charts/cni/files/profile-platform-k3d.yaml b/resources/v1.25.3/charts/cni/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.3/charts/cni/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.3/charts/cni/files/profile-platform-microk8s.yaml b/resources/v1.25.3/charts/cni/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.3/charts/cni/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.3/charts/cni/files/profile-platform-minikube.yaml b/resources/v1.25.3/charts/cni/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.3/charts/cni/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.3/charts/cni/files/profile-platform-openshift.yaml b/resources/v1.25.3/charts/cni/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.3/charts/cni/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.3/charts/cni/files/profile-preview.yaml b/resources/v1.25.3/charts/cni/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.3/charts/cni/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.3/charts/cni/files/profile-remote.yaml b/resources/v1.25.3/charts/cni/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.3/charts/cni/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.3/charts/cni/files/profile-stable.yaml b/resources/v1.25.3/charts/cni/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.3/charts/cni/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.3/charts/cni/templates/NOTES.txt b/resources/v1.25.3/charts/cni/templates/NOTES.txt
deleted file mode 100644
index fb35525b9..000000000
--- a/resources/v1.25.3/charts/cni/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-"{{ .Release.Name }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.25.3/charts/cni/templates/_helpers.tpl b/resources/v1.25.3/charts/cni/templates/_helpers.tpl
deleted file mode 100644
index 73cc17b2f..000000000
--- a/resources/v1.25.3/charts/cni/templates/_helpers.tpl
+++ /dev/null
@@ -1,8 +0,0 @@
-{{- define "name" -}}
-    istio-cni
-{{- end }}
-
-
-{{- define "istio-tag" -}}
-    {{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}
-{{- end }}
diff --git a/resources/v1.25.3/charts/cni/templates/clusterrolebinding.yaml b/resources/v1.25.3/charts/cni/templates/clusterrolebinding.yaml
deleted file mode 100644
index 42fedab1f..000000000
--- a/resources/v1.25.3/charts/cni/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-repair-rolebinding
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-repair-role
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "name" . }}
-    namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-ambient
-{{- end }}
diff --git a/resources/v1.25.3/charts/cni/templates/daemonset.yaml b/resources/v1.25.3/charts/cni/templates/daemonset.yaml
deleted file mode 100644
index d83c77fce..000000000
--- a/resources/v1.25.3/charts/cni/templates/daemonset.yaml
+++ /dev/null
@@ -1,241 +0,0 @@
-# This manifest installs the Istio install-cni container, as well
-# as the Istio CNI plugin and config on
-# each master and worker node in a Kubernetes cluster.
-#
-# $detectedBinDir exists to support a GKE-specific platform override,
-# and is deprecated in favor of using the explicit `gke` platform profile.
-{{- $detectedBinDir := (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
-    "/home/kubernetes/bin"
-    "/opt/cni/bin"
-}}
-{{- if .Values.cniBinDir }}
-{{ $detectedBinDir = .Values.cniBinDir }}
-{{- end }}
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  # Note that this is templated but evaluates to a fixed name
-  # which the CNI plugin may fall back onto in some failsafe scenarios.
-  # if this name is changed, CNI plugin logic that checks for this name
-  # format should also be updated.
-  name: {{ template "name" . }}-node
-  namespace: {{ .Release.Namespace }}
-  labels:
-    k8s-app: {{ template "name" . }}-node
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  selector:
-    matchLabels:
-      k8s-app: {{ template "name" . }}-node
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  template:
-    metadata:
-      labels:
-        k8s-app: {{ template "name" . }}-node
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: {{ template "name" . }}
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-        # Add Prometheus Scrape annotations
-        prometheus.io/scrape: 'true'
-        prometheus.io/port: "15014"
-        prometheus.io/path: '/metrics'
-        # Add AppArmor annotation
-        # This is required to avoid conflicts with AppArmor profiles which block certain
-        # privileged pod capabilities.
-        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
-        # securityContext which is otherwise preferred.
-        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
-        # Custom annotations
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{if .Values.ambient.enabled }}
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-{{ end }}
-      nodeSelector:
-        kubernetes.io/os: linux
-      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      tolerations:
-        # Make sure istio-cni-node gets scheduled on all nodes.
-        - effect: NoSchedule
-          operator: Exists
-        # Mark the pod as a critical add-on for rescheduling.
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      priorityClassName: system-node-critical
-      serviceAccountName: {{ template "name" . }}
-      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
-      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
-      terminationGracePeriodSeconds: 5
-      containers:
-        # This container installs the Istio CNI binaries
-        # and CNI network config file on each node.
-        - name: install-cni
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
-{{- end }}
-{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
-{{- end }}
-          ports:
-          - containerPort: 15014
-            name: metrics
-            protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8000
-          securityContext:
-            privileged: false
-            runAsGroup: 0
-            runAsUser: 0
-            runAsNonRoot: false
-            # Both ambient and sidecar repair mode require elevated node privileges to function.
-            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
-            # add capabilities based on feature.
-            capabilities:
-              drop:
-              - ALL
-              add:
-              # CAP_NET_ADMIN is required to allow ipset and route table access
-              - NET_ADMIN
-              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
-              - NET_RAW
-              # CAP_SYS_PTRACE is required for repair and ambient mode to describe
-              # the pod's network namespace.
-              - SYS_PTRACE
-              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
-              # network namespaces in `/proc` to obtain descriptors for entering pod network
-              # namespaces. There does not appear to be a more granular capability for this.
-              - SYS_ADMIN
-              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
-              # the typical ability to read/write to folders owned by others.
-              # This can cause problems if the hostPath mounts we use, which we require write access into,
-              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
-              - DAC_OVERRIDE
-{{- if .Values.seLinuxOptions }}
-{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
-            seLinuxOptions:
-{{ toYaml . | trim | indent 14 }}
-{{- end }}
-{{- end }}
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          command: ["install-cni"]
-          args:
-            {{- if or .Values.logging.level .Values.global.logging.level }}
-            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
-            {{- end}}
-            {{- if .Values.global.logAsJson }}
-            - --log_as_json
-            {{- end}}
-          envFrom:
-            - configMapRef:
-                name: {{ template "name" . }}-config
-          env:
-            - name: REPAIR_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: REPAIR_RUN_AS_DAEMON
-              value: "true"
-            - name: REPAIR_SIDECAR_ANNOTATION
-              value: "sidecar.istio.io/status"
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  apiVersion: v1
-                  fieldPath: spec.nodeName
-            - name: GOMEMLIMIT
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.memory
-            - name: GOMAXPROCS
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.cpu
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          volumeMounts:
-            - mountPath: /host/opt/cni/bin
-              name: cni-bin-dir
-            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-            - mountPath: /host/proc
-              name: cni-host-procfs
-              readOnly: true
-            {{- end }}
-            - mountPath: /host/etc/cni/net.d
-              name: cni-net-dir
-            - mountPath: /var/run/istio-cni
-              name: cni-socket-dir
-            {{- if .Values.ambient.enabled }}
-            - mountPath: /host/var/run/netns
-              mountPropagation: HostToContainer
-              name: cni-netns-dir
-            - mountPath: /var/run/ztunnel
-              name: cni-ztunnel-sock-dir
-            {{ end }}
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-      volumes:
-        # Used to install CNI.
-        - name: cni-bin-dir
-          hostPath:
-            path: {{ $detectedBinDir }}
-        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-        - name: cni-host-procfs
-          hostPath:
-            path: /proc
-            type: Directory
-        {{- end }}
-        {{- if .Values.ambient.enabled }}
-        - name: cni-ztunnel-sock-dir
-          hostPath:
-            path: /var/run/ztunnel
-            type: DirectoryOrCreate
-        {{- end }}
-        - name: cni-net-dir
-          hostPath:
-            path: {{ .Values.cniConfDir }}
-        # Used for UDS sockets for logging, ambient eventing
-        - name: cni-socket-dir
-          hostPath:
-            path: /var/run/istio-cni
-        - name: cni-netns-dir
-          hostPath:
-            path: {{ .Values.cniNetnsDir }}
-            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
-            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
-            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.25.3/charts/cni/templates/network-attachment-definition.yaml b/resources/v1.25.3/charts/cni/templates/network-attachment-definition.yaml
deleted file mode 100644
index 86a2eb7c0..000000000
--- a/resources/v1.25.3/charts/cni/templates/network-attachment-definition.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-{{- if eq .Values.provider "multus" }}
-apiVersion: k8s.cni.cncf.io/v1
-kind: NetworkAttachmentDefinition
-metadata:
-  name: {{ template "name" . }}
-  namespace: default
-  labels:
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/cni/templates/resourcequota.yaml b/resources/v1.25.3/charts/cni/templates/resourcequota.yaml
deleted file mode 100644
index 9a6d61ff9..000000000
--- a/resources/v1.25.3/charts/cni/templates/resourcequota.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-{{- if .Values.resourceQuotas.enabled }}
-apiVersion: v1
-kind: ResourceQuota
-metadata:
-  name: {{ template "name" . }}-resource-quota
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  hard:
-    pods: {{ .Values.resourceQuotas.pods | quote }}
-  scopeSelector:
-    matchExpressions:
-    - operator: In
-      scopeName: PriorityClass
-      values:
-      - system-node-critical
-{{- end }}
diff --git a/resources/v1.25.3/charts/cni/templates/serviceaccount.yaml b/resources/v1.25.3/charts/cni/templates/serviceaccount.yaml
deleted file mode 100644
index 3193d7b74..000000000
--- a/resources/v1.25.3/charts/cni/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-{{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-{{- end }}
-{{- end }}
-metadata:
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.25.3/charts/cni/templates/zzy_descope_legacy.yaml b/resources/v1.25.3/charts/cni/templates/zzy_descope_legacy.yaml
deleted file mode 100644
index a9584ac29..000000000
--- a/resources/v1.25.3/charts/cni/templates/zzy_descope_legacy.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-{{/* Copy anything under `.cni` to `.`, to avoid the need to specify a redundant prefix.
-Due to the file naming, this always happens after zzz_profile.yaml */}}
-{{- $_ := mustMergeOverwrite $.Values (index $.Values "cni") }}
\ No newline at end of file
diff --git a/resources/v1.25.3/charts/cni/templates/zzz_profile.yaml b/resources/v1.25.3/charts/cni/templates/zzz_profile.yaml
deleted file mode 100644
index 9c2119b9a..000000000
--- a/resources/v1.25.3/charts/cni/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.3/charts/cni/values.yaml b/resources/v1.25.3/charts/cni/values.yaml
deleted file mode 100644
index 0c3b74702..000000000
--- a/resources/v1.25.3/charts/cni/values.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  hub: ""
-  tag: ""
-  variant: ""
-  image: install-cni
-  pullPolicy: ""
-
-  # Same as `global.logging.level`, but will override it if set
-  logging:
-    level: ""
-
-  # Configuration file to insert istio-cni plugin configuration
-  # by default this will be the first file found in the cni-conf-dir
-  # Example
-  # cniConfFileName: 10-calico.conflist
-
-  # CNI-and-platform specific path defaults.
-  # These may need to be set to platform-specific values, consult
-  # overrides for your platform in `manifests/helm-profiles/platform-*.yaml`
-  cniBinDir: /opt/cni/bin
-  cniConfDir: /etc/cni/net.d
-  cniConfFileName: ""
-  cniNetnsDir: "/var/run/netns"
-
-  excludeNamespaces:
-    - kube-system
-
-  # Allows user to set custom affinity for the DaemonSet
-  affinity: {}
-
-  # Custom annotations on pod level, if you need them
-  podAnnotations: {}
-
-  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
-  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
-  chained: true
-
-  # Custom configuration happens based on the CNI provider.
-  # Possible values: "default", "multus"
-  provider: "default"
-
-  # Configure ambient settings
-  ambient:
-    # If enabled, ambient redirection will be enabled
-    enabled: false
-    # Set ambient config dir path: defaults to /etc/ambient-config
-    configDir: ""
-    # If enabled, and ambient is enabled, DNS redirection will be enabled
-    dnsCapture: true
-    # If enabled, and ambient is enabled, enables ipv6 support
-    ipv6: true
-    # If enabled, and ambient is enabled, the CNI agent will reconcile incompatible iptables rules and chains at startup.
-    # This will eventually be enabled by default
-    reconcileIptablesOnStartup: false
-
-
-  repair:
-    enabled: true
-    hub: ""
-    tag: ""
-
-    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
-    # This defines the action the controller will take when a pod is detected as broken.
-
-    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
-    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
-    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
-    labelPods: false
-    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
-    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
-    deletePods: false
-    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
-    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
-    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
-    repairPods: true
-
-    initContainerName: "istio-validation"
-
-    brokenPodLabelKey: "cni.istio.io/uninitialized"
-    brokenPodLabelValue: "true"
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
-  seLinuxOptions: {}
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 100Mi
-
-  resourceQuotas:
-    enabled: false
-    pods: 5000
-
-  # The number of pods that can be unavailable during rolling update (see
-  # `updateStrategy.rollingUpdate.maxUnavailable` here:
-  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
-  # May be specified as a number of pods or as a percent of the total number
-  # of pods at the start of the update.
-  rollingMaxUnavailable: 1
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  global:
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-
-    # Default tag for Istio images.
-    tag: 1.25.3
-
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # change cni scope level to control logging out of istio-cni-node DaemonSet
-    logging:
-      level: info
-
-    logAsJson: false
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Default resources allocated
-    defaultResources:
-      requests:
-        cpu: 100m
-        memory: 100Mi
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
diff --git a/resources/v1.25.3/charts/gateway/Chart.yaml b/resources/v1.25.3/charts/gateway/Chart.yaml
deleted file mode 100644
index d22625a3e..000000000
--- a/resources/v1.25.3/charts/gateway/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.3
-description: Helm chart for deploying Istio gateways
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- gateways
-name: gateway
-sources:
-- https://github.com/istio/istio
-type: application
-version: 1.25.3
diff --git a/resources/v1.25.3/charts/gateway/README.md b/resources/v1.25.3/charts/gateway/README.md
deleted file mode 100644
index 5c064d165..000000000
--- a/resources/v1.25.3/charts/gateway/README.md
+++ /dev/null
@@ -1,170 +0,0 @@
-# Istio Gateway Helm Chart
-
-This chart installs an Istio gateway deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-ingressgateway`:
-
-```console
-helm install istio-ingressgateway istio/gateway
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istio-ingressgateway` deployment:
-
-```console
-helm delete istio-ingressgateway
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/gateway
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### OpenShift
-
-When deploying the gateway in an OpenShift cluster, use the `openshift` profile to override the default values, for example:
-
-```console
-helm install istio-ingressgateway istio/gateway --set profile=openshift
-```
-
-### `image: auto` Information
-
-The image used by the chart, `auto`, may be unintuitive.
-This exists because the pod spec will be automatically populated at runtime, using the same mechanism as [Sidecar Injection](istio.io/latest/docs/setup/additional-setup/sidecar-injection).
-This allows the same configurations and lifecycle to apply to gateways as sidecars.
-
-Note: this does mean that the namespace the gateway is deployed in must not have the `istio-injection=disabled` label.
-See [Controlling the injection policy](https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy) for more info.
-
-### Examples
-
-#### Egress Gateway
-
-Deploying a Gateway to be used as an [Egress Gateway](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/):
-
-```yaml
-service:
-  # Egress gateways do not need an external LoadBalancer IP
-  type: ClusterIP
-```
-
-#### Multi-network/VM Gateway
-
-Deploying a Gateway to be used as a [Multi-network Gateway](https://istio.io/latest/docs/setup/install/multicluster/) for network `network-1`:
-
-```yaml
-networkGateway: network-1
-```
-
-### Migrating from other installation methods
-
-Installations from other installation methods (such as istioctl, Istio Operator, other helm charts, etc) can be migrated to use the new Helm charts
-following the guidance below.
-If you are able to, a clean installation is simpler. However, this often requires an external IP migration which can be challenging.
-
-WARNING: when installing over an existing deployment, the two deployments will be merged together by Helm, which may lead to unexpected results.
-
-#### Legacy Gateway Helm charts
-
-Istio historically offered two different charts - `manifests/charts/gateways/istio-ingress` and `manifests/charts/gateways/istio-egress`.
-These are replaced by this chart.
-While not required, it is recommended all new users use this chart, and existing users migrate when possible.
-
-This chart has the following benefits and differences:
-* Designed with Helm best practices in mind (standardized values options, values schema, values are not all nested under `gateways.istio-ingressgateway.*`, release name and namespace taken into account, etc).
-* Utilizes Gateway injection, simplifying upgrades, allowing gateways to run in any namespace, and avoiding repeating config for sidecars and gateways.
-* Published to official Istio Helm repository.
-* Single chart for all gateways (Ingress, Egress, East West).
-
-#### General concerns
-
-For a smooth migration, the resource names and `Deployment.spec.selector` labels must match.
-
-If you install with `helm install istio-gateway istio/gateway`, resources will be named `istio-gateway` and the `selector` labels set to:
-
-```yaml
-app: istio-gateway
-istio: gateway # the release name with leading istio- prefix stripped
-```
-
-If your existing installation doesn't follow these names, you can override them. For example, if you have resources named `my-custom-gateway` with `selector` labels
-`foo=bar,istio=ingressgateway`:
-
-```yaml
-name: my-custom-gateway # Override the name to match existing resources
-labels:
-  app: "" # Unset default app selector label
-  istio: ingressgateway # override default istio selector label
-  foo: bar # Add the existing custom selector label
-```
-
-#### Migrating an existing Helm release
-
-An existing helm release can be `helm upgrade`d to this chart by using the same release name. For example, if a previous
-installation was done like:
-
-```console
-helm install istio-ingress manifests/charts/gateways/istio-ingress -n istio-system
-```
-
-It could be upgraded with
-
-```console
-helm upgrade istio-ingress manifests/charts/gateway -n istio-system --set name=istio-ingressgateway --set labels.app=istio-ingressgateway --set labels.istio=ingressgateway
-```
-
-Note the name and labels are overridden to match the names of the existing installation.
-
-Warning: the helm charts here default to using port 80 and 443, while the old charts used 8080 and 8443.
-If you have AuthorizationPolicies that reference port these ports, you should update them during this process,
-or customize the ports to match the old defaults.
-See the [security advisory](https://istio.io/latest/news/security/istio-security-2021-002/) for more information.
-
-#### Other migrations
-
-If you see errors like `rendered manifests contain a resource that already exists` during installation, you may need to forcibly take ownership.
-
-The script below can handle this for you. Replace `RELEASE` and `NAMESPACE` with the name and namespace of the release:
-
-```console
-KINDS=(service deployment)
-RELEASE=istio-ingressgateway
-NAMESPACE=istio-system
-for KIND in "${KINDS[@]}"; do
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-name=$RELEASE
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-namespace=$NAMESPACE
-    kubectl --namespace $NAMESPACE --overwrite=true label $KIND $RELEASE app.kubernetes.io/managed-by=Helm
-done
-```
-
-You may ignore errors about resources not being found.
diff --git a/resources/v1.25.3/charts/gateway/files/profile-ambient.yaml b/resources/v1.25.3/charts/gateway/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.3/charts/gateway/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.3/charts/gateway/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.3/charts/gateway/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.3/charts/gateway/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/gateway/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.3/charts/gateway/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.3/charts/gateway/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/gateway/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.3/charts/gateway/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.3/charts/gateway/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/gateway/files/profile-platform-gke.yaml b/resources/v1.25.3/charts/gateway/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.3/charts/gateway/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.3/charts/gateway/files/profile-platform-k3d.yaml b/resources/v1.25.3/charts/gateway/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.3/charts/gateway/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.3/charts/gateway/files/profile-platform-microk8s.yaml b/resources/v1.25.3/charts/gateway/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.3/charts/gateway/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.3/charts/gateway/files/profile-platform-minikube.yaml b/resources/v1.25.3/charts/gateway/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.3/charts/gateway/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.3/charts/gateway/files/profile-platform-openshift.yaml b/resources/v1.25.3/charts/gateway/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.3/charts/gateway/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.3/charts/gateway/files/profile-preview.yaml b/resources/v1.25.3/charts/gateway/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.3/charts/gateway/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.3/charts/gateway/files/profile-remote.yaml b/resources/v1.25.3/charts/gateway/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.3/charts/gateway/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.3/charts/gateway/files/profile-stable.yaml b/resources/v1.25.3/charts/gateway/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.3/charts/gateway/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.3/charts/gateway/templates/NOTES.txt b/resources/v1.25.3/charts/gateway/templates/NOTES.txt
deleted file mode 100644
index fd0142911..000000000
--- a/resources/v1.25.3/charts/gateway/templates/NOTES.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-"{{ include "gateway.name" . }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
-
-Next steps:
-  * Deploy an HTTP Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/
-  * Deploy an HTTPS Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/
diff --git a/resources/v1.25.3/charts/gateway/templates/_helpers.tpl b/resources/v1.25.3/charts/gateway/templates/_helpers.tpl
deleted file mode 100644
index e5a0a9b3c..000000000
--- a/resources/v1.25.3/charts/gateway/templates/_helpers.tpl
+++ /dev/null
@@ -1,40 +0,0 @@
-{{- define "gateway.name" -}}
-{{- if eq .Release.Name "RELEASE-NAME" -}}
-  {{- .Values.name | default "istio-ingressgateway" -}}
-{{- else -}}
-  {{- .Values.name | default .Release.Name | default "istio-ingressgateway" -}}
-{{- end -}}
-{{- end }}
-
-{{- define "gateway.labels" -}}
-{{ include "gateway.selectorLabels" . }}
-{{- range $key, $val := .Values.labels }}
-{{- if and (ne $key "app") (ne $key "istio") }}
-{{ $key | quote }}: {{ $val | quote }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{- define "gateway.selectorLabels" -}}
-app: {{ (.Values.labels.app | quote) | default (include "gateway.name" .) }}
-istio: {{ (.Values.labels.istio | quote) | default (include "gateway.name" . | trimPrefix "istio-") }}
-{{- end }}
-
-{{/*
-Keep sidecar injection labels together
-https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy
-*/}}
-{{- define "gateway.sidecarInjectionLabels" -}}
-sidecar.istio.io/inject: "true"
-{{- with .Values.revision }}
-istio.io/rev: {{ . | quote }}
-{{- end }}
-{{- end }}
-
-{{- define "gateway.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create }}
-{{- .Values.serviceAccount.name | default (include "gateway.name" .)    }}
-{{- else }}
-{{- .Values.serviceAccount.name | default "default" }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/gateway/templates/deployment.yaml b/resources/v1.25.3/charts/gateway/templates/deployment.yaml
deleted file mode 100644
index 9db59d8b9..000000000
--- a/resources/v1.25.3/charts/gateway/templates/deployment.yaml
+++ /dev/null
@@ -1,128 +0,0 @@
-apiVersion: apps/v1
-kind: {{ .Values.kind | default "Deployment" }}
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  {{- with .Values.replicaCount }}
-  replicas: {{ . }}
-  {{- end }}
-  {{- end }}
-  {{- with .Values.strategy }}
-  strategy:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.minReadySeconds }}
-  minReadySeconds: {{ . }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "gateway.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
-        {{- include "gateway.selectorLabels" . | nindent 8 }}
-        app.kubernetes.io/name: {{ include "gateway.name" . }}
-        {{- include "istio.labels" .  | nindent 8}}
-        {{- range $key, $val := .Values.labels }}
-        {{- if and (ne $key "app") (ne $key "istio") }}
-        {{ $key | quote }}: {{ $val | quote }}
-        {{- end }}
-        {{- end }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
-      securityContext:
-      {{- if .Values.securityContext }}
-        {{- toYaml .Values.securityContext | nindent 8 }}
-      {{- else }}
-        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- end }}
-      {{- with .Values.volumes }}
-      volumes:
-        {{ toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: istio-proxy
-          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
-          image: auto
-          {{- with .Values.imagePullPolicy }}
-          imagePullPolicy: {{ . }}
-          {{- end }}
-          securityContext:
-          {{- if .Values.containerSecurityContext }}
-            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          {{- else }}
-            capabilities:
-              drop:
-              - ALL
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            {{- if not (eq (.Values.platform | default "") "openshift") }}
-            runAsUser: 1337
-            runAsGroup: 1337
-            {{- end }}
-            runAsNonRoot: true
-          {{- end }}
-          env:
-          {{- with .Values.networkGateway }}
-          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-            value: "{{.}}"
-          {{- end }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: {{ $val | quote }}
-          {{- end }}
-          ports:
-          - containerPort: 15090
-            protocol: TCP
-            name: http-envoy-prom
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          {{- with .Values.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.readinessProbe }}
-          readinessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
-      {{- with .Values.priorityClassName }}
-      priorityClassName: {{ . }}
-      {{- end }}
diff --git a/resources/v1.25.3/charts/gateway/templates/hpa.yaml b/resources/v1.25.3/charts/gateway/templates/hpa.yaml
deleted file mode 100644
index 64ecb6a4c..000000000
--- a/resources/v1.25.3/charts/gateway/templates/hpa.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-{{- if and (.Values.autoscaling.enabled) (eq .Values.kind "Deployment") }}
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: {{ .Values.kind | default "Deployment" }}
-    name: {{ include "gateway.name" . }}
-  minReplicas: {{ .Values.autoscaling.minReplicas }}
-  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
-  metrics:
-    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
-          type: Utilization
-    {{- end }}
-    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
-    - type: Resource
-      resource:
-        name: memory
-        target:
-          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
-          type: Utilization
-    {{- end }}
-  {{- if .Values.autoscaling.autoscaleBehavior }}
-  behavior: {{ toYaml .Values.autoscaling.autoscaleBehavior | nindent 4 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/gateway/templates/poddisruptionbudget.yaml b/resources/v1.25.3/charts/gateway/templates/poddisruptionbudget.yaml
deleted file mode 100644
index b0155cdf0..000000000
--- a/resources/v1.25.3/charts/gateway/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-{{- if .Values.podDisruptionBudget }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-spec:
-  selector:
-    matchLabels:
-  {{- include "gateway.selectorLabels" . | nindent 6 }}
-  {{- with .Values.podDisruptionBudget }}
-    {{- toYaml . | nindent 2 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/gateway/templates/role.yaml b/resources/v1.25.3/charts/gateway/templates/role.yaml
deleted file mode 100644
index 3d1607963..000000000
--- a/resources/v1.25.3/charts/gateway/templates/role.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-{{/*Set up roles for Istio Gateway. Not required for gateway-api*/}}
-{{- if .Values.rbac.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "watch", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "gateway.serviceAccountName" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ include "gateway.serviceAccountName" . }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/gateway/templates/service.yaml b/resources/v1.25.3/charts/gateway/templates/service.yaml
deleted file mode 100644
index 25ce3bcb0..000000000
--- a/resources/v1.25.3/charts/gateway/templates/service.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-{{- if not (eq .Values.service.type "None") }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-    {{- with .Values.networkGateway }}
-    topology.istio.io/network: "{{.}}"
-    {{- end }}
-  annotations:
-    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
-spec:
-{{- with .Values.service.loadBalancerIP }}
-  loadBalancerIP: "{{ . }}"
-{{- end }}
-{{- if eq .Values.service.type "LoadBalancer" }}
-  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
-  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
-  {{- end }}
-{{- end }}
-{{- if .Values.service.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.service.ipFamilies }}
-  ipFamilies:
-{{- range .Values.service.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
-{{- with .Values.service.loadBalancerSourceRanges }}
-  loadBalancerSourceRanges:
-{{ toYaml . | indent 4 }}
-{{- end }}
-{{- with .Values.service.externalTrafficPolicy }}
-  externalTrafficPolicy: "{{ . }}"
-{{- end }}
-  type: {{ .Values.service.type }}
-  ports:
-{{- if .Values.networkGateway }}
-  - name: status-port
-    port: 15021
-    targetPort: 15021
-  - name: tls
-    port: 15443
-    targetPort: 15443
-  - name: tls-istiod
-    port: 15012
-    targetPort: 15012
-  - name: tls-webhook
-    port: 15017
-    targetPort: 15017
-{{- else }}
-{{ .Values.service.ports | toYaml | indent 4 }}
-{{- end }}
-{{- if .Values.service.externalIPs }}
-  externalIPs: {{- range .Values.service.externalIPs }}
-    - {{.}}
-  {{- end }}
-{{- end }}
-  selector:
-    {{- include "gateway.selectorLabels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/gateway/templates/serviceaccount.yaml b/resources/v1.25.3/charts/gateway/templates/serviceaccount.yaml
deleted file mode 100644
index c88afeadd..000000000
--- a/resources/v1.25.3/charts/gateway/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-{{- if .Values.serviceAccount.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/gateway/templates/zzz_profile.yaml b/resources/v1.25.3/charts/gateway/templates/zzz_profile.yaml
deleted file mode 100644
index ded66c5fd..000000000
--- a/resources/v1.25.3/charts/gateway/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.3/charts/gateway/values.schema.json b/resources/v1.25.3/charts/gateway/values.schema.json
deleted file mode 100644
index 3fdaa2730..000000000
--- a/resources/v1.25.3/charts/gateway/values.schema.json
+++ /dev/null
@@ -1,330 +0,0 @@
-{
-  "$schema": "http://json-schema.org/schema#",
-  "$defs": {
-    "values": {
-      "type": "object",
-      "properties": {
-        "global": {
-          "type": "object"
-        },
-        "affinity": {
-          "type": "object"
-        },
-        "securityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "containerSecurityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "kind": {
-          "type": "string",
-          "enum": [
-            "Deployment",
-            "DaemonSet"
-          ]
-        },
-        "annotations": {
-          "additionalProperties": {
-            "type": [
-              "string",
-              "integer"
-            ]
-          },
-          "type": "object"
-        },
-        "autoscaling": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            },
-            "maxReplicas": {
-              "type": "integer"
-            },
-            "minReplicas": {
-              "type": "integer"
-            },
-            "targetCPUUtilizationPercentage": {
-              "type": "integer"
-            }
-          }
-        },
-        "env": {
-          "type": "object"
-        },
-        "strategy": {
-          "type": "object"
-        },
-        "minReadySeconds": {
-          "type": [
-            "null",
-            "integer"
-          ]
-        },
-        "readinessProbe": {
-          "type": [
-            "null",
-            "object"
-          ]
-        },
-        "labels": {
-          "type": "object"
-        },
-        "name": {
-          "type": "string"
-        },
-        "nodeSelector": {
-          "type": "object"
-        },
-        "podAnnotations": {
-          "type": "object",
-          "properties": {
-            "inject.istio.io/templates": {
-              "type": "string"
-            },
-            "prometheus.io/path": {
-              "type": "string"
-            },
-            "prometheus.io/port": {
-              "type": "string"
-            },
-            "prometheus.io/scrape": {
-              "type": "string"
-            }
-          }
-        },
-        "replicaCount": {
-          "type": [
-            "integer",
-            "null"
-          ]
-        },
-        "resources": {
-          "type": "object",
-          "properties": {
-            "limits": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            },
-            "requests": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            }
-          }
-        },
-        "revision": {
-          "type": "string"
-        },
-        "compatibilityVersion": {
-          "type": "string"
-        },
-        "runAsRoot": {
-          "type": "boolean"
-        },
-        "unprivilegedPort": {
-          "type": [
-            "string",
-            "boolean"
-          ],
-          "enum": [
-            true,
-            false,
-            "auto"
-          ]
-        },
-        "service": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "externalTrafficPolicy": {
-              "type": "string"
-            },
-            "loadBalancerIP": {
-              "type": "string"
-            },
-            "loadBalancerSourceRanges": {
-              "type": "array"
-            },
-            "ipFamilies": {
-              "items": {
-                "type": "string",
-                "enum": [
-                  "IPv4",
-                  "IPv6"
-                ]
-              }
-            },
-            "ipFamilyPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "SingleStack",
-                "PreferDualStack",
-                "RequireDualStack"
-              ]
-            },
-            "ports": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string"
-                  },
-                  "port": {
-                    "type": "integer"
-                  },
-                  "protocol": {
-                    "type": "string"
-                  },
-                  "targetPort": {
-                    "type": "integer"
-                  }
-                }
-              }
-            },
-            "type": {
-              "type": "string"
-            }
-          }
-        },
-        "serviceAccount": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "name": {
-              "type": "string"
-            },
-            "create": {
-              "type": "boolean"
-            }
-          }
-        },
-        "rbac": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            }
-          }
-        },
-        "tolerations": {
-          "type": "array"
-        },
-        "topologySpreadConstraints": {
-          "type": "array"
-        },
-        "networkGateway": {
-          "type": "string"
-        },
-        "imagePullPolicy": {
-          "type": "string",
-          "enum": [
-            "",
-            "Always",
-            "IfNotPresent",
-            "Never"
-          ]
-        },
-        "imagePullSecrets": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "name": {
-                "type": "string"
-              }
-            }
-          }
-        },
-        "podDisruptionBudget": {
-          "type": "object",
-          "properties": {
-            "minAvailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "maxUnavailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "unhealthyPodEvictionPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "IfHealthyBudget",
-                "AlwaysAllow"
-              ]
-            }
-          }
-        },
-        "terminationGracePeriodSeconds": {
-          "type": "number"
-        },
-        "volumes": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "volumeMounts": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "priorityClassName": {
-          "type": "string"
-        },
-        "_internal_defaults_do_not_set": {
-          "type": "object"
-        }
-      },
-      "additionalProperties": false
-    }
-  },
-  "defaults": {
-    "$ref": "#/$defs/values"
-  },
-  "$ref": "#/$defs/values"
-}
diff --git a/resources/v1.25.3/charts/gateway/values.yaml b/resources/v1.25.3/charts/gateway/values.yaml
deleted file mode 100644
index d8b70ec15..000000000
--- a/resources/v1.25.3/charts/gateway/values.yaml
+++ /dev/null
@@ -1,168 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Name allows overriding the release name. Generally this should not be set
-  name: ""
-  # revision declares which revision this gateway is a part of
-  revision: ""
-
-  # Controls the spec.replicas setting for the Gateway deployment if set.
-  # Otherwise defaults to Kubernetes Deployment default (1).
-  replicaCount:
-
-  kind: Deployment
-
-  rbac:
-    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
-    # when using http://gateway-api.org/.
-    enabled: true
-
-  serviceAccount:
-    # If set, a service account will be created. Otherwise, the default is used
-    create: true
-    # Annotations to add to the service account
-    annotations: {}
-    # The name of the service account to use.
-    # If not set, the release name is used
-    name: ""
-
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/stats/prometheus"
-    inject.istio.io/templates: "gateway"
-    sidecar.istio.io/inject: "true"
-
-  # Define the security context for the pod.
-  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-  securityContext: {}
-  containerSecurityContext: {}
-
-  service:
-    # Type of service. Set to "None" to disable the service entirely
-    type: LoadBalancer
-    ports:
-    - name: status-port
-      port: 15021
-      protocol: TCP
-      targetPort: 15021
-    - name: http2
-      port: 80
-      protocol: TCP
-      targetPort: 80
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
-    annotations: {}
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    externalTrafficPolicy: ""
-    externalIPs: []
-    ipFamilyPolicy: ""
-    ipFamilies: []
-    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
-    # allocateLoadBalancerNodePorts: false
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: 2000m
-      memory: 1024Mi
-
-  autoscaling:
-    enabled: true
-    minReplicas: 1
-    maxReplicas: 5
-    targetCPUUtilizationPercentage: 80
-    targetMemoryUtilizationPercentage: {}
-    autoscaleBehavior: {}
-
-  # Pod environment variables
-  env: {}
-
-  # Deployment Update strategy
-  strategy: {}
-  
-  # Sets the Deployment minReadySeconds value
-  minReadySeconds:
-  
-  # Optionally configure a custom readinessProbe. By default the control plane
-  # automatically injects the readinessProbe. If you wish to override that
-  # behavior, you may define your own readinessProbe here.
-  readinessProbe: {}
-
-  # Labels to apply to all resources
-  labels:
-    # By default, don't enroll gateways into the ambient dataplane
-    "istio.io/dataplane-mode": none
-
-  # Annotations to apply to all resources
-  annotations: {}
-
-  nodeSelector: {}
-
-  tolerations: []
-
-  topologySpreadConstraints: []
-
-  affinity: {}
-
-  # If specified, the gateway will act as a network gateway for the given network.
-  networkGateway: ""
-
-  # Specify image pull policy if default behavior isn't desired.
-  # Default behavior: latest images will be Always else IfNotPresent
-  imagePullPolicy: ""
-
-  imagePullSecrets: []
-
-  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
-  #
-  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
-  # which means that no PodDisruptionBudget resource will be created.
-  #
-  # To enable the PodDisruptionBudget, configure it by specifying the
-  # `minAvailable` or `maxUnavailable`. For example, to set the
-  # minimum number of available replicas to 1, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #
-  # Or, to allow a maximum of 1 unavailable replica, you can set:
-  #
-  # podDisruptionBudget:
-  #   maxUnavailable: 1
-  #
-  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
-  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #   unhealthyPodEvictionPolicy: AlwaysAllow
-  #
-  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
-  #
-  # podDisruptionBudget: {}
-  #
-  podDisruptionBudget: {}
-
-  # Sets the per-pod terminationGracePeriodSeconds setting.
-  terminationGracePeriodSeconds: 30
-
-  # A list of `Volumes` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumes: []
-
-  # A list of `VolumeMounts` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumeMounts: []
-
-  # Configure this to a higher priority class in order to make sure your Istio gateway pods
-  # will not be killed because of low priority class.
-  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-  # for more detail.
-  priorityClassName: ""
diff --git a/resources/v1.25.3/charts/istiod/Chart.yaml b/resources/v1.25.3/charts/istiod/Chart.yaml
deleted file mode 100644
index c4ee5aa3c..000000000
--- a/resources/v1.25.3/charts/istiod/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.3
-description: Helm chart for istio control plane
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- istiod
-- istio-discovery
-name: istiod
-sources:
-- https://github.com/istio/istio
-version: 1.25.3
diff --git a/resources/v1.25.3/charts/istiod/README.md b/resources/v1.25.3/charts/istiod/README.md
deleted file mode 100644
index ddbfbc8fe..000000000
--- a/resources/v1.25.3/charts/istiod/README.md
+++ /dev/null
@@ -1,73 +0,0 @@
-# Istiod Helm Chart
-
-This chart installs an Istiod deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-Before installing, ensure CRDs are installed in the cluster (from the `istio/base` chart).
-
-To install the chart with the release name `istiod`:
-
-```console
-kubectl create namespace istio-system
-helm install istiod istio/istiod --namespace istio-system
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istiod` deployment:
-
-```console
-helm delete istiod --namespace istio-system
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istiod
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Examples
-
-#### Configuring mesh configuration settings
-
-Any [Mesh Config](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/) options can be configured like below:
-
-```yaml
-meshConfig:
-  accessLogFile: /dev/stdout
-```
-
-#### Revisions
-
-Control plane revisions allow deploying multiple versions of the control plane in the same cluster.
-This allows safe [canary upgrades](https://istio.io/latest/docs/setup/upgrade/canary/)
-
-```yaml
-revision: my-revision-name
-```
diff --git a/resources/v1.25.3/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.25.3/charts/istiod/files/gateway-injection-template.yaml
deleted file mode 100644
index dbd83cc57..000000000
--- a/resources/v1.25.3/charts/istiod/files/gateway-injection-template.yaml
+++ /dev/null
@@ -1,253 +0,0 @@
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations:
-    istio.io/rev: {{ .Revision | default "default" | quote }}
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- end }}
-spec:
-  securityContext:
-  {{- if .Values.gateways.securityContext }}
-    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
-  {{- else }}
-    sysctls:
-    - name: net.ipv4.ip_unprivileged_port_start
-      value: "0"
-  {{- end }}
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - router
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- end }}
-    securityContext:
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-    env:
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-  volumes:
-  - emptyDir: {}
-    name: workload-socket
-  - emptyDir: {}
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else}}
-  - emptyDir: {}
-    name: workload-certs
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.3/charts/istiod/files/grpc-agent.yaml b/resources/v1.25.3/charts/istiod/files/grpc-agent.yaml
deleted file mode 100644
index 7290fcdca..000000000
--- a/resources/v1.25.3/charts/istiod/files/grpc-agent.yaml
+++ /dev/null
@@ -1,310 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-    sidecar.istio.io/rewriteAppHTTPProbers: "false",
-  }
-spec:
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15020
-      protocol: TCP
-      name: mesh-metrics
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-          - --url=http://localhost:15020/healthz/ready
-    env:
-    - name: ISTIO_META_GENERATOR
-      value: grpc
-    - name: OUTPUT_CERTS
-      value: /var/lib/istio/data
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    # grpc uses xds:/// to resolve – no need to resolve VIP
-    - name: ISTIO_META_DNS_CAPTURE
-      value: "false"
-    - name: DISABLE_ENVOY
-      value: "true"
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15020
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # UDS channel between istioagent and gRPC client for XDS/SDS
-    - mountPath: /etc/istio/proxy
-      name: istio-xds
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-{{- range $index, $container := .Spec.Containers  }}
-{{ if not (eq $container.Name "istio-proxy") }}
-  - name: {{ $container.Name }}
-    env:
-      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
-        value: "true"
-      - name: "GRPC_XDS_BOOTSTRAP"
-        value: "/etc/istio/proxy/grpc-bootstrap.json"
-    volumeMounts:
-      - mountPath: /var/lib/istio/data
-        name: istio-data
-      # UDS channel between istioagent and gRPC client for XDS/SDS
-      - mountPath: /etc/istio/proxy
-        name: istio-xds
-      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-        readOnly: true
-      {{- else }}
-      - name: workload-certs
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-      {{- end }}
-{{- end }}
-{{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-xds
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.3/charts/istiod/files/grpc-simple.yaml b/resources/v1.25.3/charts/istiod/files/grpc-simple.yaml
deleted file mode 100644
index 9ba0c7a46..000000000
--- a/resources/v1.25.3/charts/istiod/files/grpc-simple.yaml
+++ /dev/null
@@ -1,65 +0,0 @@
-metadata:
-  annotations:
-    sidecar.istio.io/rewriteAppHTTPProbers: "false"
-spec:
-  initContainers:
-    - name: grpc-bootstrap-init
-      image: busybox:1.28
-      volumeMounts:
-        - mountPath: /var/lib/grpc/data/
-          name: grpc-io-proxyless-bootstrap
-      env:
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: ISTIO_NAMESPACE
-          value: |
-             {{ .Values.global.istioNamespace }}
-      command:
-        - sh
-        - "-c"
-        - |-
-          NODE_ID="sidecar~${INSTANCE_IP}~${POD_NAME}.${POD_NAMESPACE}~cluster.local"
-          SERVER_URI="dns:///istiod.${ISTIO_NAMESPACE}.svc:15010"
-          echo '
-          {
-            "xds_servers": [
-              {
-                "server_uri": "'${SERVER_URI}'",
-                "channel_creds": [{"type": "insecure"}],
-                "server_features" : ["xds_v3"]
-              }
-            ],
-            "node": {
-              "id": "'${NODE_ID}'",
-              "metadata": {
-                "GENERATOR": "grpc"
-              }
-            }
-          }' > /var/lib/grpc/data/bootstrap.json
-  containers:
-  {{- range $index, $container := .Spec.Containers }}
-  - name: {{ $container.Name }}
-    env:
-      - name: GRPC_XDS_BOOTSTRAP
-        value: /var/lib/grpc/data/bootstrap.json
-      - name: GRPC_GO_LOG_VERBOSITY_LEVEL
-        value: "99"
-      - name: GRPC_GO_LOG_SEVERITY_LEVEL
-        value: info
-    volumeMounts:
-      - mountPath: /var/lib/grpc/data/
-        name: grpc-io-proxyless-bootstrap
-  {{- end }}
-  volumes:
-    - name: grpc-io-proxyless-bootstrap
-      emptyDir: {}
diff --git a/resources/v1.25.3/charts/istiod/files/injection-template.yaml b/resources/v1.25.3/charts/istiod/files/injection-template.yaml
deleted file mode 100644
index 3b3f69cd9..000000000
--- a/resources/v1.25.3/charts/istiod/files/injection-template.yaml
+++ /dev/null
@@ -1,515 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
-    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
-    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
-    {{- end }}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-{{- if .Values.pilot.cni.enabled }}
-    {{- if eq .Values.pilot.cni.provider "multus" }}
-    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
-    {{- end }}
-    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
-    traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}",
-    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
-    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
-    {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
-    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
-    {{- end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}istio.io/reroute-virtual-interfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
-{{- end }}
-  }
-spec:
-  {{- $holdProxy := and
-      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
-      (not $nativeSidecar) }}
-  initContainers:
-  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
-  {{ if .Values.pilot.cni.enabled -}}
-  - name: istio-validation
-  {{ else -}}
-  - name: istio-init
-  {{ end -}}
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    args:
-    - istio-iptables
-    - "-p"
-    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
-    - "-z"
-    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
-    - "-u"
-    - {{ .ProxyUID | default "1337" | quote }}
-    - "-m"
-    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
-    - "-i"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
-    - "-x"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
-    - "-b"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
-    - "-d"
-  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
-    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
-  {{- else }}
-    - "15090,15021"
-  {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
-    - "-q"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
-    {{ end -}}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
-    - "-o"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}"
-    {{ end -}}
-     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
-    - "-c"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
-    {{ end -}}
-    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
-    {{ if .Values.global.logAsJson -}}
-    - "--log_as_json"
-    {{ end -}}
-    {{ if .Values.pilot.cni.enabled -}}
-    - "--run-validation"
-    - "--skip-rule-apply"
-    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
-    - "--force-apply"
-    {{ end -}}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-  {{- if .ProxyConfig.ProxyMetadata }}
-    env:
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-  {{- end }}
-    resources:
-  {{ template "resources" . }}
-    securityContext:
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      privileged: {{ .Values.global.proxy.privileged }}
-      capabilities:
-    {{- if not .Values.pilot.cni.enabled }}
-        add:
-        - NET_ADMIN
-        - NET_RAW
-    {{- end }}
-        drop:
-        - ALL
-    {{- if not .Values.pilot.cni.enabled }}
-      readOnlyRootFilesystem: false
-      runAsGroup: 0
-      runAsNonRoot: false
-      runAsUser: 0
-    {{- else }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsNonRoot: true
-    {{- end }}
-  {{ end -}}
-  {{ if not $nativeSidecar }}
-  containers:
-  {{ end }}
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.outlierLogPath }}
-    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-  {{- end}}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- else if $holdProxy }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-  {{- else if $nativeSidecar }}
-    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
-    lifecycle:
-      preStop:
-        exec:
-          command:
-          - pilot-agent
-          - request
-          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
-          - POST
-          - drain
-  {{- end }}
-    env:
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- with (index .ObjectMeta.Labels `service.istio.io/workload-name` | default .DeploymentMeta.Name) }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ . }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - name: ISTIO_BOOTSTRAP_OVERRIDE
-      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
-    {{- end }}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-  {{ if .Values.global.proxy.startupProbe.enabled }}
-    startupProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: 0
-      periodSeconds: 1
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
-  {{ end }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    {{ end -}}
-    securityContext:
-      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
-      allowPrivilegeEscalation: true
-      capabilities:
-        add:
-        - NET_ADMIN
-        drop:
-        - ALL
-      privileged: true
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else }}
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      capabilities:
-        {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-        add:
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
-        - NET_ADMIN
-        {{- end }}
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
-        - NET_BIND_SERVICE
-        {{- end }}
-        {{- end }}
-        drop:
-        - ALL
-      privileged: {{ .Values.global.proxy.privileged }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else -}}
-      runAsNonRoot: true
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      {{- end }}
-      {{- end }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - mountPath: /etc/istio/custom-bootstrap
-      name: custom-bootstrap-volume
-    {{- end }}
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
-      name: lightstep-certs
-      readOnly: true
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  - emptyDir:
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-  - name: lightstep-certs
-    secret:
-      optional: true
-      secretName: lightstep.cacert
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.3/charts/istiod/files/kube-gateway.yaml b/resources/v1.25.3/charts/istiod/files/kube-gateway.yaml
deleted file mode 100644
index dbe158de1..000000000
--- a/resources/v1.25.3/charts/istiod/files/kube-gateway.yaml
+++ /dev/null
@@ -1,345 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-gateway-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": {{.Name}}
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-gateway-controller"
-          ) | nindent 8 }}
-    spec:
-      securityContext:
-      {{- if .Values.gateways.securityContext }}
-        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
-      {{- else }}
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- if .Values.gateways.seccompProfile }}
-        seccompProfile:
-      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
-      {{- end }}
-      {{- end }}
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-      {{- else }}
-        image: "{{ .ProxyImage }}"
-      {{- end }}
-        {{- if .Values.global.proxy.resources }}
-        resources:
-          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsUser: {{ .ProxyUID | default "1337" }}
-          runAsGroup: {{ .ProxyGID | default "1337" }}
-          runAsNonRoot: true
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        args:
-        - proxy
-        - router
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-      {{- if .Values.global.sts.servicePort }}
-        - --stsPort={{ .Values.global.sts.servicePort }}
-      {{- end }}
-      {{- if .Values.global.logAsJson }}
-        - --log_as_json
-      {{- end }}
-      {{- if .Values.global.proxy.lifecycle }}
-        lifecycle:
-          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
-      {{- end }}
-        env:
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        - name: ISTIO_META_POD_PORTS
-          value: "[]"
-        - name: ISTIO_META_APP_CONTAINERS
-          value: ""
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: "{{ .ProxyConfig.InterceptionMode.String }}"
-        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
-        - name: ISTIO_META_NETWORK
-          value: {{.|quote}}
-        {{- end }}
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName|quote}}
-        - name: ISTIO_META_OWNER
-          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
-        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-          value: {{.|quote}}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        volumeMounts:
-        - name: workload-socket
-          mountPath: /var/run/secrets/workload-spiffe-uds
-        - name: credential-socket
-          mountPath: /var/run/secrets/credential-uds
-        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-        - name: gke-workload-certificate
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-          readOnly: true
-        {{- else }}
-        - name: workload-certs
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-        {{- end }}
-        {{- if eq .Values.global.pilotCertProvider "istiod" }}
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        {{- end }}
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        # SDS channel between istioagent and Envoy
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - name: istio-podinfo
-          mountPath: /etc/istio/pod
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir: {}
-        name: credential-socket
-      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        csi:
-          driver: workloadcertificates.security.cloud.google.com
-      {{- else}}
-      - emptyDir: {}
-        name: workload-certs
-      {{- end }}
-      # SDS channel between istioagent and Envoy
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - name: istio-data
-        emptyDir: {}
-      - name: istio-podinfo
-        downwardAPI:
-          items:
-            - path: "labels"
-              fieldRef:
-                fieldPath: metadata.labels
-            - path: "annotations"
-              fieldRef:
-                fieldPath: metadata.annotations
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: {{ .Values.global.sds.token.aud }}
-      {{- if eq .Values.global.pilotCertProvider "istiod" }}
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: {{.UID}}
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": {{.Name}}
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.25.3/charts/istiod/files/profile-ambient.yaml b/resources/v1.25.3/charts/istiod/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.3/charts/istiod/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.3/charts/istiod/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.3/charts/istiod/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.3/charts/istiod/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/istiod/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.3/charts/istiod/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.3/charts/istiod/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/istiod/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.3/charts/istiod/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.3/charts/istiod/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/istiod/files/profile-platform-gke.yaml b/resources/v1.25.3/charts/istiod/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.3/charts/istiod/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.3/charts/istiod/files/profile-platform-k3d.yaml b/resources/v1.25.3/charts/istiod/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.3/charts/istiod/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.3/charts/istiod/files/profile-platform-microk8s.yaml b/resources/v1.25.3/charts/istiod/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.3/charts/istiod/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.3/charts/istiod/files/profile-platform-minikube.yaml b/resources/v1.25.3/charts/istiod/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.3/charts/istiod/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.3/charts/istiod/files/profile-platform-openshift.yaml b/resources/v1.25.3/charts/istiod/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.3/charts/istiod/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.3/charts/istiod/files/profile-preview.yaml b/resources/v1.25.3/charts/istiod/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.3/charts/istiod/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.3/charts/istiod/files/profile-remote.yaml b/resources/v1.25.3/charts/istiod/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.3/charts/istiod/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.3/charts/istiod/files/profile-stable.yaml b/resources/v1.25.3/charts/istiod/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.3/charts/istiod/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.3/charts/istiod/files/waypoint.yaml b/resources/v1.25.3/charts/istiod/files/waypoint.yaml
deleted file mode 100644
index 2600e98e2..000000000
--- a/resources/v1.25.3/charts/istiod/files/waypoint.yaml
+++ /dev/null
@@ -1,340 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-mesh-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": "{{.Name}}"
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "istio.io/dataplane-mode" "none"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-mesh-controller"
-          ) | nindent 8}}
-    spec:
-      {{- if .Values.global.waypoint.affinity }}
-      affinity:
-      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.topologySpreadConstraints }}
-      topologySpreadConstraints:
-      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.nodeSelector }}
-      nodeSelector:
-      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.tolerations }}
-      tolerations:
-      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: 2
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-        {{- else }}
-        image: "{{ .ProxyImage }}"
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        args:
-        - proxy
-        - waypoint
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --serviceCluster
-        - {{.ServiceAccount}}.$(POD_NAMESPACE)
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-        {{- if .Values.global.logAsJson }}
-        - --log_as_json
-        {{- end }}
-        {{- if .Values.global.proxy.outlierLogPath }}
-        - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-        {{- end}}
-        env:
-        - name: ISTIO_META_SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        {{- if .ProxyConfig.ProxyMetadata }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
-        {{- if $network }}
-        - name: ISTIO_META_NETWORK
-          value: "{{ $network }}"
-        {{- end }}
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: REDIRECT
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName}}
-        - name: ISTIO_META_OWNER
-          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- if .Values.global.waypoint.resources }}
-        resources:
-        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        securityContext:
-          privileged: false
-        {{- if not (eq .Values.global.platform "openshift") }}
-          runAsGroup: 1337
-          runAsUser: 1337
-        {{- end }}
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-            - ALL
-{{- if .Values.gateways.seccompProfile }}
-          seccompProfile:
-{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
-{{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/workload-spiffe-uds
-          name: workload-socket
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /etc/istio/pod
-          name: istio-podinfo
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - emptyDir:
-          medium: Memory
-        name: go-proxy-envoy
-      - emptyDir: {}
-        name: istio-data
-      - emptyDir: {}
-        name: go-proxy-data
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.labels
-            path: labels
-          - fieldRef:
-              fieldPath: metadata.annotations
-            path: annotations
-        name: istio-podinfo
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              audience: istio-ca
-              expirationSeconds: 43200
-              path: istio-token
-      - configMap:
-          name: istio-ca-root-cert
-        name: istiod-ca-cert
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap
-      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
-      (omit .InfrastructureAnnotations
-        "kubectl.kubernetes.io/last-applied-configuration"
-        "gateway.istio.io/name-override"
-        "gateway.istio.io/service-account"
-        "gateway.istio.io/controller-version"
-      ) | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": "{{.Name}}"
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.25.3/charts/istiod/templates/NOTES.txt b/resources/v1.25.3/charts/istiod/templates/NOTES.txt
deleted file mode 100644
index 0d07ea7f4..000000000
--- a/resources/v1.25.3/charts/istiod/templates/NOTES.txt
+++ /dev/null
@@ -1,82 +0,0 @@
-"istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
-
-Next steps:
-{{- $profile := default "" .Values.profile }}
-{{- if (eq $profile "ambient") }}
-  * Get started with ambient: https://istio.io/latest/docs/ops/ambient/getting-started/
-  * Review ambient's architecture: https://istio.io/latest/docs/ops/ambient/architecture/
-{{- else }}
-  * Deploy a Gateway: https://istio.io/latest/docs/setup/additional-setup/gateway/
-  * Try out our tasks to get started on common configurations:
-    * https://istio.io/latest/docs/tasks/traffic-management
-    * https://istio.io/latest/docs/tasks/security/
-    * https://istio.io/latest/docs/tasks/policy-enforcement/
-{{- end }}
-  * Review the list of actively supported releases, CVE publications and our hardening guide:
-    * https://istio.io/latest/docs/releases/supported-releases/
-    * https://istio.io/latest/news/security/
-    * https://istio.io/latest/docs/ops/best-practices/security/
-
-For further documentation see https://istio.io website
-
-{{-
-  $deps := dict
-    "global.outboundTrafficPolicy" "meshConfig.outboundTrafficPolicy"
-    "global.certificates" "meshConfig.certificates"
-    "global.localityLbSetting" "meshConfig.localityLbSetting"
-    "global.policyCheckFailOpen" "meshConfig.policyCheckFailOpen"
-    "global.enableTracing" "meshConfig.enableTracing"
-    "global.proxy.accessLogFormat" "meshConfig.accessLogFormat"
-    "global.proxy.accessLogFile" "meshConfig.accessLogFile"
-    "global.proxy.concurrency" "meshConfig.defaultConfig.concurrency"
-    "global.proxy.envoyAccessLogService" "meshConfig.defaultConfig.envoyAccessLogService"
-    "global.proxy.envoyAccessLogService.enabled" "meshConfig.enableEnvoyAccessLogService"
-    "global.proxy.envoyMetricsService" "meshConfig.defaultConfig.envoyMetricsService"
-    "global.proxy.protocolDetectionTimeout" "meshConfig.protocolDetectionTimeout"
-    "global.proxy.holdApplicationUntilProxyStarts" "meshConfig.defaultConfig.holdApplicationUntilProxyStarts"
-    "pilot.ingress" "meshConfig.ingressService, meshConfig.ingressControllerMode, and meshConfig.ingressClass"
-    "global.mtls.enabled" "the PeerAuthentication resource"
-    "global.mtls.auto" "meshConfig.enableAutoMtls"
-    "global.tracer.lightstep.address" "meshConfig.defaultConfig.tracing.lightstep.address"
-    "global.tracer.lightstep.accessToken" "meshConfig.defaultConfig.tracing.lightstep.accessToken"
-    "global.tracer.zipkin.address" "meshConfig.defaultConfig.tracing.zipkin.address"
-    "global.tracer.datadog.address" "meshConfig.defaultConfig.tracing.datadog.address"
-    "global.meshExpansion.enabled" "Gateway and other Istio networking resources, such as in samples/multicluster/"
-    "istiocoredns.enabled" "the in-proxy DNS capturing (ISTIO_META_DNS_CAPTURE)"
-}}
-{{- range $dep, $replace := $deps }}
-{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
-{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
-{{- if not (eq $res "")}}
-WARNING: {{$dep|quote}} is deprecated; use {{$replace|quote}} instead.
-{{- end }}
-{{- end }}
-{{-
-  $failDeps := dict
-    "telemetry.v2.prometheus.configOverride"
-    "telemetry.v2.stackdriver.configOverride"
-    "telemetry.v2.stackdriver.disableOutbound"
-    "telemetry.v2.stackdriver.outboundAccessLogging"
-    "global.tracer.stackdriver.debug" "meshConfig.defaultConfig.tracing.stackdriver.debug"
-    "global.tracer.stackdriver.maxNumberOfAttributes" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes"
-    "global.tracer.stackdriver.maxNumberOfAnnotations" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations"
-    "global.tracer.stackdriver.maxNumberOfMessageEvents" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents"
-    "meshConfig.defaultConfig.tracing.stackdriver.debug" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents" "Istio supported tracers"
-}}
-{{- range $dep, $replace := $failDeps }}
-{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
-{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
-{{- if not (eq $res "")}}
-{{fail (print $dep " is removed")}}
-{{- end }}
-{{- end }}
-{{- if eq $.Values.global.pilotCertProvider "kubernetes" }}
-{{- fail "pilotCertProvider=kubernetes is not supported" }}
-{{- end }}
\ No newline at end of file
diff --git a/resources/v1.25.3/charts/istiod/templates/_helpers.tpl b/resources/v1.25.3/charts/istiod/templates/_helpers.tpl
deleted file mode 100644
index 042c92538..000000000
--- a/resources/v1.25.3/charts/istiod/templates/_helpers.tpl
+++ /dev/null
@@ -1,23 +0,0 @@
-{{/* Default Prometheus is enabled if its enabled and there are no config overrides set */}}
-{{ define "default-prometheus" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.prometheus.enabled
-}}
-{{- end }}
-
-{{/* SD has metrics and logging split. Default metrics are enabled if SD is enabled */}}
-{{ define "default-sd-metrics" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
-}}
-{{- end }}
-
-{{/* SD has metrics and logging split. */}}
-{{ define "default-sd-logs" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
-}}
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/autoscale.yaml b/resources/v1.25.3/charts/istiod/templates/autoscale.yaml
deleted file mode 100644
index 09cd6258c..000000000
--- a/resources/v1.25.3/charts/istiod/templates/autoscale.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if and .Values.autoscaleEnabled .Values.autoscaleMin .Values.autoscaleMax }}
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  maxReplicas: {{ .Values.autoscaleMax }}
-  minReplicas: {{ .Values.autoscaleMin }}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  metrics:
-  - type: Resource
-    resource:
-      name: cpu
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.cpu.targetAverageUtilization }}
-  {{- if .Values.memory.targetAverageUtilization }}
-  - type: Resource
-    resource:
-      name: memory
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.memory.targetAverageUtilization }}
-  {{- end }}
-  {{- if .Values.autoscaleBehavior }}
-  behavior: {{ toYaml .Values.autoscaleBehavior | nindent 4 }}
-  {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/clusterrole.yaml b/resources/v1.25.3/charts/istiod/templates/clusterrole.yaml
deleted file mode 100644
index 0c340b5b3..000000000
--- a/resources/v1.25.3/charts/istiod/templates/clusterrole.yaml
+++ /dev/null
@@ -1,187 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  # sidecar injection controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-
-  # configuration validation webhook controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-
-  # istio configuration
-  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
-  # please proceed with caution
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["get", "watch", "list"]
-    resources: ["*"]
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["update", "patch"]
-    resources:
-    - authorizationpolicies/status
-    - destinationrules/status
-    - envoyfilters/status
-    - gateways/status
-    - peerauthentications/status
-    - proxyconfigs/status
-    - requestauthentications/status
-    - serviceentries/status
-    - sidecars/status
-    - telemetries/status
-    - virtualservices/status
-    - wasmplugins/status
-    - workloadentries/status
-    - workloadgroups/status
-{{- end }}
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries/status",  "serviceentries/status" ]
-  - apiGroups: ["security.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "authorizationpolicies/status" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services/status" ]
-
-  # auto-detect installed CRD definitions
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-
-  # discovery and routing
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-
-{{- if .Values.taint.enabled }}
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["patch"]
-{{- end }}
-
-  # ingress controller
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-{{- end}}
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses", "ingressclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-
-  # required for CA's namespace controller
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-
-  # Istiod and bootstrap.
-{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
-{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "certificatesigningrequests"
-      - "certificatesigningrequests/approval"
-      - "certificatesigningrequests/status"
-    verbs: ["update", "create", "get", "delete", "watch"]
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "signers"
-    resourceNames:
-{{- range .Values.global.certSigners }}
-    - {{ . | quote }}
-{{- end }}
-    verbs: ["approve"]
-{{- end}}
-
-  # Used by Istiod to verify the JWT tokens
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-
-  # Used by Istiod to verify gateway SDS
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-
-  # Use for Kubernetes Service APIs
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources:
-    - backendtlspolicies/status
-    - gatewayclasses/status
-    - gateways/status
-    - grpcroutes/status
-    - httproutes/status
-    - referencegrants/status
-    - tcproutes/status
-    - tlsroutes/status
-    - udproutes/status
-    verbs: ["update", "patch"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["gatewayclasses"]
-    verbs: ["create", "update", "patch", "delete"]
-
-  # Needed for multicluster secret reading, possibly ingress certs in the future
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "watch", "list"]
-
-  # Used for MCS serviceexport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: [ "get", "watch", "list", "create", "delete"]
-
-  # Used for MCS serviceimport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "watch", "list"]
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: ["apps"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "deployments" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "serviceaccounts"]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.25.3/charts/istiod/templates/clusterrolebinding.yaml
deleted file mode 100644
index 10781b407..000000000
--- a/resources/v1.25.3/charts/istiod/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-- kind: ServiceAccount
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.25.3/charts/istiod/templates/configmap-jwks.yaml
deleted file mode 100644
index 3505d2822..000000000
--- a/resources/v1.25.3/charts/istiod/templates/configmap-jwks.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.jwksResolverExtraRootCA }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  extra.pem: {{ .Values.jwksResolverExtraRootCA | quote }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/configmap-values.yaml b/resources/v1.25.3/charts/istiod/templates/configmap-values.yaml
deleted file mode 100644
index a7e60369d..000000000
--- a/resources/v1.25.3/charts/istiod/templates/configmap-values.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  original-values: |-
-{{ .Values._original | toPrettyJson | indent 4 }}
-{{- $_ := unset $.Values "_original" }}
-  merged-values: |-
-{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.25.3/charts/istiod/templates/deployment.yaml b/resources/v1.25.3/charts/istiod/templates/deployment.yaml
deleted file mode 100644
index 5380805e9..000000000
--- a/resources/v1.25.3/charts/istiod/templates/deployment.yaml
+++ /dev/null
@@ -1,291 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- range $key, $val := .Values.deploymentLabels }}
-    {{ $key }}: "{{ $val }}"
-{{- end }}
-spec:
-{{- if not .Values.autoscaleEnabled }}
-{{- if .Values.replicaCount }}
-  replicas: {{ .Values.replicaCount }}
-{{- end }}
-{{- end }}
-  strategy:
-    rollingUpdate:
-      maxSurge: {{ .Values.rollingMaxSurge }}
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  selector:
-    matchLabels:
-      {{- if ne .Values.revision "" }}
-      app: istiod
-      istio.io/rev: {{ .Values.revision | default "default" | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
-  template:
-    metadata:
-      labels:
-        app: istiod
-        istio.io/rev: {{ .Values.revision | default "default" | quote }}
-        sidecar.istio.io/inject: "false"
-        operator.istio.io/component: "Pilot"
-        {{- if ne .Values.revision "" }}
-        istio: istiod
-        {{- else }}
-        istio: pilot
-        {{- end }}
-        {{- range $key, $val := .Values.podLabels }}
-        {{ $key }}: "{{ $val }}"
-        {{- end }}
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: "istiod"
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        prometheus.io/port: "15014"
-        prometheus.io/scrape: "true"
-        sidecar.istio.io/inject: "false"
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{- if .Values.nodeSelector }}
-      nodeSelector:
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- with .Values.affinity }}
-      affinity:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      tolerations:
-        - key: cni.istio.io/not-ready
-          operator: "Exists"
-{{- with .Values.tolerations }}
-{{- toYaml . | nindent 8 }}
-{{- end }}
-{{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- if .Values.global.priorityClassName }}
-      priorityClassName: "{{ .Values.global.priorityClassName }}"
-{{- end }}
-{{- with .Values.initContainers }}
-      initContainers:
-        {{- tpl (toYaml .) $ | nindent 8 }}
-{{- end }}
-      containers:
-        - name: discovery
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
-{{- end }}
-{{- if .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
-{{- end }}
-          args:
-          - "discovery"
-          - --monitoringAddr=:15014
-{{- if .Values.global.logging.level }}
-          - --log_output_level={{ .Values.global.logging.level }}
-{{- end}}
-{{- if .Values.global.logAsJson }}
-          - --log_as_json
-{{- end }}
-          - --domain
-          - {{ .Values.global.proxy.clusterDomain }}
-{{- if .Values.taint.namespace }}
-          - --cniNamespace={{ .Values.taint.namespace }}
-{{- end }}
-          - --keepaliveMaxServerConnectionAge
-          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
-{{- if .Values.extraContainerArgs }}
-          {{- with .Values.extraContainerArgs }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-{{- end }}
-          ports:
-          - containerPort: 8080
-            protocol: TCP
-            name: http-debug
-          - containerPort: 15010
-            protocol: TCP
-            name: grpc-xds
-          - containerPort: 15012
-            protocol: TCP
-            name: tls-xds
-          - containerPort: 15017
-            protocol: TCP
-            name: https-webhooks
-          - containerPort: 15014
-            protocol: TCP
-            name: http-monitoring
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 8080
-            initialDelaySeconds: 1
-            periodSeconds: 3
-            timeoutSeconds: 5
-          env:
-          - name: REVISION
-            value: "{{ .Values.revision | default `default` }}"
-          - name: PILOT_CERT_PROVIDER
-            value: {{ .Values.global.pilotCertProvider }}
-          - name: POD_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.name
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.namespace
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: spec.serviceAccountName
-          - name: KUBECONFIG
-            value: /var/run/secrets/remote/config
-          # If you explicitly told us where ztunnel lives, use that.
-          # Otherwise, assume it lives in our namespace
-          # Also, check for an explicit ENV override (legacy approach) and prefer that
-          # if present
-          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
-          {{ $ztTrustedName := or .Values.trustedZtunnelName "ztunnel" }}
-          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
-          - name: CA_TRUSTED_NODE_ACCOUNTS
-            value: "{{ $ztTrustedNS }}/{{ $ztTrustedName }}"
-          {{- end }}
-          {{- if .Values.env }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: "{{ $val }}"
-          {{- end }}
-          {{- end }}
-{{- if .Values.traceSampling }}
-          - name: PILOT_TRACE_SAMPLING
-            value: "{{ .Values.traceSampling }}"
-{{- end }}
-# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
-# don't set it here to avoid duplication.
-# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
-{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
-          - name: EXTERNAL_ISTIOD
-            value: "{{ .Values.global.externalIstiod }}"
-{{- end }}
-          - name: PILOT_ENABLE_ANALYSIS
-            value: "{{ .Values.global.istiod.enableAnalysis }}"
-          - name: CLUSTER_ID
-            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
-          - name: GOMEMLIMIT
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.memory
-          - name: GOMAXPROCS
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.cpu
-                divisor: "1"
-          - name: PLATFORM
-            value: "{{ coalesce .Values.global.platform .Values.platform }}"
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-              - ALL
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          volumeMounts:
-          - name: istio-token
-            mountPath: /var/run/secrets/tokens
-            readOnly: true
-          - name: local-certs
-            mountPath: /var/run/secrets/istio-dns
-          - name: cacerts
-            mountPath: /etc/cacerts
-            readOnly: true
-          - name: istio-kubeconfig
-            mountPath: /var/run/secrets/remote
-            readOnly: true
-          {{- if .Values.jwksResolverExtraRootCA }}
-          - name: extracacerts
-            mountPath: /cacerts
-          {{- end }}
-          - name: istio-csr-dns-cert
-            mountPath: /var/run/secrets/istiod/tls
-            readOnly: true
-          - name: istio-csr-ca-configmap
-            mountPath: /var/run/secrets/istiod/ca
-            readOnly: true
-          {{- with .Values.volumeMounts }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-      volumes:
-      # Technically not needed on this pod - but it helps debugging/testing SDS
-      # Should be removed after everything works.
-      - emptyDir:
-          medium: Memory
-        name: local-certs
-      - name: istio-token
-        projected:
-          sources:
-            - serviceAccountToken:
-                audience: {{ .Values.global.sds.token.aud }}
-                expirationSeconds: 43200
-                path: istio-token
-      # Optional: user-generated root
-      - name: cacerts
-        secret:
-          secretName: cacerts
-          optional: true
-      - name: istio-kubeconfig
-        secret:
-          secretName: istio-kubeconfig
-          optional: true
-      # Optional: istio-csr dns pilot certs
-      - name: istio-csr-dns-cert
-        secret:
-          secretName: istiod-tls
-          optional: true
-      - name: istio-csr-ca-configmap
-        configMap:
-          name: istio-ca-root-cert
-          defaultMode: 420
-          optional: true
-  {{- if .Values.jwksResolverExtraRootCA }}
-      - name: extracacerts
-        configMap:
-          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  {{- end }}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
-
----
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.25.3/charts/istiod/templates/istiod-injector-configmap.yaml
deleted file mode 100644
index 560c284ff..000000000
--- a/resources/v1.25.3/charts/istiod/templates/istiod-injector-configmap.yaml
+++ /dev/null
@@ -1,81 +0,0 @@
-{{- if not .Values.global.omitSidecarInjectorConfigMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
-  values: |-
-{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
-{{ $pilotVals := pick .Values "cni" -}}
-{{ $vals = set $vals "pilot" $pilotVals -}}
-{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
-{{ $vals = set $vals "gateways" $gatewayVals -}}
-{{ $vals | toPrettyJson | indent 4 }}
-
-  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
-  # and istiod webhook functionality.
-  #
-  # New fields should not use Values - it is a 'primary' config object, users should be able
-  # to fine tune it or use it with kube-inject.
-  config: |-
-    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
-    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
-    defaultTemplates:
-{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
-    - {{ . }}
-{{- end }}
-    {{- else }}
-    defaultTemplates: [sidecar]
-    {{- end }}
-    policy: {{ .Values.global.proxy.autoInject }}
-    alwaysInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
-    neverInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
-    injectedAnnotations:
-      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
-      "{{ $key }}": {{ $val | quote }}
-      {{- end }}
-    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
-         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
-         This should make it obvious that their installation is broken.
-     */}}
-    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
-    templates:
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
-      sidecar: |
-{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
-      gateway: |
-{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
-      grpc-simple: |
-{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
-      grpc-agent: |
-{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
-      waypoint: |
-{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
-      kube-gateway: |
-{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
-{{- end }}
-{{- with .Values.sidecarInjectorWebhook.templates }}
-{{ toYaml . | trim | indent 6 }}
-{{- end }}
-
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.25.3/charts/istiod/templates/mutatingwebhook.yaml
deleted file mode 100644
index 22160f70a..000000000
--- a/resources/v1.25.3/charts/istiod/templates/mutatingwebhook.yaml
+++ /dev/null
@@ -1,164 +0,0 @@
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- /* Core defines the common configuration used by all webhook segments */}}
-{{/* Copy just what we need to avoid expensive deepCopy */}}
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "caBundle" .Values.istiodRemote.injectionCABundle
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-    {{- if .caBundle }}
-    caBundle: "{{ .caBundle }}"
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  reinvocationPolicy: "{{ .reinvocationPolicy }}"
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
-{{- if not .Values.global.operatorManageWebhooks }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq .Release.Namespace "istio-system"}}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- else }}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
-
-{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
-{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-
-
-{{- /* Webhooks for default revision */}}
-{{- if (eq .Values.revision "") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.25.3/charts/istiod/templates/poddisruptionbudget.yaml
deleted file mode 100644
index 1eacf16e6..000000000
--- a/resources/v1.25.3/charts/istiod/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    istio: pilot
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app: istiod
-      {{- if ne .Values.revision "" }}
-      istio.io/rev: {{ .Values.revision | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.25.3/charts/istiod/templates/reader-clusterrole.yaml
deleted file mode 100644
index dbaa80503..000000000
--- a/resources/v1.25.3/charts/istiod/templates/reader-clusterrole.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - "config.istio.io"
-      - "security.istio.io"
-      - "networking.istio.io"
-      - "authentication.istio.io"
-      - "rbac.istio.io"
-      - "telemetry.istio.io"
-      - "extensions.istio.io"
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
-    resources: ["gateways"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: ["get", "list", "watch", "create", "delete"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["apps"]
-    resources: ["replicasets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-{{- if .Values.istiodRemote.enabled }}
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-{{- end}}
diff --git a/resources/v1.25.3/charts/istiod/templates/reader-clusterrolebinding.yaml b/resources/v1.25.3/charts/istiod/templates/reader-clusterrolebinding.yaml
deleted file mode 100644
index aea9f01f7..000000000
--- a/resources/v1.25.3/charts/istiod/templates/reader-clusterrolebinding.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istio-reader-service-account
-    namespace: {{ .Values.global.istioNamespace }}
diff --git a/resources/v1.25.3/charts/istiod/templates/remote-istiod-endpoints.yaml b/resources/v1.25.3/charts/istiod/templates/remote-istiod-endpoints.yaml
deleted file mode 100644
index a6de571da..000000000
--- a/resources/v1.25.3/charts/istiod/templates/remote-istiod-endpoints.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-# if the remotePilotAddress is an IP addr
-{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-subsets:
-- addresses:
-  - ip: {{ .Values.global.remotePilotAddress }}
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 15017
-    name: tcp-webhook
-    protocol: TCP
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/revision-tags.yaml b/resources/v1.25.3/charts/istiod/templates/revision-tags.yaml
deleted file mode 100644
index 607358aa0..000000000
--- a/resources/v1.25.3/charts/istiod/templates/revision-tags.yaml
+++ /dev/null
@@ -1,147 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/role.yaml b/resources/v1.25.3/charts/istiod/templates/role.yaml
deleted file mode 100644
index 10d89e8d1..000000000
--- a/resources/v1.25.3/charts/istiod/templates/role.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-# permissions to verify the webhook is ready and rejecting
-# invalid config. We use --server-dry-run so no config is persisted.
-- apiGroups: ["networking.istio.io"]
-  verbs: ["create"]
-  resources: ["gateways"]
-
-# For storing CA secret
-- apiGroups: [""]
-  resources: ["secrets"]
-  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
-  verbs: ["create", "get", "watch", "list", "update", "delete"]
-
-# For status controller, so it can delete the distribution report configmap
-- apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["delete"]
-
-# For gateway deployment controller
-- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
-  verbs: ["get", "update", "patch", "create"]
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/rolebinding.yaml b/resources/v1.25.3/charts/istiod/templates/rolebinding.yaml
deleted file mode 100644
index a42f4ec44..000000000
--- a/resources/v1.25.3/charts/istiod/templates/rolebinding.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/service.yaml b/resources/v1.25.3/charts/istiod/templates/service.yaml
deleted file mode 100644
index 30d5b8912..000000000
--- a/resources/v1.25.3/charts/istiod/templates/service.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  {{- if .Values.serviceAnnotations }}
-  annotations:
-{{ toYaml .Values.serviceAnnotations | indent 4 }}
-  {{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: istiod
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-    - port: 15010
-      name: grpc-xds # plaintext
-      protocol: TCP
-    - port: 15012
-      name: https-dns # mTLS with k8s-signed cert
-      protocol: TCP
-    - port: 443
-      name: https-webhook # validation and injection
-      targetPort: 15017
-      protocol: TCP
-    - port: 15014
-      name: http-monitoring # prometheus stats
-      protocol: TCP
-  selector:
-    app: istiod
-    {{- if ne .Values.revision "" }}
-    istio.io/rev: {{ .Values.revision | quote }}
-    {{- else }}
-    # Label used by the 'default' service. For versioned deployments we match with app and version.
-    # This avoids default deployment picking the canary
-    istio: pilot
-    {{- end }}
-  {{- if .Values.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.ipFamilyPolicy }}
-  {{- end }}
-  {{- if .Values.ipFamilies }}
-  ipFamilies:
-  {{- range .Values.ipFamilies }}
-  - {{ . }}
-  {{- end }}
-  {{- end }}
----
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/serviceaccount.yaml b/resources/v1.25.3/charts/istiod/templates/serviceaccount.yaml
deleted file mode 100644
index a673a4d07..000000000
--- a/resources/v1.25.3/charts/istiod/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-  {{- if .Values.serviceAccountAnnotations }}
-  annotations:
-{{- toYaml .Values.serviceAccountAnnotations | nindent 4 }}
-  {{- end }}
-{{- end }}
----
diff --git a/resources/v1.25.3/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.25.3/charts/istiod/templates/validatingadmissionpolicy.yaml
deleted file mode 100644
index d36eef68e..000000000
--- a/resources/v1.25.3/charts/istiod/templates/validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.experimental.stableValidationPolicy }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-policy-binding{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-spec:
-  policyName: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  validationActions: [Deny]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.25.3/charts/istiod/templates/validatingwebhookconfiguration.yaml
deleted file mode 100644
index fb28836a0..000000000
--- a/resources/v1.25.3/charts/istiod/templates/validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,68 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.global.configValidation }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  # Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
-  # are rejecting invalid configs on a per-revision basis.
-  - name: rev.validation.istio.io
-    clientConfig:
-      # Should change from base but cannot for API compat
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.3/charts/istiod/templates/zzy_descope_legacy.yaml b/resources/v1.25.3/charts/istiod/templates/zzy_descope_legacy.yaml
deleted file mode 100644
index ae8fced29..000000000
--- a/resources/v1.25.3/charts/istiod/templates/zzy_descope_legacy.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-{{/* Copy anything under `.pilot` to `.`, to avoid the need to specify a redundant prefix.
-Due to the file naming, this always happens after zzz_profile.yaml */}}
-{{- $_ := mustMergeOverwrite $.Values (index $.Values "pilot") }}
\ No newline at end of file
diff --git a/resources/v1.25.3/charts/istiod/values.yaml b/resources/v1.25.3/charts/istiod/values.yaml
deleted file mode 100644
index 4d17c7478..000000000
--- a/resources/v1.25.3/charts/istiod/values.yaml
+++ /dev/null
@@ -1,541 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-  # Set this if you install ztunnel with a name different from the default.
-  trustedZtunnelName: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.25.3
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.25.3/charts/revisiontags/Chart.yaml b/resources/v1.25.3/charts/revisiontags/Chart.yaml
deleted file mode 100644
index 6ddb8fc6e..000000000
--- a/resources/v1.25.3/charts/revisiontags/Chart.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.3
-description: Helm chart for istio revision tags
-name: revisiontags
-sources:
-- https://github.com/istio-ecosystem/sail-operator
-version: 0.1.0
-
diff --git a/resources/v1.25.3/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.25.3/charts/revisiontags/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.3/charts/revisiontags/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.3/charts/revisiontags/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.3/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.3/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/revisiontags/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.3/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.3/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/revisiontags/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.3/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.3/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/revisiontags/files/profile-platform-gke.yaml b/resources/v1.25.3/charts/revisiontags/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.3/charts/revisiontags/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.3/charts/revisiontags/files/profile-platform-k3d.yaml b/resources/v1.25.3/charts/revisiontags/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.3/charts/revisiontags/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.3/charts/revisiontags/files/profile-platform-microk8s.yaml b/resources/v1.25.3/charts/revisiontags/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.3/charts/revisiontags/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.3/charts/revisiontags/files/profile-platform-minikube.yaml b/resources/v1.25.3/charts/revisiontags/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.3/charts/revisiontags/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.3/charts/revisiontags/files/profile-platform-openshift.yaml b/resources/v1.25.3/charts/revisiontags/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.3/charts/revisiontags/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.3/charts/revisiontags/files/profile-preview.yaml b/resources/v1.25.3/charts/revisiontags/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.3/charts/revisiontags/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.3/charts/revisiontags/files/profile-remote.yaml b/resources/v1.25.3/charts/revisiontags/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.3/charts/revisiontags/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.3/charts/revisiontags/files/profile-stable.yaml b/resources/v1.25.3/charts/revisiontags/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.3/charts/revisiontags/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.3/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.25.3/charts/revisiontags/templates/revision-tags.yaml
deleted file mode 100644
index 607358aa0..000000000
--- a/resources/v1.25.3/charts/revisiontags/templates/revision-tags.yaml
+++ /dev/null
@@ -1,147 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.25.3/charts/revisiontags/values.yaml b/resources/v1.25.3/charts/revisiontags/values.yaml
deleted file mode 100644
index 4d17c7478..000000000
--- a/resources/v1.25.3/charts/revisiontags/values.yaml
+++ /dev/null
@@ -1,541 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-  # Set this if you install ztunnel with a name different from the default.
-  trustedZtunnelName: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.25.3
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.25.3/charts/ztunnel/Chart.yaml b/resources/v1.25.3/charts/ztunnel/Chart.yaml
deleted file mode 100644
index b44dfa39c..000000000
--- a/resources/v1.25.3/charts/ztunnel/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.3
-description: Helm chart for istio ztunnel components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-ztunnel
-- istio
-name: ztunnel
-sources:
-- https://github.com/istio/istio
-version: 1.25.3
diff --git a/resources/v1.25.3/charts/ztunnel/README.md b/resources/v1.25.3/charts/ztunnel/README.md
deleted file mode 100644
index ffe0b94fe..000000000
--- a/resources/v1.25.3/charts/ztunnel/README.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# Istio Ztunnel Helm Chart
-
-This chart installs an Istio ztunnel.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart:
-
-```console
-helm install ztunnel istio/ztunnel
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the chart:
-
-```console
-helm delete ztunnel
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/ztunnel
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.25.3/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.25.3/charts/ztunnel/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.3/charts/ztunnel/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.3/charts/ztunnel/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.3/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.3/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/ztunnel/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.3/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.3/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/ztunnel/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.3/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.3/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.3/charts/ztunnel/files/profile-platform-gke.yaml b/resources/v1.25.3/charts/ztunnel/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.3/charts/ztunnel/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.3/charts/ztunnel/files/profile-platform-k3d.yaml b/resources/v1.25.3/charts/ztunnel/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.3/charts/ztunnel/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.3/charts/ztunnel/files/profile-platform-microk8s.yaml b/resources/v1.25.3/charts/ztunnel/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.3/charts/ztunnel/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.3/charts/ztunnel/files/profile-platform-minikube.yaml b/resources/v1.25.3/charts/ztunnel/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.3/charts/ztunnel/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.3/charts/ztunnel/files/profile-platform-openshift.yaml b/resources/v1.25.3/charts/ztunnel/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.3/charts/ztunnel/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.3/charts/ztunnel/files/profile-preview.yaml b/resources/v1.25.3/charts/ztunnel/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.3/charts/ztunnel/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.3/charts/ztunnel/files/profile-remote.yaml b/resources/v1.25.3/charts/ztunnel/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.3/charts/ztunnel/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.3/charts/ztunnel/files/profile-stable.yaml b/resources/v1.25.3/charts/ztunnel/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.3/charts/ztunnel/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.3/charts/ztunnel/templates/NOTES.txt b/resources/v1.25.3/charts/ztunnel/templates/NOTES.txt
deleted file mode 100644
index 244f59db0..000000000
--- a/resources/v1.25.3/charts/ztunnel/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-ztunnel successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.25.3/charts/ztunnel/templates/_helpers.tpl b/resources/v1.25.3/charts/ztunnel/templates/_helpers.tpl
deleted file mode 100644
index 82740e441..000000000
--- a/resources/v1.25.3/charts/ztunnel/templates/_helpers.tpl
+++ /dev/null
@@ -1 +0,0 @@
-{{ define "ztunnel.release-name" }}{{ .Values.resourceName| default .Release.Name }}{{ end }}
diff --git a/resources/v1.25.3/charts/ztunnel/templates/daemonset.yaml b/resources/v1.25.3/charts/ztunnel/templates/daemonset.yaml
deleted file mode 100644
index ee5775d70..000000000
--- a/resources/v1.25.3/charts/ztunnel/templates/daemonset.yaml
+++ /dev/null
@@ -1,197 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: {{ include "ztunnel.release-name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-spec:
-  updateStrategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app: ztunnel
-  template:
-    metadata:
-      labels:
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app: ztunnel
-        app.kubernetes.io/name: ztunnel
-        {{- include "istio.labels" . | nindent 8}}
-{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-{{- if .Values.revision }}
-        istio.io/rev: {{ .Values.revision }}
-{{- end }}
-{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-{{- if .Values.nodeSelector }}
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- if .Values.affinity }}
-      affinity:
-{{ toYaml .Values.affinity | trim | indent 8 }}
-{{- end }}
-      serviceAccountName: {{ include "ztunnel.release-name" . }}
-      tolerations:
-        - effect: NoSchedule
-          operator: Exists
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      containers:
-      - name: istio-proxy
-{{- if contains "/" .Values.image }}
-        image: "{{ .Values.image }}"
-{{- else }}
-        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
-{{- end }}
-        ports:
-        - containerPort: 15020
-          name: ztunnel-stats
-          protocol: TCP
-        resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 10 }}
-{{- end }}
-{{- with .Values.imagePullPolicy }}
-        imagePullPolicy: {{ . }}
-{{- end }}
-        securityContext:
-          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
-          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
-          allowPrivilegeEscalation: true
-          privileged: false
-          capabilities:
-            drop:
-            - ALL
-            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
-            - NET_ADMIN # Required for TPROXY and setsockopt
-            - SYS_ADMIN # Required for `setns` - doing things in other netns
-            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
-          readOnlyRootFilesystem: true
-          runAsGroup: 1337
-          runAsNonRoot: false
-          runAsUser: 0
-{{- if .Values.seLinuxOptions }}
-          seLinuxOptions:
-{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
-{{- end }}
-        readinessProbe:
-          httpGet:
-            port: 15021
-            path: /healthz/ready
-        args:
-        - proxy
-        - ztunnel
-        env:
-        - name: CA_ADDRESS
-        {{- if .Values.caAddress }}
-          value: {{ .Values.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: XDS_ADDRESS
-        {{- if .Values.xdsAddress }}
-          value: {{ .Values.xdsAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        {{- if .Values.logAsJson }}
-        - name: LOG_FORMAT
-          value: json
-        {{- end}}
-        - name: RUST_LOG
-          value: {{ .Values.logLevel | quote }}
-        - name: RUST_BACKTRACE
-          value: "1"
-        - name: ISTIO_META_CLUSTER_ID
-          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
-        - name: INPOD_ENABLED
-          value: "true"
-        - name: TERMINATION_GRACE_PERIOD_SECONDS
-          value: "{{ .Values.terminationGracePeriodSeconds }}"
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
-        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        {{- with .Values.env }}
-        {{- range $key, $val := . }}
-        - name: {{ $key }}
-          value: "{{ $val }}"
-        {{- end }}
-        {{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /var/run/ztunnel
-          name: cni-ztunnel-sock-dir
-        - mountPath: /tmp
-          name: tmp
-        {{- with .Values.volumeMounts }}
-          {{- toYaml . | nindent 8 }}
-        {{- end }}
-      priorityClassName: system-node-critical
-      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
-      volumes:
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: istio-ca
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      - name: cni-ztunnel-sock-dir
-        hostPath:
-          path: /var/run/ztunnel
-          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
-      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
-      - name: tmp
-        emptyDir: {}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
diff --git a/resources/v1.25.3/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.25.3/charts/ztunnel/templates/zzz_profile.yaml
deleted file mode 100644
index ded66c5fd..000000000
--- a/resources/v1.25.3/charts/ztunnel/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.3/charts/ztunnel/values.yaml b/resources/v1.25.3/charts/ztunnel/values.yaml
deleted file mode 100644
index 2d00f2d7e..000000000
--- a/resources/v1.25.3/charts/ztunnel/values.yaml
+++ /dev/null
@@ -1,102 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
-  hub: gcr.io/istio-release
-  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
-  tag: 1.25.3
-  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
-  variant: ""
-
-  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
-  # If Image contains a "/", it will replace the entire `image` in the pod.
-  image: ztunnel
-
-  # resourceName, if set, will override the naming of resources. If not set, will default to the release name.
-  # It is recommended to not set this; this is primarily for backwards compatibility.
-  resourceName: ""
-
-  # Labels to apply to all top level resources
-  labels: {}
-  # Annotations to apply to all top level resources
-  annotations: {}
-
-  # Additional volumeMounts to the ztunnel container
-  volumeMounts: []
-
-  # Additional volumes to the ztunnel pod
-  volumes: []
-
-  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-
-  # Additional labels to apply on the pod level
-  podLabels: {}
-
-  # Pod resource configuration
-  resources:
-    requests:
-      cpu: 200m
-      # Ztunnel memory scales with the size of the cluster and traffic load
-      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
-      memory: 512Mi
-
-  # List of secret names to add to the service account as image pull secrets
-  imagePullSecrets: []
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
-
-  # Override for the pod imagePullPolicy
-  imagePullPolicy: ""
-
-  # Settings for multicluster
-  multiCluster:
-    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
-    # with Istiod configuration.
-    clusterName: ""
-
-  # meshConfig defines runtime configuration of components.
-  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
-  # components.
-  # TODO: https://github.com/istio/istio/issues/43248
-  meshConfig:
-    defaultConfig:
-      proxyMetadata: {}
-
-  # This value defines:
-  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
-  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
-  # Default K8S value is 30 seconds
-  terminationGracePeriodSeconds: 30
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
-  revision: ""
-
-  # The customized CA address to retrieve certificates for the pods in the cluster.
-  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-  caAddress: ""
-
-  # The customized XDS address to retrieve configuration.
-  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
-  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
-  xdsAddress: ""
-
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
-  istioNamespace: istio-system
-
-  # Configuration log level of ztunnel binary, default is info.
-  # Valid values are: trace, debug, info, warn, error
-  logLevel: info
-
-  # To output all logs in json format
-  logAsJson: false
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seLinuxOptions: {}
-  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
-  #seLinuxOptions:
-  #  type: spc_t
diff --git a/resources/v1.25.3/cni-1.25.3.tgz.etag b/resources/v1.25.3/cni-1.25.3.tgz.etag
deleted file mode 100644
index 1597c3c70..000000000
--- a/resources/v1.25.3/cni-1.25.3.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-f0924275ec5432928e3712fb67bcc2fb
diff --git a/resources/v1.25.3/commit b/resources/v1.25.3/commit
deleted file mode 100644
index 5bb76b575..000000000
--- a/resources/v1.25.3/commit
+++ /dev/null
@@ -1 +0,0 @@
-1.25.3
diff --git a/resources/v1.25.3/gateway-1.25.3.tgz.etag b/resources/v1.25.3/gateway-1.25.3.tgz.etag
deleted file mode 100644
index 31851c7f8..000000000
--- a/resources/v1.25.3/gateway-1.25.3.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-87272c280976a183a627a79637adcfe1
diff --git a/resources/v1.25.3/istiod-1.25.3.tgz.etag b/resources/v1.25.3/istiod-1.25.3.tgz.etag
deleted file mode 100644
index 80c4bed3b..000000000
--- a/resources/v1.25.3/istiod-1.25.3.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-30885f01a467b94484c7ae7adddba2f0
diff --git a/resources/v1.25.3/profiles/ambient.yaml b/resources/v1.25.3/profiles/ambient.yaml
deleted file mode 100644
index 71ea784a8..000000000
--- a/resources/v1.25.3/profiles/ambient.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: ambient
diff --git a/resources/v1.25.3/profiles/demo.yaml b/resources/v1.25.3/profiles/demo.yaml
deleted file mode 100644
index 53c4b4163..000000000
--- a/resources/v1.25.3/profiles/demo.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: demo
diff --git a/resources/v1.25.3/profiles/empty.yaml b/resources/v1.25.3/profiles/empty.yaml
deleted file mode 100644
index 4477cb1fe..000000000
--- a/resources/v1.25.3/profiles/empty.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-# The empty profile has everything disabled
-# This is useful as a base for custom user configuration
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec: {}
diff --git a/resources/v1.25.3/profiles/openshift-ambient.yaml b/resources/v1.25.3/profiles/openshift-ambient.yaml
deleted file mode 100644
index 76edf00cd..000000000
--- a/resources/v1.25.3/profiles/openshift-ambient.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: ambient
-    global:
-      platform: openshift
diff --git a/resources/v1.25.3/profiles/openshift.yaml b/resources/v1.25.3/profiles/openshift.yaml
deleted file mode 100644
index 41492660f..000000000
--- a/resources/v1.25.3/profiles/openshift.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    global:
-      platform: openshift
diff --git a/resources/v1.25.3/profiles/preview.yaml b/resources/v1.25.3/profiles/preview.yaml
deleted file mode 100644
index 59d545c84..000000000
--- a/resources/v1.25.3/profiles/preview.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: preview
diff --git a/resources/v1.25.3/profiles/remote.yaml b/resources/v1.25.3/profiles/remote.yaml
deleted file mode 100644
index 54c65c8ba..000000000
--- a/resources/v1.25.3/profiles/remote.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# The remote profile is used to configure a mesh cluster without a locally deployed control plane.
-# Only the injector mutating webhook configuration is installed.
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: remote
diff --git a/resources/v1.25.3/profiles/stable.yaml b/resources/v1.25.3/profiles/stable.yaml
deleted file mode 100644
index 285feba24..000000000
--- a/resources/v1.25.3/profiles/stable.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: stable
diff --git a/resources/v1.25.3/ztunnel-1.25.3.tgz.etag b/resources/v1.25.3/ztunnel-1.25.3.tgz.etag
deleted file mode 100644
index 08ce494d6..000000000
--- a/resources/v1.25.3/ztunnel-1.25.3.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-e2dcb41e5a253305b067e3de90606800
diff --git a/resources/v1.25.4/base-1.25.4.tgz.etag b/resources/v1.25.4/base-1.25.4.tgz.etag
deleted file mode 100644
index 8bd620ff6..000000000
--- a/resources/v1.25.4/base-1.25.4.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-055aef98aaefe0616cc6f9665394cee9
diff --git a/resources/v1.25.4/charts/base/Chart.yaml b/resources/v1.25.4/charts/base/Chart.yaml
deleted file mode 100644
index 565bdb977..000000000
--- a/resources/v1.25.4/charts/base/Chart.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.4
-description: Helm chart for deploying Istio cluster resources and CRDs
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-name: base
-sources:
-- https://github.com/istio/istio
-version: 1.25.4
diff --git a/resources/v1.25.4/charts/base/README.md b/resources/v1.25.4/charts/base/README.md
deleted file mode 100644
index ae8f6d5b0..000000000
--- a/resources/v1.25.4/charts/base/README.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Istio base Helm Chart
-
-This chart installs resources shared by all Istio revisions. This includes Istio CRDs.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-base`:
-
-```console
-kubectl create namespace istio-system
-helm install istio-base istio/base -n istio-system
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.25.4/charts/base/files/profile-ambient.yaml b/resources/v1.25.4/charts/base/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.4/charts/base/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.4/charts/base/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.4/charts/base/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.4/charts/base/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/base/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.4/charts/base/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.4/charts/base/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/base/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.4/charts/base/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.4/charts/base/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/base/files/profile-platform-gke.yaml b/resources/v1.25.4/charts/base/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.4/charts/base/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.4/charts/base/files/profile-platform-k3d.yaml b/resources/v1.25.4/charts/base/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.4/charts/base/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.4/charts/base/files/profile-platform-microk8s.yaml b/resources/v1.25.4/charts/base/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.4/charts/base/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.4/charts/base/files/profile-platform-minikube.yaml b/resources/v1.25.4/charts/base/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.4/charts/base/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.4/charts/base/files/profile-platform-openshift.yaml b/resources/v1.25.4/charts/base/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.4/charts/base/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.4/charts/base/files/profile-preview.yaml b/resources/v1.25.4/charts/base/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.4/charts/base/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.4/charts/base/files/profile-remote.yaml b/resources/v1.25.4/charts/base/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.4/charts/base/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.4/charts/base/files/profile-stable.yaml b/resources/v1.25.4/charts/base/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.4/charts/base/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.4/charts/base/templates/NOTES.txt b/resources/v1.25.4/charts/base/templates/NOTES.txt
deleted file mode 100644
index f12616f57..000000000
--- a/resources/v1.25.4/charts/base/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-Istio base successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.25.4/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml b/resources/v1.25.4/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
deleted file mode 100644
index 2616b09c9..000000000
--- a/resources/v1.25.4/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,53 +0,0 @@
-{{- if and .Values.experimental.stableValidationPolicy (not (eq .Values.defaultRevision "")) }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-default-policy.istio.io"
-  labels:
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision }}
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-default-policy-binding.istio.io"
-spec:
-  policyName: "stable-channel-default-policy.istio.io"
-  validationActions: [Deny]
-{{- end }}
diff --git a/resources/v1.25.4/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml b/resources/v1.25.4/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
deleted file mode 100644
index 8cb76fd77..000000000
--- a/resources/v1.25.4/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-{{- if not (eq .Values.defaultRevision "") }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istiod-default-validator
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  - name: validation.istio.io
-    clientConfig:
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        {{- if (eq .Values.defaultRevision "default") }}
-        name: istiod
-        {{- else }}
-        name: istiod-{{ .Values.defaultRevision }}
-        {{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-{{- end }}
diff --git a/resources/v1.25.4/charts/base/templates/reader-serviceaccount.yaml b/resources/v1.25.4/charts/base/templates/reader-serviceaccount.yaml
deleted file mode 100644
index ba829a6bf..000000000
--- a/resources/v1.25.4/charts/base/templates/reader-serviceaccount.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-# This singleton service account aggregates reader permissions for the revisions in a given cluster
-# ATM this is a singleton per cluster with Istio installed, and is not revisioned. It maybe should be,
-# as otherwise compromising the token for this SA would give you access to *every* installed revision.
-# Should be used for remote secret creation.
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-    {{- end }}
-    {{- end }}
-metadata:
-  name: istio-reader-service-account
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.25.4/charts/base/templates/zzz_profile.yaml b/resources/v1.25.4/charts/base/templates/zzz_profile.yaml
deleted file mode 100644
index 9c2119b9a..000000000
--- a/resources/v1.25.4/charts/base/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.4/charts/cni/Chart.yaml b/resources/v1.25.4/charts/cni/Chart.yaml
deleted file mode 100644
index bcf8b9d2b..000000000
--- a/resources/v1.25.4/charts/cni/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.4
-description: Helm chart for istio-cni components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-cni
-- istio
-name: cni
-sources:
-- https://github.com/istio/istio
-version: 1.25.4
diff --git a/resources/v1.25.4/charts/cni/README.md b/resources/v1.25.4/charts/cni/README.md
deleted file mode 100644
index a8b78d5bd..000000000
--- a/resources/v1.25.4/charts/cni/README.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# Istio CNI Helm Chart
-
-This chart installs the Istio CNI Plugin. See the [CNI installation guide](https://istio.io/latest/docs/setup/additional-setup/cni/)
-for more information.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-cni`:
-
-```console
-helm install istio-cni istio/cni -n kube-system
-```
-
-Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
-`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
-'system-node-critical' outside of kube-system.
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istio-cni
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Ambient
-
-To enable ambient, you can use the ambient profile: `--set profile=ambient`.
-
-#### Calico
-
-For Calico, you must also modify the settings to allow source spoofing:
-
-- if deployed by operator,  `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`
-- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )
-
-### GKE notes
-
-On GKE, 'kube-system' is required.
-
-If using `helm template`, `--set cni.cniBinDir=/home/kubernetes/bin` is required - with `helm install`
-it is auto-detected.
diff --git a/resources/v1.25.4/charts/cni/files/profile-ambient.yaml b/resources/v1.25.4/charts/cni/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.4/charts/cni/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.4/charts/cni/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.4/charts/cni/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.4/charts/cni/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/cni/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.4/charts/cni/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.4/charts/cni/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/cni/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.4/charts/cni/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.4/charts/cni/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/cni/files/profile-platform-gke.yaml b/resources/v1.25.4/charts/cni/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.4/charts/cni/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.4/charts/cni/files/profile-platform-k3d.yaml b/resources/v1.25.4/charts/cni/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.4/charts/cni/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.4/charts/cni/files/profile-platform-microk8s.yaml b/resources/v1.25.4/charts/cni/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.4/charts/cni/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.4/charts/cni/files/profile-platform-minikube.yaml b/resources/v1.25.4/charts/cni/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.4/charts/cni/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.4/charts/cni/files/profile-platform-openshift.yaml b/resources/v1.25.4/charts/cni/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.4/charts/cni/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.4/charts/cni/files/profile-preview.yaml b/resources/v1.25.4/charts/cni/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.4/charts/cni/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.4/charts/cni/files/profile-remote.yaml b/resources/v1.25.4/charts/cni/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.4/charts/cni/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.4/charts/cni/files/profile-stable.yaml b/resources/v1.25.4/charts/cni/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.4/charts/cni/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.4/charts/cni/templates/NOTES.txt b/resources/v1.25.4/charts/cni/templates/NOTES.txt
deleted file mode 100644
index fb35525b9..000000000
--- a/resources/v1.25.4/charts/cni/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-"{{ .Release.Name }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.25.4/charts/cni/templates/_helpers.tpl b/resources/v1.25.4/charts/cni/templates/_helpers.tpl
deleted file mode 100644
index 73cc17b2f..000000000
--- a/resources/v1.25.4/charts/cni/templates/_helpers.tpl
+++ /dev/null
@@ -1,8 +0,0 @@
-{{- define "name" -}}
-    istio-cni
-{{- end }}
-
-
-{{- define "istio-tag" -}}
-    {{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}
-{{- end }}
diff --git a/resources/v1.25.4/charts/cni/templates/clusterrolebinding.yaml b/resources/v1.25.4/charts/cni/templates/clusterrolebinding.yaml
deleted file mode 100644
index 42fedab1f..000000000
--- a/resources/v1.25.4/charts/cni/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-repair-rolebinding
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-repair-role
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "name" . }}
-    namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-ambient
-{{- end }}
diff --git a/resources/v1.25.4/charts/cni/templates/daemonset.yaml b/resources/v1.25.4/charts/cni/templates/daemonset.yaml
deleted file mode 100644
index d83c77fce..000000000
--- a/resources/v1.25.4/charts/cni/templates/daemonset.yaml
+++ /dev/null
@@ -1,241 +0,0 @@
-# This manifest installs the Istio install-cni container, as well
-# as the Istio CNI plugin and config on
-# each master and worker node in a Kubernetes cluster.
-#
-# $detectedBinDir exists to support a GKE-specific platform override,
-# and is deprecated in favor of using the explicit `gke` platform profile.
-{{- $detectedBinDir := (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
-    "/home/kubernetes/bin"
-    "/opt/cni/bin"
-}}
-{{- if .Values.cniBinDir }}
-{{ $detectedBinDir = .Values.cniBinDir }}
-{{- end }}
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  # Note that this is templated but evaluates to a fixed name
-  # which the CNI plugin may fall back onto in some failsafe scenarios.
-  # if this name is changed, CNI plugin logic that checks for this name
-  # format should also be updated.
-  name: {{ template "name" . }}-node
-  namespace: {{ .Release.Namespace }}
-  labels:
-    k8s-app: {{ template "name" . }}-node
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  selector:
-    matchLabels:
-      k8s-app: {{ template "name" . }}-node
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  template:
-    metadata:
-      labels:
-        k8s-app: {{ template "name" . }}-node
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: {{ template "name" . }}
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-        # Add Prometheus Scrape annotations
-        prometheus.io/scrape: 'true'
-        prometheus.io/port: "15014"
-        prometheus.io/path: '/metrics'
-        # Add AppArmor annotation
-        # This is required to avoid conflicts with AppArmor profiles which block certain
-        # privileged pod capabilities.
-        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
-        # securityContext which is otherwise preferred.
-        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
-        # Custom annotations
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{if .Values.ambient.enabled }}
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-{{ end }}
-      nodeSelector:
-        kubernetes.io/os: linux
-      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      tolerations:
-        # Make sure istio-cni-node gets scheduled on all nodes.
-        - effect: NoSchedule
-          operator: Exists
-        # Mark the pod as a critical add-on for rescheduling.
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      priorityClassName: system-node-critical
-      serviceAccountName: {{ template "name" . }}
-      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
-      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
-      terminationGracePeriodSeconds: 5
-      containers:
-        # This container installs the Istio CNI binaries
-        # and CNI network config file on each node.
-        - name: install-cni
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
-{{- end }}
-{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
-{{- end }}
-          ports:
-          - containerPort: 15014
-            name: metrics
-            protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8000
-          securityContext:
-            privileged: false
-            runAsGroup: 0
-            runAsUser: 0
-            runAsNonRoot: false
-            # Both ambient and sidecar repair mode require elevated node privileges to function.
-            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
-            # add capabilities based on feature.
-            capabilities:
-              drop:
-              - ALL
-              add:
-              # CAP_NET_ADMIN is required to allow ipset and route table access
-              - NET_ADMIN
-              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
-              - NET_RAW
-              # CAP_SYS_PTRACE is required for repair and ambient mode to describe
-              # the pod's network namespace.
-              - SYS_PTRACE
-              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
-              # network namespaces in `/proc` to obtain descriptors for entering pod network
-              # namespaces. There does not appear to be a more granular capability for this.
-              - SYS_ADMIN
-              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
-              # the typical ability to read/write to folders owned by others.
-              # This can cause problems if the hostPath mounts we use, which we require write access into,
-              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
-              - DAC_OVERRIDE
-{{- if .Values.seLinuxOptions }}
-{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
-            seLinuxOptions:
-{{ toYaml . | trim | indent 14 }}
-{{- end }}
-{{- end }}
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          command: ["install-cni"]
-          args:
-            {{- if or .Values.logging.level .Values.global.logging.level }}
-            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
-            {{- end}}
-            {{- if .Values.global.logAsJson }}
-            - --log_as_json
-            {{- end}}
-          envFrom:
-            - configMapRef:
-                name: {{ template "name" . }}-config
-          env:
-            - name: REPAIR_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: REPAIR_RUN_AS_DAEMON
-              value: "true"
-            - name: REPAIR_SIDECAR_ANNOTATION
-              value: "sidecar.istio.io/status"
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  apiVersion: v1
-                  fieldPath: spec.nodeName
-            - name: GOMEMLIMIT
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.memory
-            - name: GOMAXPROCS
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.cpu
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          volumeMounts:
-            - mountPath: /host/opt/cni/bin
-              name: cni-bin-dir
-            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-            - mountPath: /host/proc
-              name: cni-host-procfs
-              readOnly: true
-            {{- end }}
-            - mountPath: /host/etc/cni/net.d
-              name: cni-net-dir
-            - mountPath: /var/run/istio-cni
-              name: cni-socket-dir
-            {{- if .Values.ambient.enabled }}
-            - mountPath: /host/var/run/netns
-              mountPropagation: HostToContainer
-              name: cni-netns-dir
-            - mountPath: /var/run/ztunnel
-              name: cni-ztunnel-sock-dir
-            {{ end }}
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-      volumes:
-        # Used to install CNI.
-        - name: cni-bin-dir
-          hostPath:
-            path: {{ $detectedBinDir }}
-        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-        - name: cni-host-procfs
-          hostPath:
-            path: /proc
-            type: Directory
-        {{- end }}
-        {{- if .Values.ambient.enabled }}
-        - name: cni-ztunnel-sock-dir
-          hostPath:
-            path: /var/run/ztunnel
-            type: DirectoryOrCreate
-        {{- end }}
-        - name: cni-net-dir
-          hostPath:
-            path: {{ .Values.cniConfDir }}
-        # Used for UDS sockets for logging, ambient eventing
-        - name: cni-socket-dir
-          hostPath:
-            path: /var/run/istio-cni
-        - name: cni-netns-dir
-          hostPath:
-            path: {{ .Values.cniNetnsDir }}
-            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
-            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
-            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.25.4/charts/cni/templates/network-attachment-definition.yaml b/resources/v1.25.4/charts/cni/templates/network-attachment-definition.yaml
deleted file mode 100644
index 86a2eb7c0..000000000
--- a/resources/v1.25.4/charts/cni/templates/network-attachment-definition.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-{{- if eq .Values.provider "multus" }}
-apiVersion: k8s.cni.cncf.io/v1
-kind: NetworkAttachmentDefinition
-metadata:
-  name: {{ template "name" . }}
-  namespace: default
-  labels:
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/cni/templates/resourcequota.yaml b/resources/v1.25.4/charts/cni/templates/resourcequota.yaml
deleted file mode 100644
index 9a6d61ff9..000000000
--- a/resources/v1.25.4/charts/cni/templates/resourcequota.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-{{- if .Values.resourceQuotas.enabled }}
-apiVersion: v1
-kind: ResourceQuota
-metadata:
-  name: {{ template "name" . }}-resource-quota
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  hard:
-    pods: {{ .Values.resourceQuotas.pods | quote }}
-  scopeSelector:
-    matchExpressions:
-    - operator: In
-      scopeName: PriorityClass
-      values:
-      - system-node-critical
-{{- end }}
diff --git a/resources/v1.25.4/charts/cni/templates/serviceaccount.yaml b/resources/v1.25.4/charts/cni/templates/serviceaccount.yaml
deleted file mode 100644
index 3193d7b74..000000000
--- a/resources/v1.25.4/charts/cni/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-{{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-{{- end }}
-{{- end }}
-metadata:
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.25.4/charts/cni/templates/zzy_descope_legacy.yaml b/resources/v1.25.4/charts/cni/templates/zzy_descope_legacy.yaml
deleted file mode 100644
index a9584ac29..000000000
--- a/resources/v1.25.4/charts/cni/templates/zzy_descope_legacy.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-{{/* Copy anything under `.cni` to `.`, to avoid the need to specify a redundant prefix.
-Due to the file naming, this always happens after zzz_profile.yaml */}}
-{{- $_ := mustMergeOverwrite $.Values (index $.Values "cni") }}
\ No newline at end of file
diff --git a/resources/v1.25.4/charts/cni/templates/zzz_profile.yaml b/resources/v1.25.4/charts/cni/templates/zzz_profile.yaml
deleted file mode 100644
index 9c2119b9a..000000000
--- a/resources/v1.25.4/charts/cni/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.4/charts/cni/values.yaml b/resources/v1.25.4/charts/cni/values.yaml
deleted file mode 100644
index 6ebd3d08f..000000000
--- a/resources/v1.25.4/charts/cni/values.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  hub: ""
-  tag: ""
-  variant: ""
-  image: install-cni
-  pullPolicy: ""
-
-  # Same as `global.logging.level`, but will override it if set
-  logging:
-    level: ""
-
-  # Configuration file to insert istio-cni plugin configuration
-  # by default this will be the first file found in the cni-conf-dir
-  # Example
-  # cniConfFileName: 10-calico.conflist
-
-  # CNI-and-platform specific path defaults.
-  # These may need to be set to platform-specific values, consult
-  # overrides for your platform in `manifests/helm-profiles/platform-*.yaml`
-  cniBinDir: /opt/cni/bin
-  cniConfDir: /etc/cni/net.d
-  cniConfFileName: ""
-  cniNetnsDir: "/var/run/netns"
-
-  excludeNamespaces:
-    - kube-system
-
-  # Allows user to set custom affinity for the DaemonSet
-  affinity: {}
-
-  # Custom annotations on pod level, if you need them
-  podAnnotations: {}
-
-  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
-  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
-  chained: true
-
-  # Custom configuration happens based on the CNI provider.
-  # Possible values: "default", "multus"
-  provider: "default"
-
-  # Configure ambient settings
-  ambient:
-    # If enabled, ambient redirection will be enabled
-    enabled: false
-    # Set ambient config dir path: defaults to /etc/ambient-config
-    configDir: ""
-    # If enabled, and ambient is enabled, DNS redirection will be enabled
-    dnsCapture: true
-    # If enabled, and ambient is enabled, enables ipv6 support
-    ipv6: true
-    # If enabled, and ambient is enabled, the CNI agent will reconcile incompatible iptables rules and chains at startup.
-    # This will eventually be enabled by default
-    reconcileIptablesOnStartup: false
-
-
-  repair:
-    enabled: true
-    hub: ""
-    tag: ""
-
-    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
-    # This defines the action the controller will take when a pod is detected as broken.
-
-    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
-    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
-    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
-    labelPods: false
-    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
-    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
-    deletePods: false
-    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
-    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
-    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
-    repairPods: true
-
-    initContainerName: "istio-validation"
-
-    brokenPodLabelKey: "cni.istio.io/uninitialized"
-    brokenPodLabelValue: "true"
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
-  seLinuxOptions: {}
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 100Mi
-
-  resourceQuotas:
-    enabled: false
-    pods: 5000
-
-  # The number of pods that can be unavailable during rolling update (see
-  # `updateStrategy.rollingUpdate.maxUnavailable` here:
-  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
-  # May be specified as a number of pods or as a percent of the total number
-  # of pods at the start of the update.
-  rollingMaxUnavailable: 1
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  global:
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-
-    # Default tag for Istio images.
-    tag: 1.25.4
-
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # change cni scope level to control logging out of istio-cni-node DaemonSet
-    logging:
-      level: info
-
-    logAsJson: false
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Default resources allocated
-    defaultResources:
-      requests:
-        cpu: 100m
-        memory: 100Mi
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
diff --git a/resources/v1.25.4/charts/gateway/Chart.yaml b/resources/v1.25.4/charts/gateway/Chart.yaml
deleted file mode 100644
index 0cb14fb66..000000000
--- a/resources/v1.25.4/charts/gateway/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.4
-description: Helm chart for deploying Istio gateways
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- gateways
-name: gateway
-sources:
-- https://github.com/istio/istio
-type: application
-version: 1.25.4
diff --git a/resources/v1.25.4/charts/gateway/README.md b/resources/v1.25.4/charts/gateway/README.md
deleted file mode 100644
index 5c064d165..000000000
--- a/resources/v1.25.4/charts/gateway/README.md
+++ /dev/null
@@ -1,170 +0,0 @@
-# Istio Gateway Helm Chart
-
-This chart installs an Istio gateway deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-ingressgateway`:
-
-```console
-helm install istio-ingressgateway istio/gateway
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istio-ingressgateway` deployment:
-
-```console
-helm delete istio-ingressgateway
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/gateway
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### OpenShift
-
-When deploying the gateway in an OpenShift cluster, use the `openshift` profile to override the default values, for example:
-
-```console
-helm install istio-ingressgateway istio/gateway --set profile=openshift
-```
-
-### `image: auto` Information
-
-The image used by the chart, `auto`, may be unintuitive.
-This exists because the pod spec will be automatically populated at runtime, using the same mechanism as [Sidecar Injection](istio.io/latest/docs/setup/additional-setup/sidecar-injection).
-This allows the same configurations and lifecycle to apply to gateways as sidecars.
-
-Note: this does mean that the namespace the gateway is deployed in must not have the `istio-injection=disabled` label.
-See [Controlling the injection policy](https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy) for more info.
-
-### Examples
-
-#### Egress Gateway
-
-Deploying a Gateway to be used as an [Egress Gateway](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/):
-
-```yaml
-service:
-  # Egress gateways do not need an external LoadBalancer IP
-  type: ClusterIP
-```
-
-#### Multi-network/VM Gateway
-
-Deploying a Gateway to be used as a [Multi-network Gateway](https://istio.io/latest/docs/setup/install/multicluster/) for network `network-1`:
-
-```yaml
-networkGateway: network-1
-```
-
-### Migrating from other installation methods
-
-Installations from other installation methods (such as istioctl, Istio Operator, other helm charts, etc) can be migrated to use the new Helm charts
-following the guidance below.
-If you are able to, a clean installation is simpler. However, this often requires an external IP migration which can be challenging.
-
-WARNING: when installing over an existing deployment, the two deployments will be merged together by Helm, which may lead to unexpected results.
-
-#### Legacy Gateway Helm charts
-
-Istio historically offered two different charts - `manifests/charts/gateways/istio-ingress` and `manifests/charts/gateways/istio-egress`.
-These are replaced by this chart.
-While not required, it is recommended all new users use this chart, and existing users migrate when possible.
-
-This chart has the following benefits and differences:
-* Designed with Helm best practices in mind (standardized values options, values schema, values are not all nested under `gateways.istio-ingressgateway.*`, release name and namespace taken into account, etc).
-* Utilizes Gateway injection, simplifying upgrades, allowing gateways to run in any namespace, and avoiding repeating config for sidecars and gateways.
-* Published to official Istio Helm repository.
-* Single chart for all gateways (Ingress, Egress, East West).
-
-#### General concerns
-
-For a smooth migration, the resource names and `Deployment.spec.selector` labels must match.
-
-If you install with `helm install istio-gateway istio/gateway`, resources will be named `istio-gateway` and the `selector` labels set to:
-
-```yaml
-app: istio-gateway
-istio: gateway # the release name with leading istio- prefix stripped
-```
-
-If your existing installation doesn't follow these names, you can override them. For example, if you have resources named `my-custom-gateway` with `selector` labels
-`foo=bar,istio=ingressgateway`:
-
-```yaml
-name: my-custom-gateway # Override the name to match existing resources
-labels:
-  app: "" # Unset default app selector label
-  istio: ingressgateway # override default istio selector label
-  foo: bar # Add the existing custom selector label
-```
-
-#### Migrating an existing Helm release
-
-An existing helm release can be `helm upgrade`d to this chart by using the same release name. For example, if a previous
-installation was done like:
-
-```console
-helm install istio-ingress manifests/charts/gateways/istio-ingress -n istio-system
-```
-
-It could be upgraded with
-
-```console
-helm upgrade istio-ingress manifests/charts/gateway -n istio-system --set name=istio-ingressgateway --set labels.app=istio-ingressgateway --set labels.istio=ingressgateway
-```
-
-Note the name and labels are overridden to match the names of the existing installation.
-
-Warning: the helm charts here default to using port 80 and 443, while the old charts used 8080 and 8443.
-If you have AuthorizationPolicies that reference port these ports, you should update them during this process,
-or customize the ports to match the old defaults.
-See the [security advisory](https://istio.io/latest/news/security/istio-security-2021-002/) for more information.
-
-#### Other migrations
-
-If you see errors like `rendered manifests contain a resource that already exists` during installation, you may need to forcibly take ownership.
-
-The script below can handle this for you. Replace `RELEASE` and `NAMESPACE` with the name and namespace of the release:
-
-```console
-KINDS=(service deployment)
-RELEASE=istio-ingressgateway
-NAMESPACE=istio-system
-for KIND in "${KINDS[@]}"; do
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-name=$RELEASE
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-namespace=$NAMESPACE
-    kubectl --namespace $NAMESPACE --overwrite=true label $KIND $RELEASE app.kubernetes.io/managed-by=Helm
-done
-```
-
-You may ignore errors about resources not being found.
diff --git a/resources/v1.25.4/charts/gateway/files/profile-ambient.yaml b/resources/v1.25.4/charts/gateway/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.4/charts/gateway/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.4/charts/gateway/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.4/charts/gateway/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.4/charts/gateway/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/gateway/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.4/charts/gateway/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.4/charts/gateway/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/gateway/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.4/charts/gateway/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.4/charts/gateway/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/gateway/files/profile-platform-gke.yaml b/resources/v1.25.4/charts/gateway/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.4/charts/gateway/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.4/charts/gateway/files/profile-platform-k3d.yaml b/resources/v1.25.4/charts/gateway/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.4/charts/gateway/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.4/charts/gateway/files/profile-platform-microk8s.yaml b/resources/v1.25.4/charts/gateway/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.4/charts/gateway/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.4/charts/gateway/files/profile-platform-minikube.yaml b/resources/v1.25.4/charts/gateway/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.4/charts/gateway/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.4/charts/gateway/files/profile-platform-openshift.yaml b/resources/v1.25.4/charts/gateway/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.4/charts/gateway/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.4/charts/gateway/files/profile-preview.yaml b/resources/v1.25.4/charts/gateway/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.4/charts/gateway/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.4/charts/gateway/files/profile-remote.yaml b/resources/v1.25.4/charts/gateway/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.4/charts/gateway/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.4/charts/gateway/files/profile-stable.yaml b/resources/v1.25.4/charts/gateway/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.4/charts/gateway/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.4/charts/gateway/templates/NOTES.txt b/resources/v1.25.4/charts/gateway/templates/NOTES.txt
deleted file mode 100644
index fd0142911..000000000
--- a/resources/v1.25.4/charts/gateway/templates/NOTES.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-"{{ include "gateway.name" . }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
-
-Next steps:
-  * Deploy an HTTP Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/
-  * Deploy an HTTPS Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/
diff --git a/resources/v1.25.4/charts/gateway/templates/_helpers.tpl b/resources/v1.25.4/charts/gateway/templates/_helpers.tpl
deleted file mode 100644
index e5a0a9b3c..000000000
--- a/resources/v1.25.4/charts/gateway/templates/_helpers.tpl
+++ /dev/null
@@ -1,40 +0,0 @@
-{{- define "gateway.name" -}}
-{{- if eq .Release.Name "RELEASE-NAME" -}}
-  {{- .Values.name | default "istio-ingressgateway" -}}
-{{- else -}}
-  {{- .Values.name | default .Release.Name | default "istio-ingressgateway" -}}
-{{- end -}}
-{{- end }}
-
-{{- define "gateway.labels" -}}
-{{ include "gateway.selectorLabels" . }}
-{{- range $key, $val := .Values.labels }}
-{{- if and (ne $key "app") (ne $key "istio") }}
-{{ $key | quote }}: {{ $val | quote }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{- define "gateway.selectorLabels" -}}
-app: {{ (.Values.labels.app | quote) | default (include "gateway.name" .) }}
-istio: {{ (.Values.labels.istio | quote) | default (include "gateway.name" . | trimPrefix "istio-") }}
-{{- end }}
-
-{{/*
-Keep sidecar injection labels together
-https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy
-*/}}
-{{- define "gateway.sidecarInjectionLabels" -}}
-sidecar.istio.io/inject: "true"
-{{- with .Values.revision }}
-istio.io/rev: {{ . | quote }}
-{{- end }}
-{{- end }}
-
-{{- define "gateway.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create }}
-{{- .Values.serviceAccount.name | default (include "gateway.name" .)    }}
-{{- else }}
-{{- .Values.serviceAccount.name | default "default" }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/gateway/templates/deployment.yaml b/resources/v1.25.4/charts/gateway/templates/deployment.yaml
deleted file mode 100644
index 9db59d8b9..000000000
--- a/resources/v1.25.4/charts/gateway/templates/deployment.yaml
+++ /dev/null
@@ -1,128 +0,0 @@
-apiVersion: apps/v1
-kind: {{ .Values.kind | default "Deployment" }}
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  {{- with .Values.replicaCount }}
-  replicas: {{ . }}
-  {{- end }}
-  {{- end }}
-  {{- with .Values.strategy }}
-  strategy:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.minReadySeconds }}
-  minReadySeconds: {{ . }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "gateway.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
-        {{- include "gateway.selectorLabels" . | nindent 8 }}
-        app.kubernetes.io/name: {{ include "gateway.name" . }}
-        {{- include "istio.labels" .  | nindent 8}}
-        {{- range $key, $val := .Values.labels }}
-        {{- if and (ne $key "app") (ne $key "istio") }}
-        {{ $key | quote }}: {{ $val | quote }}
-        {{- end }}
-        {{- end }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
-      securityContext:
-      {{- if .Values.securityContext }}
-        {{- toYaml .Values.securityContext | nindent 8 }}
-      {{- else }}
-        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- end }}
-      {{- with .Values.volumes }}
-      volumes:
-        {{ toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: istio-proxy
-          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
-          image: auto
-          {{- with .Values.imagePullPolicy }}
-          imagePullPolicy: {{ . }}
-          {{- end }}
-          securityContext:
-          {{- if .Values.containerSecurityContext }}
-            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          {{- else }}
-            capabilities:
-              drop:
-              - ALL
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            {{- if not (eq (.Values.platform | default "") "openshift") }}
-            runAsUser: 1337
-            runAsGroup: 1337
-            {{- end }}
-            runAsNonRoot: true
-          {{- end }}
-          env:
-          {{- with .Values.networkGateway }}
-          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-            value: "{{.}}"
-          {{- end }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: {{ $val | quote }}
-          {{- end }}
-          ports:
-          - containerPort: 15090
-            protocol: TCP
-            name: http-envoy-prom
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          {{- with .Values.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.readinessProbe }}
-          readinessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
-      {{- with .Values.priorityClassName }}
-      priorityClassName: {{ . }}
-      {{- end }}
diff --git a/resources/v1.25.4/charts/gateway/templates/hpa.yaml b/resources/v1.25.4/charts/gateway/templates/hpa.yaml
deleted file mode 100644
index 64ecb6a4c..000000000
--- a/resources/v1.25.4/charts/gateway/templates/hpa.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-{{- if and (.Values.autoscaling.enabled) (eq .Values.kind "Deployment") }}
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: {{ .Values.kind | default "Deployment" }}
-    name: {{ include "gateway.name" . }}
-  minReplicas: {{ .Values.autoscaling.minReplicas }}
-  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
-  metrics:
-    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
-          type: Utilization
-    {{- end }}
-    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
-    - type: Resource
-      resource:
-        name: memory
-        target:
-          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
-          type: Utilization
-    {{- end }}
-  {{- if .Values.autoscaling.autoscaleBehavior }}
-  behavior: {{ toYaml .Values.autoscaling.autoscaleBehavior | nindent 4 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/gateway/templates/poddisruptionbudget.yaml b/resources/v1.25.4/charts/gateway/templates/poddisruptionbudget.yaml
deleted file mode 100644
index b0155cdf0..000000000
--- a/resources/v1.25.4/charts/gateway/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-{{- if .Values.podDisruptionBudget }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-spec:
-  selector:
-    matchLabels:
-  {{- include "gateway.selectorLabels" . | nindent 6 }}
-  {{- with .Values.podDisruptionBudget }}
-    {{- toYaml . | nindent 2 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/gateway/templates/role.yaml b/resources/v1.25.4/charts/gateway/templates/role.yaml
deleted file mode 100644
index 3d1607963..000000000
--- a/resources/v1.25.4/charts/gateway/templates/role.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-{{/*Set up roles for Istio Gateway. Not required for gateway-api*/}}
-{{- if .Values.rbac.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "watch", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "gateway.serviceAccountName" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ include "gateway.serviceAccountName" . }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/gateway/templates/service.yaml b/resources/v1.25.4/charts/gateway/templates/service.yaml
deleted file mode 100644
index 25ce3bcb0..000000000
--- a/resources/v1.25.4/charts/gateway/templates/service.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-{{- if not (eq .Values.service.type "None") }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-    {{- with .Values.networkGateway }}
-    topology.istio.io/network: "{{.}}"
-    {{- end }}
-  annotations:
-    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
-spec:
-{{- with .Values.service.loadBalancerIP }}
-  loadBalancerIP: "{{ . }}"
-{{- end }}
-{{- if eq .Values.service.type "LoadBalancer" }}
-  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
-  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
-  {{- end }}
-{{- end }}
-{{- if .Values.service.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.service.ipFamilies }}
-  ipFamilies:
-{{- range .Values.service.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
-{{- with .Values.service.loadBalancerSourceRanges }}
-  loadBalancerSourceRanges:
-{{ toYaml . | indent 4 }}
-{{- end }}
-{{- with .Values.service.externalTrafficPolicy }}
-  externalTrafficPolicy: "{{ . }}"
-{{- end }}
-  type: {{ .Values.service.type }}
-  ports:
-{{- if .Values.networkGateway }}
-  - name: status-port
-    port: 15021
-    targetPort: 15021
-  - name: tls
-    port: 15443
-    targetPort: 15443
-  - name: tls-istiod
-    port: 15012
-    targetPort: 15012
-  - name: tls-webhook
-    port: 15017
-    targetPort: 15017
-{{- else }}
-{{ .Values.service.ports | toYaml | indent 4 }}
-{{- end }}
-{{- if .Values.service.externalIPs }}
-  externalIPs: {{- range .Values.service.externalIPs }}
-    - {{.}}
-  {{- end }}
-{{- end }}
-  selector:
-    {{- include "gateway.selectorLabels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/gateway/templates/serviceaccount.yaml b/resources/v1.25.4/charts/gateway/templates/serviceaccount.yaml
deleted file mode 100644
index c88afeadd..000000000
--- a/resources/v1.25.4/charts/gateway/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-{{- if .Values.serviceAccount.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/gateway/templates/zzz_profile.yaml b/resources/v1.25.4/charts/gateway/templates/zzz_profile.yaml
deleted file mode 100644
index ded66c5fd..000000000
--- a/resources/v1.25.4/charts/gateway/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.4/charts/gateway/values.schema.json b/resources/v1.25.4/charts/gateway/values.schema.json
deleted file mode 100644
index 3fdaa2730..000000000
--- a/resources/v1.25.4/charts/gateway/values.schema.json
+++ /dev/null
@@ -1,330 +0,0 @@
-{
-  "$schema": "http://json-schema.org/schema#",
-  "$defs": {
-    "values": {
-      "type": "object",
-      "properties": {
-        "global": {
-          "type": "object"
-        },
-        "affinity": {
-          "type": "object"
-        },
-        "securityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "containerSecurityContext": {
-          "type": [
-            "object",
-            "null"
-          ]
-        },
-        "kind": {
-          "type": "string",
-          "enum": [
-            "Deployment",
-            "DaemonSet"
-          ]
-        },
-        "annotations": {
-          "additionalProperties": {
-            "type": [
-              "string",
-              "integer"
-            ]
-          },
-          "type": "object"
-        },
-        "autoscaling": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            },
-            "maxReplicas": {
-              "type": "integer"
-            },
-            "minReplicas": {
-              "type": "integer"
-            },
-            "targetCPUUtilizationPercentage": {
-              "type": "integer"
-            }
-          }
-        },
-        "env": {
-          "type": "object"
-        },
-        "strategy": {
-          "type": "object"
-        },
-        "minReadySeconds": {
-          "type": [
-            "null",
-            "integer"
-          ]
-        },
-        "readinessProbe": {
-          "type": [
-            "null",
-            "object"
-          ]
-        },
-        "labels": {
-          "type": "object"
-        },
-        "name": {
-          "type": "string"
-        },
-        "nodeSelector": {
-          "type": "object"
-        },
-        "podAnnotations": {
-          "type": "object",
-          "properties": {
-            "inject.istio.io/templates": {
-              "type": "string"
-            },
-            "prometheus.io/path": {
-              "type": "string"
-            },
-            "prometheus.io/port": {
-              "type": "string"
-            },
-            "prometheus.io/scrape": {
-              "type": "string"
-            }
-          }
-        },
-        "replicaCount": {
-          "type": [
-            "integer",
-            "null"
-          ]
-        },
-        "resources": {
-          "type": "object",
-          "properties": {
-            "limits": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            },
-            "requests": {
-              "type": "object",
-              "properties": {
-                "cpu": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "memory": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                }
-              }
-            }
-          }
-        },
-        "revision": {
-          "type": "string"
-        },
-        "compatibilityVersion": {
-          "type": "string"
-        },
-        "runAsRoot": {
-          "type": "boolean"
-        },
-        "unprivilegedPort": {
-          "type": [
-            "string",
-            "boolean"
-          ],
-          "enum": [
-            true,
-            false,
-            "auto"
-          ]
-        },
-        "service": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "externalTrafficPolicy": {
-              "type": "string"
-            },
-            "loadBalancerIP": {
-              "type": "string"
-            },
-            "loadBalancerSourceRanges": {
-              "type": "array"
-            },
-            "ipFamilies": {
-              "items": {
-                "type": "string",
-                "enum": [
-                  "IPv4",
-                  "IPv6"
-                ]
-              }
-            },
-            "ipFamilyPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "SingleStack",
-                "PreferDualStack",
-                "RequireDualStack"
-              ]
-            },
-            "ports": {
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string"
-                  },
-                  "port": {
-                    "type": "integer"
-                  },
-                  "protocol": {
-                    "type": "string"
-                  },
-                  "targetPort": {
-                    "type": "integer"
-                  }
-                }
-              }
-            },
-            "type": {
-              "type": "string"
-            }
-          }
-        },
-        "serviceAccount": {
-          "type": "object",
-          "properties": {
-            "annotations": {
-              "type": "object"
-            },
-            "name": {
-              "type": "string"
-            },
-            "create": {
-              "type": "boolean"
-            }
-          }
-        },
-        "rbac": {
-          "type": "object",
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            }
-          }
-        },
-        "tolerations": {
-          "type": "array"
-        },
-        "topologySpreadConstraints": {
-          "type": "array"
-        },
-        "networkGateway": {
-          "type": "string"
-        },
-        "imagePullPolicy": {
-          "type": "string",
-          "enum": [
-            "",
-            "Always",
-            "IfNotPresent",
-            "Never"
-          ]
-        },
-        "imagePullSecrets": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "name": {
-                "type": "string"
-              }
-            }
-          }
-        },
-        "podDisruptionBudget": {
-          "type": "object",
-          "properties": {
-            "minAvailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "maxUnavailable": {
-              "type": [
-                "integer",
-                "string"
-              ]
-            },
-            "unhealthyPodEvictionPolicy": {
-              "type": "string",
-              "enum": [
-                "",
-                "IfHealthyBudget",
-                "AlwaysAllow"
-              ]
-            }
-          }
-        },
-        "terminationGracePeriodSeconds": {
-          "type": "number"
-        },
-        "volumes": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "volumeMounts": {
-          "type": "array",
-          "items": {
-            "type": "object"
-          }
-        },
-        "priorityClassName": {
-          "type": "string"
-        },
-        "_internal_defaults_do_not_set": {
-          "type": "object"
-        }
-      },
-      "additionalProperties": false
-    }
-  },
-  "defaults": {
-    "$ref": "#/$defs/values"
-  },
-  "$ref": "#/$defs/values"
-}
diff --git a/resources/v1.25.4/charts/gateway/values.yaml b/resources/v1.25.4/charts/gateway/values.yaml
deleted file mode 100644
index d8b70ec15..000000000
--- a/resources/v1.25.4/charts/gateway/values.yaml
+++ /dev/null
@@ -1,168 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Name allows overriding the release name. Generally this should not be set
-  name: ""
-  # revision declares which revision this gateway is a part of
-  revision: ""
-
-  # Controls the spec.replicas setting for the Gateway deployment if set.
-  # Otherwise defaults to Kubernetes Deployment default (1).
-  replicaCount:
-
-  kind: Deployment
-
-  rbac:
-    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
-    # when using http://gateway-api.org/.
-    enabled: true
-
-  serviceAccount:
-    # If set, a service account will be created. Otherwise, the default is used
-    create: true
-    # Annotations to add to the service account
-    annotations: {}
-    # The name of the service account to use.
-    # If not set, the release name is used
-    name: ""
-
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/stats/prometheus"
-    inject.istio.io/templates: "gateway"
-    sidecar.istio.io/inject: "true"
-
-  # Define the security context for the pod.
-  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-  securityContext: {}
-  containerSecurityContext: {}
-
-  service:
-    # Type of service. Set to "None" to disable the service entirely
-    type: LoadBalancer
-    ports:
-    - name: status-port
-      port: 15021
-      protocol: TCP
-      targetPort: 15021
-    - name: http2
-      port: 80
-      protocol: TCP
-      targetPort: 80
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
-    annotations: {}
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    externalTrafficPolicy: ""
-    externalIPs: []
-    ipFamilyPolicy: ""
-    ipFamilies: []
-    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
-    # allocateLoadBalancerNodePorts: false
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: 2000m
-      memory: 1024Mi
-
-  autoscaling:
-    enabled: true
-    minReplicas: 1
-    maxReplicas: 5
-    targetCPUUtilizationPercentage: 80
-    targetMemoryUtilizationPercentage: {}
-    autoscaleBehavior: {}
-
-  # Pod environment variables
-  env: {}
-
-  # Deployment Update strategy
-  strategy: {}
-  
-  # Sets the Deployment minReadySeconds value
-  minReadySeconds:
-  
-  # Optionally configure a custom readinessProbe. By default the control plane
-  # automatically injects the readinessProbe. If you wish to override that
-  # behavior, you may define your own readinessProbe here.
-  readinessProbe: {}
-
-  # Labels to apply to all resources
-  labels:
-    # By default, don't enroll gateways into the ambient dataplane
-    "istio.io/dataplane-mode": none
-
-  # Annotations to apply to all resources
-  annotations: {}
-
-  nodeSelector: {}
-
-  tolerations: []
-
-  topologySpreadConstraints: []
-
-  affinity: {}
-
-  # If specified, the gateway will act as a network gateway for the given network.
-  networkGateway: ""
-
-  # Specify image pull policy if default behavior isn't desired.
-  # Default behavior: latest images will be Always else IfNotPresent
-  imagePullPolicy: ""
-
-  imagePullSecrets: []
-
-  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
-  #
-  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
-  # which means that no PodDisruptionBudget resource will be created.
-  #
-  # To enable the PodDisruptionBudget, configure it by specifying the
-  # `minAvailable` or `maxUnavailable`. For example, to set the
-  # minimum number of available replicas to 1, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #
-  # Or, to allow a maximum of 1 unavailable replica, you can set:
-  #
-  # podDisruptionBudget:
-  #   maxUnavailable: 1
-  #
-  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
-  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #   unhealthyPodEvictionPolicy: AlwaysAllow
-  #
-  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
-  #
-  # podDisruptionBudget: {}
-  #
-  podDisruptionBudget: {}
-
-  # Sets the per-pod terminationGracePeriodSeconds setting.
-  terminationGracePeriodSeconds: 30
-
-  # A list of `Volumes` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumes: []
-
-  # A list of `VolumeMounts` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumeMounts: []
-
-  # Configure this to a higher priority class in order to make sure your Istio gateway pods
-  # will not be killed because of low priority class.
-  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-  # for more detail.
-  priorityClassName: ""
diff --git a/resources/v1.25.4/charts/istiod/Chart.yaml b/resources/v1.25.4/charts/istiod/Chart.yaml
deleted file mode 100644
index b921020bd..000000000
--- a/resources/v1.25.4/charts/istiod/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.4
-description: Helm chart for istio control plane
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- istiod
-- istio-discovery
-name: istiod
-sources:
-- https://github.com/istio/istio
-version: 1.25.4
diff --git a/resources/v1.25.4/charts/istiod/README.md b/resources/v1.25.4/charts/istiod/README.md
deleted file mode 100644
index ddbfbc8fe..000000000
--- a/resources/v1.25.4/charts/istiod/README.md
+++ /dev/null
@@ -1,73 +0,0 @@
-# Istiod Helm Chart
-
-This chart installs an Istiod deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-Before installing, ensure CRDs are installed in the cluster (from the `istio/base` chart).
-
-To install the chart with the release name `istiod`:
-
-```console
-kubectl create namespace istio-system
-helm install istiod istio/istiod --namespace istio-system
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istiod` deployment:
-
-```console
-helm delete istiod --namespace istio-system
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istiod
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Examples
-
-#### Configuring mesh configuration settings
-
-Any [Mesh Config](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/) options can be configured like below:
-
-```yaml
-meshConfig:
-  accessLogFile: /dev/stdout
-```
-
-#### Revisions
-
-Control plane revisions allow deploying multiple versions of the control plane in the same cluster.
-This allows safe [canary upgrades](https://istio.io/latest/docs/setup/upgrade/canary/)
-
-```yaml
-revision: my-revision-name
-```
diff --git a/resources/v1.25.4/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.25.4/charts/istiod/files/gateway-injection-template.yaml
deleted file mode 100644
index dbd83cc57..000000000
--- a/resources/v1.25.4/charts/istiod/files/gateway-injection-template.yaml
+++ /dev/null
@@ -1,253 +0,0 @@
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations:
-    istio.io/rev: {{ .Revision | default "default" | quote }}
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- end }}
-spec:
-  securityContext:
-  {{- if .Values.gateways.securityContext }}
-    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
-  {{- else }}
-    sysctls:
-    - name: net.ipv4.ip_unprivileged_port_start
-      value: "0"
-  {{- end }}
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - router
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- end }}
-    securityContext:
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-    env:
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-  volumes:
-  - emptyDir: {}
-    name: workload-socket
-  - emptyDir: {}
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else}}
-  - emptyDir: {}
-    name: workload-certs
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.4/charts/istiod/files/grpc-agent.yaml b/resources/v1.25.4/charts/istiod/files/grpc-agent.yaml
deleted file mode 100644
index 7290fcdca..000000000
--- a/resources/v1.25.4/charts/istiod/files/grpc-agent.yaml
+++ /dev/null
@@ -1,310 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-    sidecar.istio.io/rewriteAppHTTPProbers: "false",
-  }
-spec:
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15020
-      protocol: TCP
-      name: mesh-metrics
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-          - --url=http://localhost:15020/healthz/ready
-    env:
-    - name: ISTIO_META_GENERATOR
-      value: grpc
-    - name: OUTPUT_CERTS
-      value: /var/lib/istio/data
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    # grpc uses xds:/// to resolve – no need to resolve VIP
-    - name: ISTIO_META_DNS_CAPTURE
-      value: "false"
-    - name: DISABLE_ENVOY
-      value: "true"
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15020
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # UDS channel between istioagent and gRPC client for XDS/SDS
-    - mountPath: /etc/istio/proxy
-      name: istio-xds
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-{{- range $index, $container := .Spec.Containers  }}
-{{ if not (eq $container.Name "istio-proxy") }}
-  - name: {{ $container.Name }}
-    env:
-      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
-        value: "true"
-      - name: "GRPC_XDS_BOOTSTRAP"
-        value: "/etc/istio/proxy/grpc-bootstrap.json"
-    volumeMounts:
-      - mountPath: /var/lib/istio/data
-        name: istio-data
-      # UDS channel between istioagent and gRPC client for XDS/SDS
-      - mountPath: /etc/istio/proxy
-        name: istio-xds
-      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-        readOnly: true
-      {{- else }}
-      - name: workload-certs
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-      {{- end }}
-{{- end }}
-{{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-xds
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.4/charts/istiod/files/grpc-simple.yaml b/resources/v1.25.4/charts/istiod/files/grpc-simple.yaml
deleted file mode 100644
index 9ba0c7a46..000000000
--- a/resources/v1.25.4/charts/istiod/files/grpc-simple.yaml
+++ /dev/null
@@ -1,65 +0,0 @@
-metadata:
-  annotations:
-    sidecar.istio.io/rewriteAppHTTPProbers: "false"
-spec:
-  initContainers:
-    - name: grpc-bootstrap-init
-      image: busybox:1.28
-      volumeMounts:
-        - mountPath: /var/lib/grpc/data/
-          name: grpc-io-proxyless-bootstrap
-      env:
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: ISTIO_NAMESPACE
-          value: |
-             {{ .Values.global.istioNamespace }}
-      command:
-        - sh
-        - "-c"
-        - |-
-          NODE_ID="sidecar~${INSTANCE_IP}~${POD_NAME}.${POD_NAMESPACE}~cluster.local"
-          SERVER_URI="dns:///istiod.${ISTIO_NAMESPACE}.svc:15010"
-          echo '
-          {
-            "xds_servers": [
-              {
-                "server_uri": "'${SERVER_URI}'",
-                "channel_creds": [{"type": "insecure"}],
-                "server_features" : ["xds_v3"]
-              }
-            ],
-            "node": {
-              "id": "'${NODE_ID}'",
-              "metadata": {
-                "GENERATOR": "grpc"
-              }
-            }
-          }' > /var/lib/grpc/data/bootstrap.json
-  containers:
-  {{- range $index, $container := .Spec.Containers }}
-  - name: {{ $container.Name }}
-    env:
-      - name: GRPC_XDS_BOOTSTRAP
-        value: /var/lib/grpc/data/bootstrap.json
-      - name: GRPC_GO_LOG_VERBOSITY_LEVEL
-        value: "99"
-      - name: GRPC_GO_LOG_SEVERITY_LEVEL
-        value: info
-    volumeMounts:
-      - mountPath: /var/lib/grpc/data/
-        name: grpc-io-proxyless-bootstrap
-  {{- end }}
-  volumes:
-    - name: grpc-io-proxyless-bootstrap
-      emptyDir: {}
diff --git a/resources/v1.25.4/charts/istiod/files/injection-template.yaml b/resources/v1.25.4/charts/istiod/files/injection-template.yaml
deleted file mode 100644
index 55c6f563c..000000000
--- a/resources/v1.25.4/charts/istiod/files/injection-template.yaml
+++ /dev/null
@@ -1,517 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
-{{ $tproxy := (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
-    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
-    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
-    {{- end }}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-{{- if .Values.pilot.cni.enabled }}
-    {{- if eq .Values.pilot.cni.provider "multus" }}
-    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
-    {{- end }}
-    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
-    traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}",
-    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
-    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
-    {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
-    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
-    {{- end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}istio.io/reroute-virtual-interfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
-{{- end }}
-  }
-spec:
-  {{- $holdProxy := and
-      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
-      (not $nativeSidecar) }}
-  initContainers:
-  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
-  {{ if .Values.pilot.cni.enabled -}}
-  - name: istio-validation
-  {{ else -}}
-  - name: istio-init
-  {{ end -}}
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    args:
-    - istio-iptables
-    - "-p"
-    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
-    - "-z"
-    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
-    - "-u"
-    - {{ if $tproxy }} "1337" {{ else }} {{ .ProxyUID | default "1337" | quote }} {{ end }}
-    - "-m"
-    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
-    - "-i"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
-    - "-x"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
-    - "-b"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
-    - "-d"
-  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
-    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
-  {{- else }}
-    - "15090,15021"
-  {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
-    - "-q"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
-    {{ end -}}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
-    - "-o"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}"
-    {{ end -}}
-     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
-    - "-c"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
-    {{ end -}}
-    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
-    {{ if .Values.global.logAsJson -}}
-    - "--log_as_json"
-    {{ end -}}
-    {{ if .Values.pilot.cni.enabled -}}
-    - "--run-validation"
-    - "--skip-rule-apply"
-    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
-    - "--force-apply"
-    {{ end -}}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-  {{- if .ProxyConfig.ProxyMetadata }}
-    env:
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-  {{- end }}
-    resources:
-  {{ template "resources" . }}
-    securityContext:
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      privileged: {{ .Values.global.proxy.privileged }}
-      capabilities:
-    {{- if not .Values.pilot.cni.enabled }}
-        add:
-        - NET_ADMIN
-        - NET_RAW
-    {{- end }}
-        drop:
-        - ALL
-    {{- if not .Values.pilot.cni.enabled }}
-      readOnlyRootFilesystem: false
-      runAsGroup: 0
-      runAsNonRoot: false
-      runAsUser: 0
-    {{- else }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyGID | default "1337" }} {{ end }}
-      runAsUser: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyUID | default "1337" }} {{ end }}
-      runAsNonRoot: true
-    {{- end }}
-  {{ end -}}
-  {{ if not $nativeSidecar }}
-  containers:
-  {{ end }}
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.outlierLogPath }}
-    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-  {{- end}}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- else if $holdProxy }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-  {{- else if $nativeSidecar }}
-    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
-    lifecycle:
-      preStop:
-        exec:
-          command:
-          - pilot-agent
-          - request
-          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
-          - POST
-          - drain
-  {{- end }}
-    env:
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- with (index .ObjectMeta.Labels `service.istio.io/workload-name` | default .DeploymentMeta.Name) }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ . }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - name: ISTIO_BOOTSTRAP_OVERRIDE
-      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
-    {{- end }}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-  {{ if .Values.global.proxy.startupProbe.enabled }}
-    startupProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: 0
-      periodSeconds: 1
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
-  {{ end }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    {{ end -}}
-    securityContext:
-      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
-      allowPrivilegeEscalation: true
-      capabilities:
-        add:
-        - NET_ADMIN
-        drop:
-        - ALL
-      privileged: true
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else }}
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      capabilities:
-        {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-        add:
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
-        - NET_ADMIN
-        {{- end }}
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
-        - NET_BIND_SERVICE
-        {{- end }}
-        {{- end }}
-        drop:
-        - ALL
-      privileged: {{ .Values.global.proxy.privileged }}
-      readOnlyRootFilesystem: true
-      {{ if or ($tproxy) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-      runAsNonRoot: false
-      runAsUser: 0
-      runAsGroup: 1337
-      {{- else -}}
-      runAsNonRoot: true
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      {{- end }}
-      {{- end }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - mountPath: /etc/istio/custom-bootstrap
-      name: custom-bootstrap-volume
-    {{- end }}
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
-      name: lightstep-certs
-      readOnly: true
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  - emptyDir:
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-  - name: lightstep-certs
-    secret:
-      optional: true
-      secretName: lightstep.cacert
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.4/charts/istiod/files/kube-gateway.yaml b/resources/v1.25.4/charts/istiod/files/kube-gateway.yaml
deleted file mode 100644
index dbe158de1..000000000
--- a/resources/v1.25.4/charts/istiod/files/kube-gateway.yaml
+++ /dev/null
@@ -1,345 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-gateway-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": {{.Name}}
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-gateway-controller"
-          ) | nindent 8 }}
-    spec:
-      securityContext:
-      {{- if .Values.gateways.securityContext }}
-        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
-      {{- else }}
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- if .Values.gateways.seccompProfile }}
-        seccompProfile:
-      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
-      {{- end }}
-      {{- end }}
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-      {{- else }}
-        image: "{{ .ProxyImage }}"
-      {{- end }}
-        {{- if .Values.global.proxy.resources }}
-        resources:
-          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsUser: {{ .ProxyUID | default "1337" }}
-          runAsGroup: {{ .ProxyGID | default "1337" }}
-          runAsNonRoot: true
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        args:
-        - proxy
-        - router
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-      {{- if .Values.global.sts.servicePort }}
-        - --stsPort={{ .Values.global.sts.servicePort }}
-      {{- end }}
-      {{- if .Values.global.logAsJson }}
-        - --log_as_json
-      {{- end }}
-      {{- if .Values.global.proxy.lifecycle }}
-        lifecycle:
-          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
-      {{- end }}
-        env:
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        - name: ISTIO_META_POD_PORTS
-          value: "[]"
-        - name: ISTIO_META_APP_CONTAINERS
-          value: ""
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: "{{ .ProxyConfig.InterceptionMode.String }}"
-        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
-        - name: ISTIO_META_NETWORK
-          value: {{.|quote}}
-        {{- end }}
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName|quote}}
-        - name: ISTIO_META_OWNER
-          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
-        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-          value: {{.|quote}}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        volumeMounts:
-        - name: workload-socket
-          mountPath: /var/run/secrets/workload-spiffe-uds
-        - name: credential-socket
-          mountPath: /var/run/secrets/credential-uds
-        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-        - name: gke-workload-certificate
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-          readOnly: true
-        {{- else }}
-        - name: workload-certs
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-        {{- end }}
-        {{- if eq .Values.global.pilotCertProvider "istiod" }}
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        {{- end }}
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        # SDS channel between istioagent and Envoy
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - name: istio-podinfo
-          mountPath: /etc/istio/pod
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir: {}
-        name: credential-socket
-      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        csi:
-          driver: workloadcertificates.security.cloud.google.com
-      {{- else}}
-      - emptyDir: {}
-        name: workload-certs
-      {{- end }}
-      # SDS channel between istioagent and Envoy
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - name: istio-data
-        emptyDir: {}
-      - name: istio-podinfo
-        downwardAPI:
-          items:
-            - path: "labels"
-              fieldRef:
-                fieldPath: metadata.labels
-            - path: "annotations"
-              fieldRef:
-                fieldPath: metadata.annotations
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: {{ .Values.global.sds.token.aud }}
-      {{- if eq .Values.global.pilotCertProvider "istiod" }}
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: {{.UID}}
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": {{.Name}}
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.25.4/charts/istiod/files/profile-ambient.yaml b/resources/v1.25.4/charts/istiod/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.4/charts/istiod/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.4/charts/istiod/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.4/charts/istiod/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.4/charts/istiod/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/istiod/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.4/charts/istiod/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.4/charts/istiod/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/istiod/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.4/charts/istiod/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.4/charts/istiod/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/istiod/files/profile-platform-gke.yaml b/resources/v1.25.4/charts/istiod/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.4/charts/istiod/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.4/charts/istiod/files/profile-platform-k3d.yaml b/resources/v1.25.4/charts/istiod/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.4/charts/istiod/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.4/charts/istiod/files/profile-platform-microk8s.yaml b/resources/v1.25.4/charts/istiod/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.4/charts/istiod/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.4/charts/istiod/files/profile-platform-minikube.yaml b/resources/v1.25.4/charts/istiod/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.4/charts/istiod/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.4/charts/istiod/files/profile-platform-openshift.yaml b/resources/v1.25.4/charts/istiod/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.4/charts/istiod/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.4/charts/istiod/files/profile-preview.yaml b/resources/v1.25.4/charts/istiod/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.4/charts/istiod/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.4/charts/istiod/files/profile-remote.yaml b/resources/v1.25.4/charts/istiod/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.4/charts/istiod/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.4/charts/istiod/files/profile-stable.yaml b/resources/v1.25.4/charts/istiod/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.4/charts/istiod/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.4/charts/istiod/files/waypoint.yaml b/resources/v1.25.4/charts/istiod/files/waypoint.yaml
deleted file mode 100644
index 2600e98e2..000000000
--- a/resources/v1.25.4/charts/istiod/files/waypoint.yaml
+++ /dev/null
@@ -1,340 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-mesh-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": "{{.Name}}"
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "istio.io/dataplane-mode" "none"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-mesh-controller"
-          ) | nindent 8}}
-    spec:
-      {{- if .Values.global.waypoint.affinity }}
-      affinity:
-      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.topologySpreadConstraints }}
-      topologySpreadConstraints:
-      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.nodeSelector }}
-      nodeSelector:
-      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.tolerations }}
-      tolerations:
-      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: 2
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-        {{- else }}
-        image: "{{ .ProxyImage }}"
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        args:
-        - proxy
-        - waypoint
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --serviceCluster
-        - {{.ServiceAccount}}.$(POD_NAMESPACE)
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-        {{- if .Values.global.logAsJson }}
-        - --log_as_json
-        {{- end }}
-        {{- if .Values.global.proxy.outlierLogPath }}
-        - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-        {{- end}}
-        env:
-        - name: ISTIO_META_SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        {{- if .ProxyConfig.ProxyMetadata }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
-        {{- if $network }}
-        - name: ISTIO_META_NETWORK
-          value: "{{ $network }}"
-        {{- end }}
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: REDIRECT
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName}}
-        - name: ISTIO_META_OWNER
-          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- if .Values.global.waypoint.resources }}
-        resources:
-        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        securityContext:
-          privileged: false
-        {{- if not (eq .Values.global.platform "openshift") }}
-          runAsGroup: 1337
-          runAsUser: 1337
-        {{- end }}
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-            - ALL
-{{- if .Values.gateways.seccompProfile }}
-          seccompProfile:
-{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
-{{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/workload-spiffe-uds
-          name: workload-socket
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /etc/istio/pod
-          name: istio-podinfo
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - emptyDir:
-          medium: Memory
-        name: go-proxy-envoy
-      - emptyDir: {}
-        name: istio-data
-      - emptyDir: {}
-        name: go-proxy-data
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.labels
-            path: labels
-          - fieldRef:
-              fieldPath: metadata.annotations
-            path: annotations
-        name: istio-podinfo
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              audience: istio-ca
-              expirationSeconds: 43200
-              path: istio-token
-      - configMap:
-          name: istio-ca-root-cert
-        name: istiod-ca-cert
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap
-      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
-      (omit .InfrastructureAnnotations
-        "kubectl.kubernetes.io/last-applied-configuration"
-        "gateway.istio.io/name-override"
-        "gateway.istio.io/service-account"
-        "gateway.istio.io/controller-version"
-      ) | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": "{{.Name}}"
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.25.4/charts/istiod/templates/NOTES.txt b/resources/v1.25.4/charts/istiod/templates/NOTES.txt
deleted file mode 100644
index 0d07ea7f4..000000000
--- a/resources/v1.25.4/charts/istiod/templates/NOTES.txt
+++ /dev/null
@@ -1,82 +0,0 @@
-"istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
-
-Next steps:
-{{- $profile := default "" .Values.profile }}
-{{- if (eq $profile "ambient") }}
-  * Get started with ambient: https://istio.io/latest/docs/ops/ambient/getting-started/
-  * Review ambient's architecture: https://istio.io/latest/docs/ops/ambient/architecture/
-{{- else }}
-  * Deploy a Gateway: https://istio.io/latest/docs/setup/additional-setup/gateway/
-  * Try out our tasks to get started on common configurations:
-    * https://istio.io/latest/docs/tasks/traffic-management
-    * https://istio.io/latest/docs/tasks/security/
-    * https://istio.io/latest/docs/tasks/policy-enforcement/
-{{- end }}
-  * Review the list of actively supported releases, CVE publications and our hardening guide:
-    * https://istio.io/latest/docs/releases/supported-releases/
-    * https://istio.io/latest/news/security/
-    * https://istio.io/latest/docs/ops/best-practices/security/
-
-For further documentation see https://istio.io website
-
-{{-
-  $deps := dict
-    "global.outboundTrafficPolicy" "meshConfig.outboundTrafficPolicy"
-    "global.certificates" "meshConfig.certificates"
-    "global.localityLbSetting" "meshConfig.localityLbSetting"
-    "global.policyCheckFailOpen" "meshConfig.policyCheckFailOpen"
-    "global.enableTracing" "meshConfig.enableTracing"
-    "global.proxy.accessLogFormat" "meshConfig.accessLogFormat"
-    "global.proxy.accessLogFile" "meshConfig.accessLogFile"
-    "global.proxy.concurrency" "meshConfig.defaultConfig.concurrency"
-    "global.proxy.envoyAccessLogService" "meshConfig.defaultConfig.envoyAccessLogService"
-    "global.proxy.envoyAccessLogService.enabled" "meshConfig.enableEnvoyAccessLogService"
-    "global.proxy.envoyMetricsService" "meshConfig.defaultConfig.envoyMetricsService"
-    "global.proxy.protocolDetectionTimeout" "meshConfig.protocolDetectionTimeout"
-    "global.proxy.holdApplicationUntilProxyStarts" "meshConfig.defaultConfig.holdApplicationUntilProxyStarts"
-    "pilot.ingress" "meshConfig.ingressService, meshConfig.ingressControllerMode, and meshConfig.ingressClass"
-    "global.mtls.enabled" "the PeerAuthentication resource"
-    "global.mtls.auto" "meshConfig.enableAutoMtls"
-    "global.tracer.lightstep.address" "meshConfig.defaultConfig.tracing.lightstep.address"
-    "global.tracer.lightstep.accessToken" "meshConfig.defaultConfig.tracing.lightstep.accessToken"
-    "global.tracer.zipkin.address" "meshConfig.defaultConfig.tracing.zipkin.address"
-    "global.tracer.datadog.address" "meshConfig.defaultConfig.tracing.datadog.address"
-    "global.meshExpansion.enabled" "Gateway and other Istio networking resources, such as in samples/multicluster/"
-    "istiocoredns.enabled" "the in-proxy DNS capturing (ISTIO_META_DNS_CAPTURE)"
-}}
-{{- range $dep, $replace := $deps }}
-{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
-{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
-{{- if not (eq $res "")}}
-WARNING: {{$dep|quote}} is deprecated; use {{$replace|quote}} instead.
-{{- end }}
-{{- end }}
-{{-
-  $failDeps := dict
-    "telemetry.v2.prometheus.configOverride"
-    "telemetry.v2.stackdriver.configOverride"
-    "telemetry.v2.stackdriver.disableOutbound"
-    "telemetry.v2.stackdriver.outboundAccessLogging"
-    "global.tracer.stackdriver.debug" "meshConfig.defaultConfig.tracing.stackdriver.debug"
-    "global.tracer.stackdriver.maxNumberOfAttributes" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes"
-    "global.tracer.stackdriver.maxNumberOfAnnotations" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations"
-    "global.tracer.stackdriver.maxNumberOfMessageEvents" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents"
-    "meshConfig.defaultConfig.tracing.stackdriver.debug" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents" "Istio supported tracers"
-}}
-{{- range $dep, $replace := $failDeps }}
-{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
-{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
-{{- if not (eq $res "")}}
-{{fail (print $dep " is removed")}}
-{{- end }}
-{{- end }}
-{{- if eq $.Values.global.pilotCertProvider "kubernetes" }}
-{{- fail "pilotCertProvider=kubernetes is not supported" }}
-{{- end }}
\ No newline at end of file
diff --git a/resources/v1.25.4/charts/istiod/templates/_helpers.tpl b/resources/v1.25.4/charts/istiod/templates/_helpers.tpl
deleted file mode 100644
index 042c92538..000000000
--- a/resources/v1.25.4/charts/istiod/templates/_helpers.tpl
+++ /dev/null
@@ -1,23 +0,0 @@
-{{/* Default Prometheus is enabled if its enabled and there are no config overrides set */}}
-{{ define "default-prometheus" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.prometheus.enabled
-}}
-{{- end }}
-
-{{/* SD has metrics and logging split. Default metrics are enabled if SD is enabled */}}
-{{ define "default-sd-metrics" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
-}}
-{{- end }}
-
-{{/* SD has metrics and logging split. */}}
-{{ define "default-sd-logs" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
-}}
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/autoscale.yaml b/resources/v1.25.4/charts/istiod/templates/autoscale.yaml
deleted file mode 100644
index 09cd6258c..000000000
--- a/resources/v1.25.4/charts/istiod/templates/autoscale.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if and .Values.autoscaleEnabled .Values.autoscaleMin .Values.autoscaleMax }}
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  maxReplicas: {{ .Values.autoscaleMax }}
-  minReplicas: {{ .Values.autoscaleMin }}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  metrics:
-  - type: Resource
-    resource:
-      name: cpu
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.cpu.targetAverageUtilization }}
-  {{- if .Values.memory.targetAverageUtilization }}
-  - type: Resource
-    resource:
-      name: memory
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.memory.targetAverageUtilization }}
-  {{- end }}
-  {{- if .Values.autoscaleBehavior }}
-  behavior: {{ toYaml .Values.autoscaleBehavior | nindent 4 }}
-  {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/clusterrole.yaml b/resources/v1.25.4/charts/istiod/templates/clusterrole.yaml
deleted file mode 100644
index 0c340b5b3..000000000
--- a/resources/v1.25.4/charts/istiod/templates/clusterrole.yaml
+++ /dev/null
@@ -1,187 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  # sidecar injection controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-
-  # configuration validation webhook controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-
-  # istio configuration
-  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
-  # please proceed with caution
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["get", "watch", "list"]
-    resources: ["*"]
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["update", "patch"]
-    resources:
-    - authorizationpolicies/status
-    - destinationrules/status
-    - envoyfilters/status
-    - gateways/status
-    - peerauthentications/status
-    - proxyconfigs/status
-    - requestauthentications/status
-    - serviceentries/status
-    - sidecars/status
-    - telemetries/status
-    - virtualservices/status
-    - wasmplugins/status
-    - workloadentries/status
-    - workloadgroups/status
-{{- end }}
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries/status",  "serviceentries/status" ]
-  - apiGroups: ["security.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "authorizationpolicies/status" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services/status" ]
-
-  # auto-detect installed CRD definitions
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-
-  # discovery and routing
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-
-{{- if .Values.taint.enabled }}
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["patch"]
-{{- end }}
-
-  # ingress controller
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-{{- end}}
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses", "ingressclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-
-  # required for CA's namespace controller
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-
-  # Istiod and bootstrap.
-{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
-{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "certificatesigningrequests"
-      - "certificatesigningrequests/approval"
-      - "certificatesigningrequests/status"
-    verbs: ["update", "create", "get", "delete", "watch"]
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "signers"
-    resourceNames:
-{{- range .Values.global.certSigners }}
-    - {{ . | quote }}
-{{- end }}
-    verbs: ["approve"]
-{{- end}}
-
-  # Used by Istiod to verify the JWT tokens
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-
-  # Used by Istiod to verify gateway SDS
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-
-  # Use for Kubernetes Service APIs
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources:
-    - backendtlspolicies/status
-    - gatewayclasses/status
-    - gateways/status
-    - grpcroutes/status
-    - httproutes/status
-    - referencegrants/status
-    - tcproutes/status
-    - tlsroutes/status
-    - udproutes/status
-    verbs: ["update", "patch"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["gatewayclasses"]
-    verbs: ["create", "update", "patch", "delete"]
-
-  # Needed for multicluster secret reading, possibly ingress certs in the future
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "watch", "list"]
-
-  # Used for MCS serviceexport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: [ "get", "watch", "list", "create", "delete"]
-
-  # Used for MCS serviceimport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "watch", "list"]
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: ["apps"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "deployments" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "serviceaccounts"]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.25.4/charts/istiod/templates/clusterrolebinding.yaml
deleted file mode 100644
index 10781b407..000000000
--- a/resources/v1.25.4/charts/istiod/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-- kind: ServiceAccount
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.25.4/charts/istiod/templates/configmap-jwks.yaml
deleted file mode 100644
index 3505d2822..000000000
--- a/resources/v1.25.4/charts/istiod/templates/configmap-jwks.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.jwksResolverExtraRootCA }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  extra.pem: {{ .Values.jwksResolverExtraRootCA | quote }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/configmap-values.yaml b/resources/v1.25.4/charts/istiod/templates/configmap-values.yaml
deleted file mode 100644
index a7e60369d..000000000
--- a/resources/v1.25.4/charts/istiod/templates/configmap-values.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  original-values: |-
-{{ .Values._original | toPrettyJson | indent 4 }}
-{{- $_ := unset $.Values "_original" }}
-  merged-values: |-
-{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.25.4/charts/istiod/templates/configmap.yaml b/resources/v1.25.4/charts/istiod/templates/configmap.yaml
deleted file mode 100644
index 3098d300f..000000000
--- a/resources/v1.25.4/charts/istiod/templates/configmap.yaml
+++ /dev/null
@@ -1,106 +0,0 @@
-{{- define "mesh" }}
-    # The trust domain corresponds to the trust root of a system.
-    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
-    trustDomain: "cluster.local"
-
-    # The namespace to treat as the administrative root namespace for Istio configuration.
-    # When processing a leaf namespace Istio will search for declarations in that namespace first
-    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
-    # is processed as if it were declared in the leaf namespace.
-    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
-
-  {{ $prom := include "default-prometheus" . | eq "true" }}
-  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
-  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
-  {{- if or $prom $sdMetrics $sdLogs }}
-    defaultProviders:
-    {{- if or $prom $sdMetrics }}
-      metrics:
-      {{ if $prom }}- prometheus{{ end }}
-      {{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
-    {{- end }}
-    {{- if and $sdMetrics $sdLogs }}
-      accessLogging:
-      - stackdriver
-    {{- end }}
-  {{- end }}
-
-    defaultConfig:
-      {{- if .Values.global.meshID }}
-      meshId: "{{ .Values.global.meshID }}"
-      {{- end }}
-      {{- with (.Values.global.proxy.variant | default .Values.global.variant) }}
-      image:
-        imageType: {{. | quote}}
-      {{- end }}
-      {{- if not (eq .Values.global.proxy.tracer "none") }}
-      tracing:
-      {{- if eq .Values.global.proxy.tracer "lightstep" }}
-        lightstep:
-          # Address of the LightStep Satellite pool
-          address: {{ .Values.global.tracer.lightstep.address }}
-          # Access Token used to communicate with the Satellite pool
-          accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
-      {{- else if eq .Values.global.proxy.tracer "zipkin" }}
-        zipkin:
-          # Address of the Zipkin collector
-          address: {{ ((.Values.global.tracer).zipkin).address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
-      {{- else if eq .Values.global.proxy.tracer "datadog" }}
-        datadog:
-          # Address of the Datadog Agent
-          address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
-      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
-        stackdriver:
-          # enables trace output to stdout.
-          debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}
-          # The global default max number of attributes per span.
-          maxNumberOfAttributes: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAttributes | default "200" }}
-          # The global default max number of annotation events per span.
-          maxNumberOfAnnotations: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAnnotations | default "200" }}
-          # The global default max number of message events per span.
-          maxNumberOfMessageEvents: {{ (($.Values.global.tracer).stackdriver).maxNumberOfMessageEvents | default "200" }}
-      {{- end }}
-      {{- end }}
-      {{- if .Values.global.remotePilotAddress }}
-      discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
-      {{- else }}
-      discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
-      {{- end }}
-{{- end }}
-
-{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
-{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
-{{- $originalMesh := include "mesh" . | fromYaml }}
-{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
-
-{{- if .Values.configMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-
-  # Configuration file for the mesh networks to be used by the Split Horizon EDS.
-  meshNetworks: |-
-  {{- if .Values.global.meshNetworks }}
-    networks:
-{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
-  {{- else }}
-    networks: {}
-  {{- end }}
-
-  mesh: |-
-{{- if .Values.meshConfig }}
-{{ $mesh | toYaml | indent 4 }}
-{{- else }}
-{{- include "mesh" . }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/deployment.yaml b/resources/v1.25.4/charts/istiod/templates/deployment.yaml
deleted file mode 100644
index 5380805e9..000000000
--- a/resources/v1.25.4/charts/istiod/templates/deployment.yaml
+++ /dev/null
@@ -1,291 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- range $key, $val := .Values.deploymentLabels }}
-    {{ $key }}: "{{ $val }}"
-{{- end }}
-spec:
-{{- if not .Values.autoscaleEnabled }}
-{{- if .Values.replicaCount }}
-  replicas: {{ .Values.replicaCount }}
-{{- end }}
-{{- end }}
-  strategy:
-    rollingUpdate:
-      maxSurge: {{ .Values.rollingMaxSurge }}
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  selector:
-    matchLabels:
-      {{- if ne .Values.revision "" }}
-      app: istiod
-      istio.io/rev: {{ .Values.revision | default "default" | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
-  template:
-    metadata:
-      labels:
-        app: istiod
-        istio.io/rev: {{ .Values.revision | default "default" | quote }}
-        sidecar.istio.io/inject: "false"
-        operator.istio.io/component: "Pilot"
-        {{- if ne .Values.revision "" }}
-        istio: istiod
-        {{- else }}
-        istio: pilot
-        {{- end }}
-        {{- range $key, $val := .Values.podLabels }}
-        {{ $key }}: "{{ $val }}"
-        {{- end }}
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: "istiod"
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        prometheus.io/port: "15014"
-        prometheus.io/scrape: "true"
-        sidecar.istio.io/inject: "false"
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{- if .Values.nodeSelector }}
-      nodeSelector:
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- with .Values.affinity }}
-      affinity:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      tolerations:
-        - key: cni.istio.io/not-ready
-          operator: "Exists"
-{{- with .Values.tolerations }}
-{{- toYaml . | nindent 8 }}
-{{- end }}
-{{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- if .Values.global.priorityClassName }}
-      priorityClassName: "{{ .Values.global.priorityClassName }}"
-{{- end }}
-{{- with .Values.initContainers }}
-      initContainers:
-        {{- tpl (toYaml .) $ | nindent 8 }}
-{{- end }}
-      containers:
-        - name: discovery
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
-{{- end }}
-{{- if .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
-{{- end }}
-          args:
-          - "discovery"
-          - --monitoringAddr=:15014
-{{- if .Values.global.logging.level }}
-          - --log_output_level={{ .Values.global.logging.level }}
-{{- end}}
-{{- if .Values.global.logAsJson }}
-          - --log_as_json
-{{- end }}
-          - --domain
-          - {{ .Values.global.proxy.clusterDomain }}
-{{- if .Values.taint.namespace }}
-          - --cniNamespace={{ .Values.taint.namespace }}
-{{- end }}
-          - --keepaliveMaxServerConnectionAge
-          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
-{{- if .Values.extraContainerArgs }}
-          {{- with .Values.extraContainerArgs }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-{{- end }}
-          ports:
-          - containerPort: 8080
-            protocol: TCP
-            name: http-debug
-          - containerPort: 15010
-            protocol: TCP
-            name: grpc-xds
-          - containerPort: 15012
-            protocol: TCP
-            name: tls-xds
-          - containerPort: 15017
-            protocol: TCP
-            name: https-webhooks
-          - containerPort: 15014
-            protocol: TCP
-            name: http-monitoring
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 8080
-            initialDelaySeconds: 1
-            periodSeconds: 3
-            timeoutSeconds: 5
-          env:
-          - name: REVISION
-            value: "{{ .Values.revision | default `default` }}"
-          - name: PILOT_CERT_PROVIDER
-            value: {{ .Values.global.pilotCertProvider }}
-          - name: POD_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.name
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.namespace
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: spec.serviceAccountName
-          - name: KUBECONFIG
-            value: /var/run/secrets/remote/config
-          # If you explicitly told us where ztunnel lives, use that.
-          # Otherwise, assume it lives in our namespace
-          # Also, check for an explicit ENV override (legacy approach) and prefer that
-          # if present
-          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
-          {{ $ztTrustedName := or .Values.trustedZtunnelName "ztunnel" }}
-          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
-          - name: CA_TRUSTED_NODE_ACCOUNTS
-            value: "{{ $ztTrustedNS }}/{{ $ztTrustedName }}"
-          {{- end }}
-          {{- if .Values.env }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: "{{ $val }}"
-          {{- end }}
-          {{- end }}
-{{- if .Values.traceSampling }}
-          - name: PILOT_TRACE_SAMPLING
-            value: "{{ .Values.traceSampling }}"
-{{- end }}
-# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
-# don't set it here to avoid duplication.
-# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
-{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
-          - name: EXTERNAL_ISTIOD
-            value: "{{ .Values.global.externalIstiod }}"
-{{- end }}
-          - name: PILOT_ENABLE_ANALYSIS
-            value: "{{ .Values.global.istiod.enableAnalysis }}"
-          - name: CLUSTER_ID
-            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
-          - name: GOMEMLIMIT
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.memory
-          - name: GOMAXPROCS
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.cpu
-                divisor: "1"
-          - name: PLATFORM
-            value: "{{ coalesce .Values.global.platform .Values.platform }}"
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-              - ALL
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          volumeMounts:
-          - name: istio-token
-            mountPath: /var/run/secrets/tokens
-            readOnly: true
-          - name: local-certs
-            mountPath: /var/run/secrets/istio-dns
-          - name: cacerts
-            mountPath: /etc/cacerts
-            readOnly: true
-          - name: istio-kubeconfig
-            mountPath: /var/run/secrets/remote
-            readOnly: true
-          {{- if .Values.jwksResolverExtraRootCA }}
-          - name: extracacerts
-            mountPath: /cacerts
-          {{- end }}
-          - name: istio-csr-dns-cert
-            mountPath: /var/run/secrets/istiod/tls
-            readOnly: true
-          - name: istio-csr-ca-configmap
-            mountPath: /var/run/secrets/istiod/ca
-            readOnly: true
-          {{- with .Values.volumeMounts }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-      volumes:
-      # Technically not needed on this pod - but it helps debugging/testing SDS
-      # Should be removed after everything works.
-      - emptyDir:
-          medium: Memory
-        name: local-certs
-      - name: istio-token
-        projected:
-          sources:
-            - serviceAccountToken:
-                audience: {{ .Values.global.sds.token.aud }}
-                expirationSeconds: 43200
-                path: istio-token
-      # Optional: user-generated root
-      - name: cacerts
-        secret:
-          secretName: cacerts
-          optional: true
-      - name: istio-kubeconfig
-        secret:
-          secretName: istio-kubeconfig
-          optional: true
-      # Optional: istio-csr dns pilot certs
-      - name: istio-csr-dns-cert
-        secret:
-          secretName: istiod-tls
-          optional: true
-      - name: istio-csr-ca-configmap
-        configMap:
-          name: istio-ca-root-cert
-          defaultMode: 420
-          optional: true
-  {{- if .Values.jwksResolverExtraRootCA }}
-      - name: extracacerts
-        configMap:
-          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  {{- end }}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
-
----
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.25.4/charts/istiod/templates/istiod-injector-configmap.yaml
deleted file mode 100644
index 560c284ff..000000000
--- a/resources/v1.25.4/charts/istiod/templates/istiod-injector-configmap.yaml
+++ /dev/null
@@ -1,81 +0,0 @@
-{{- if not .Values.global.omitSidecarInjectorConfigMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
-  values: |-
-{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
-{{ $pilotVals := pick .Values "cni" -}}
-{{ $vals = set $vals "pilot" $pilotVals -}}
-{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
-{{ $vals = set $vals "gateways" $gatewayVals -}}
-{{ $vals | toPrettyJson | indent 4 }}
-
-  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
-  # and istiod webhook functionality.
-  #
-  # New fields should not use Values - it is a 'primary' config object, users should be able
-  # to fine tune it or use it with kube-inject.
-  config: |-
-    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
-    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
-    defaultTemplates:
-{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
-    - {{ . }}
-{{- end }}
-    {{- else }}
-    defaultTemplates: [sidecar]
-    {{- end }}
-    policy: {{ .Values.global.proxy.autoInject }}
-    alwaysInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
-    neverInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
-    injectedAnnotations:
-      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
-      "{{ $key }}": {{ $val | quote }}
-      {{- end }}
-    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
-         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
-         This should make it obvious that their installation is broken.
-     */}}
-    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
-    templates:
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
-      sidecar: |
-{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
-      gateway: |
-{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
-      grpc-simple: |
-{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
-      grpc-agent: |
-{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
-      waypoint: |
-{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
-      kube-gateway: |
-{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
-{{- end }}
-{{- with .Values.sidecarInjectorWebhook.templates }}
-{{ toYaml . | trim | indent 6 }}
-{{- end }}
-
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.25.4/charts/istiod/templates/mutatingwebhook.yaml
deleted file mode 100644
index 22160f70a..000000000
--- a/resources/v1.25.4/charts/istiod/templates/mutatingwebhook.yaml
+++ /dev/null
@@ -1,164 +0,0 @@
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- /* Core defines the common configuration used by all webhook segments */}}
-{{/* Copy just what we need to avoid expensive deepCopy */}}
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "caBundle" .Values.istiodRemote.injectionCABundle
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-    {{- if .caBundle }}
-    caBundle: "{{ .caBundle }}"
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  reinvocationPolicy: "{{ .reinvocationPolicy }}"
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
-{{- if not .Values.global.operatorManageWebhooks }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq .Release.Namespace "istio-system"}}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- else }}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
-
-{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
-{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-
-
-{{- /* Webhooks for default revision */}}
-{{- if (eq .Values.revision "") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.25.4/charts/istiod/templates/poddisruptionbudget.yaml
deleted file mode 100644
index 1eacf16e6..000000000
--- a/resources/v1.25.4/charts/istiod/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    istio: pilot
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app: istiod
-      {{- if ne .Values.revision "" }}
-      istio.io/rev: {{ .Values.revision | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.25.4/charts/istiod/templates/reader-clusterrole.yaml
deleted file mode 100644
index dbaa80503..000000000
--- a/resources/v1.25.4/charts/istiod/templates/reader-clusterrole.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - "config.istio.io"
-      - "security.istio.io"
-      - "networking.istio.io"
-      - "authentication.istio.io"
-      - "rbac.istio.io"
-      - "telemetry.istio.io"
-      - "extensions.istio.io"
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
-    resources: ["gateways"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: ["get", "list", "watch", "create", "delete"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["apps"]
-    resources: ["replicasets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-{{- if .Values.istiodRemote.enabled }}
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-{{- end}}
diff --git a/resources/v1.25.4/charts/istiod/templates/reader-clusterrolebinding.yaml b/resources/v1.25.4/charts/istiod/templates/reader-clusterrolebinding.yaml
deleted file mode 100644
index aea9f01f7..000000000
--- a/resources/v1.25.4/charts/istiod/templates/reader-clusterrolebinding.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istio-reader-service-account
-    namespace: {{ .Values.global.istioNamespace }}
diff --git a/resources/v1.25.4/charts/istiod/templates/remote-istiod-endpoints.yaml b/resources/v1.25.4/charts/istiod/templates/remote-istiod-endpoints.yaml
deleted file mode 100644
index a6de571da..000000000
--- a/resources/v1.25.4/charts/istiod/templates/remote-istiod-endpoints.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-# if the remotePilotAddress is an IP addr
-{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-subsets:
-- addresses:
-  - ip: {{ .Values.global.remotePilotAddress }}
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 15017
-    name: tcp-webhook
-    protocol: TCP
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.25.4/charts/istiod/templates/remote-istiod-service.yaml
deleted file mode 100644
index d3f872f74..000000000
--- a/resources/v1.25.4/charts/istiod/templates/remote-istiod-service.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.global.remotePilotAddress }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 443
-    targetPort: 15017
-    name: tcp-webhook
-    protocol: TCP
-  {{- if and .Values.global.remotePilotAddress (not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress)) }}
-  # if the remotePilotAddress is not an IP addr, we use ExternalName
-  type: ExternalName
-  externalName: {{ .Values.global.remotePilotAddress }}
-  {{- end }}
-{{- if .Values.global.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.global.ipFamilies }}
-  ipFamilies:
-{{- range .Values.global.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/revision-tags.yaml b/resources/v1.25.4/charts/istiod/templates/revision-tags.yaml
deleted file mode 100644
index 607358aa0..000000000
--- a/resources/v1.25.4/charts/istiod/templates/revision-tags.yaml
+++ /dev/null
@@ -1,147 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/role.yaml b/resources/v1.25.4/charts/istiod/templates/role.yaml
deleted file mode 100644
index 10d89e8d1..000000000
--- a/resources/v1.25.4/charts/istiod/templates/role.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-# permissions to verify the webhook is ready and rejecting
-# invalid config. We use --server-dry-run so no config is persisted.
-- apiGroups: ["networking.istio.io"]
-  verbs: ["create"]
-  resources: ["gateways"]
-
-# For storing CA secret
-- apiGroups: [""]
-  resources: ["secrets"]
-  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
-  verbs: ["create", "get", "watch", "list", "update", "delete"]
-
-# For status controller, so it can delete the distribution report configmap
-- apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["delete"]
-
-# For gateway deployment controller
-- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
-  verbs: ["get", "update", "patch", "create"]
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/rolebinding.yaml b/resources/v1.25.4/charts/istiod/templates/rolebinding.yaml
deleted file mode 100644
index a42f4ec44..000000000
--- a/resources/v1.25.4/charts/istiod/templates/rolebinding.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/service.yaml b/resources/v1.25.4/charts/istiod/templates/service.yaml
deleted file mode 100644
index 30d5b8912..000000000
--- a/resources/v1.25.4/charts/istiod/templates/service.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  {{- if .Values.serviceAnnotations }}
-  annotations:
-{{ toYaml .Values.serviceAnnotations | indent 4 }}
-  {{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: istiod
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-    - port: 15010
-      name: grpc-xds # plaintext
-      protocol: TCP
-    - port: 15012
-      name: https-dns # mTLS with k8s-signed cert
-      protocol: TCP
-    - port: 443
-      name: https-webhook # validation and injection
-      targetPort: 15017
-      protocol: TCP
-    - port: 15014
-      name: http-monitoring # prometheus stats
-      protocol: TCP
-  selector:
-    app: istiod
-    {{- if ne .Values.revision "" }}
-    istio.io/rev: {{ .Values.revision | quote }}
-    {{- else }}
-    # Label used by the 'default' service. For versioned deployments we match with app and version.
-    # This avoids default deployment picking the canary
-    istio: pilot
-    {{- end }}
-  {{- if .Values.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.ipFamilyPolicy }}
-  {{- end }}
-  {{- if .Values.ipFamilies }}
-  ipFamilies:
-  {{- range .Values.ipFamilies }}
-  - {{ . }}
-  {{- end }}
-  {{- end }}
----
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/serviceaccount.yaml b/resources/v1.25.4/charts/istiod/templates/serviceaccount.yaml
deleted file mode 100644
index a673a4d07..000000000
--- a/resources/v1.25.4/charts/istiod/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-  {{- if .Values.serviceAccountAnnotations }}
-  annotations:
-{{- toYaml .Values.serviceAccountAnnotations | nindent 4 }}
-  {{- end }}
-{{- end }}
----
diff --git a/resources/v1.25.4/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.25.4/charts/istiod/templates/validatingadmissionpolicy.yaml
deleted file mode 100644
index d36eef68e..000000000
--- a/resources/v1.25.4/charts/istiod/templates/validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.experimental.stableValidationPolicy }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-policy-binding{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-spec:
-  policyName: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  validationActions: [Deny]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.25.4/charts/istiod/templates/validatingwebhookconfiguration.yaml
deleted file mode 100644
index fb28836a0..000000000
--- a/resources/v1.25.4/charts/istiod/templates/validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,68 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.global.configValidation }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  # Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
-  # are rejecting invalid configs on a per-revision basis.
-  - name: rev.validation.istio.io
-    clientConfig:
-      # Should change from base but cannot for API compat
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.4/charts/istiod/templates/zzy_descope_legacy.yaml b/resources/v1.25.4/charts/istiod/templates/zzy_descope_legacy.yaml
deleted file mode 100644
index ae8fced29..000000000
--- a/resources/v1.25.4/charts/istiod/templates/zzy_descope_legacy.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-{{/* Copy anything under `.pilot` to `.`, to avoid the need to specify a redundant prefix.
-Due to the file naming, this always happens after zzz_profile.yaml */}}
-{{- $_ := mustMergeOverwrite $.Values (index $.Values "pilot") }}
\ No newline at end of file
diff --git a/resources/v1.25.4/charts/istiod/values.yaml b/resources/v1.25.4/charts/istiod/values.yaml
deleted file mode 100644
index ec32605a8..000000000
--- a/resources/v1.25.4/charts/istiod/values.yaml
+++ /dev/null
@@ -1,541 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-  # Set this if you install ztunnel with a name different from the default.
-  trustedZtunnelName: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.25.4
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.25.4/charts/revisiontags/Chart.yaml b/resources/v1.25.4/charts/revisiontags/Chart.yaml
deleted file mode 100644
index 43cfab3fc..000000000
--- a/resources/v1.25.4/charts/revisiontags/Chart.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.4
-description: Helm chart for istio revision tags
-name: revisiontags
-sources:
-- https://github.com/istio-ecosystem/sail-operator
-version: 0.1.0
-
diff --git a/resources/v1.25.4/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.25.4/charts/revisiontags/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.4/charts/revisiontags/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.4/charts/revisiontags/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.4/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.4/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/revisiontags/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.4/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.4/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/revisiontags/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.4/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.4/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/revisiontags/files/profile-platform-gke.yaml b/resources/v1.25.4/charts/revisiontags/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.4/charts/revisiontags/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.4/charts/revisiontags/files/profile-platform-k3d.yaml b/resources/v1.25.4/charts/revisiontags/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.4/charts/revisiontags/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.4/charts/revisiontags/files/profile-platform-microk8s.yaml b/resources/v1.25.4/charts/revisiontags/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.4/charts/revisiontags/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.4/charts/revisiontags/files/profile-platform-minikube.yaml b/resources/v1.25.4/charts/revisiontags/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.4/charts/revisiontags/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.4/charts/revisiontags/files/profile-platform-openshift.yaml b/resources/v1.25.4/charts/revisiontags/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.4/charts/revisiontags/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.4/charts/revisiontags/files/profile-preview.yaml b/resources/v1.25.4/charts/revisiontags/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.4/charts/revisiontags/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.4/charts/revisiontags/files/profile-remote.yaml b/resources/v1.25.4/charts/revisiontags/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.4/charts/revisiontags/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.4/charts/revisiontags/files/profile-stable.yaml b/resources/v1.25.4/charts/revisiontags/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.4/charts/revisiontags/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.4/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.25.4/charts/revisiontags/templates/revision-tags.yaml
deleted file mode 100644
index 607358aa0..000000000
--- a/resources/v1.25.4/charts/revisiontags/templates/revision-tags.yaml
+++ /dev/null
@@ -1,147 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.25.4/charts/revisiontags/values.yaml b/resources/v1.25.4/charts/revisiontags/values.yaml
deleted file mode 100644
index ec32605a8..000000000
--- a/resources/v1.25.4/charts/revisiontags/values.yaml
+++ /dev/null
@@ -1,541 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-  # Set this if you install ztunnel with a name different from the default.
-  trustedZtunnelName: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.25.4
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.25.4/charts/ztunnel/Chart.yaml b/resources/v1.25.4/charts/ztunnel/Chart.yaml
deleted file mode 100644
index a96d5c63f..000000000
--- a/resources/v1.25.4/charts/ztunnel/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.4
-description: Helm chart for istio ztunnel components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-ztunnel
-- istio
-name: ztunnel
-sources:
-- https://github.com/istio/istio
-version: 1.25.4
diff --git a/resources/v1.25.4/charts/ztunnel/README.md b/resources/v1.25.4/charts/ztunnel/README.md
deleted file mode 100644
index ffe0b94fe..000000000
--- a/resources/v1.25.4/charts/ztunnel/README.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# Istio Ztunnel Helm Chart
-
-This chart installs an Istio ztunnel.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart:
-
-```console
-helm install ztunnel istio/ztunnel
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the chart:
-
-```console
-helm delete ztunnel
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/ztunnel
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.25.4/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.25.4/charts/ztunnel/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.4/charts/ztunnel/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.4/charts/ztunnel/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.4/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.4/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/ztunnel/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.4/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.4/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/ztunnel/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.4/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.4/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.4/charts/ztunnel/files/profile-platform-gke.yaml b/resources/v1.25.4/charts/ztunnel/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.4/charts/ztunnel/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.4/charts/ztunnel/files/profile-platform-k3d.yaml b/resources/v1.25.4/charts/ztunnel/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.4/charts/ztunnel/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.4/charts/ztunnel/files/profile-platform-microk8s.yaml b/resources/v1.25.4/charts/ztunnel/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.4/charts/ztunnel/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.4/charts/ztunnel/files/profile-platform-minikube.yaml b/resources/v1.25.4/charts/ztunnel/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.4/charts/ztunnel/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.4/charts/ztunnel/files/profile-platform-openshift.yaml b/resources/v1.25.4/charts/ztunnel/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.4/charts/ztunnel/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.4/charts/ztunnel/files/profile-preview.yaml b/resources/v1.25.4/charts/ztunnel/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.4/charts/ztunnel/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.4/charts/ztunnel/files/profile-remote.yaml b/resources/v1.25.4/charts/ztunnel/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.4/charts/ztunnel/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.4/charts/ztunnel/files/profile-stable.yaml b/resources/v1.25.4/charts/ztunnel/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.4/charts/ztunnel/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.4/charts/ztunnel/templates/NOTES.txt b/resources/v1.25.4/charts/ztunnel/templates/NOTES.txt
deleted file mode 100644
index 244f59db0..000000000
--- a/resources/v1.25.4/charts/ztunnel/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-ztunnel successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.25.4/charts/ztunnel/templates/_helpers.tpl b/resources/v1.25.4/charts/ztunnel/templates/_helpers.tpl
deleted file mode 100644
index 82740e441..000000000
--- a/resources/v1.25.4/charts/ztunnel/templates/_helpers.tpl
+++ /dev/null
@@ -1 +0,0 @@
-{{ define "ztunnel.release-name" }}{{ .Values.resourceName| default .Release.Name }}{{ end }}
diff --git a/resources/v1.25.4/charts/ztunnel/templates/daemonset.yaml b/resources/v1.25.4/charts/ztunnel/templates/daemonset.yaml
deleted file mode 100644
index ee5775d70..000000000
--- a/resources/v1.25.4/charts/ztunnel/templates/daemonset.yaml
+++ /dev/null
@@ -1,197 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: {{ include "ztunnel.release-name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-spec:
-  updateStrategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app: ztunnel
-  template:
-    metadata:
-      labels:
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app: ztunnel
-        app.kubernetes.io/name: ztunnel
-        {{- include "istio.labels" . | nindent 8}}
-{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-{{- if .Values.revision }}
-        istio.io/rev: {{ .Values.revision }}
-{{- end }}
-{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-{{- if .Values.nodeSelector }}
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- if .Values.affinity }}
-      affinity:
-{{ toYaml .Values.affinity | trim | indent 8 }}
-{{- end }}
-      serviceAccountName: {{ include "ztunnel.release-name" . }}
-      tolerations:
-        - effect: NoSchedule
-          operator: Exists
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      containers:
-      - name: istio-proxy
-{{- if contains "/" .Values.image }}
-        image: "{{ .Values.image }}"
-{{- else }}
-        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
-{{- end }}
-        ports:
-        - containerPort: 15020
-          name: ztunnel-stats
-          protocol: TCP
-        resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 10 }}
-{{- end }}
-{{- with .Values.imagePullPolicy }}
-        imagePullPolicy: {{ . }}
-{{- end }}
-        securityContext:
-          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
-          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
-          allowPrivilegeEscalation: true
-          privileged: false
-          capabilities:
-            drop:
-            - ALL
-            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
-            - NET_ADMIN # Required for TPROXY and setsockopt
-            - SYS_ADMIN # Required for `setns` - doing things in other netns
-            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
-          readOnlyRootFilesystem: true
-          runAsGroup: 1337
-          runAsNonRoot: false
-          runAsUser: 0
-{{- if .Values.seLinuxOptions }}
-          seLinuxOptions:
-{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
-{{- end }}
-        readinessProbe:
-          httpGet:
-            port: 15021
-            path: /healthz/ready
-        args:
-        - proxy
-        - ztunnel
-        env:
-        - name: CA_ADDRESS
-        {{- if .Values.caAddress }}
-          value: {{ .Values.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: XDS_ADDRESS
-        {{- if .Values.xdsAddress }}
-          value: {{ .Values.xdsAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        {{- if .Values.logAsJson }}
-        - name: LOG_FORMAT
-          value: json
-        {{- end}}
-        - name: RUST_LOG
-          value: {{ .Values.logLevel | quote }}
-        - name: RUST_BACKTRACE
-          value: "1"
-        - name: ISTIO_META_CLUSTER_ID
-          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
-        - name: INPOD_ENABLED
-          value: "true"
-        - name: TERMINATION_GRACE_PERIOD_SECONDS
-          value: "{{ .Values.terminationGracePeriodSeconds }}"
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
-        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        {{- with .Values.env }}
-        {{- range $key, $val := . }}
-        - name: {{ $key }}
-          value: "{{ $val }}"
-        {{- end }}
-        {{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /var/run/ztunnel
-          name: cni-ztunnel-sock-dir
-        - mountPath: /tmp
-          name: tmp
-        {{- with .Values.volumeMounts }}
-          {{- toYaml . | nindent 8 }}
-        {{- end }}
-      priorityClassName: system-node-critical
-      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
-      volumes:
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: istio-ca
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      - name: cni-ztunnel-sock-dir
-        hostPath:
-          path: /var/run/ztunnel
-          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
-      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
-      - name: tmp
-        emptyDir: {}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
diff --git a/resources/v1.25.4/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.25.4/charts/ztunnel/templates/zzz_profile.yaml
deleted file mode 100644
index ded66c5fd..000000000
--- a/resources/v1.25.4/charts/ztunnel/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.4/charts/ztunnel/values.yaml b/resources/v1.25.4/charts/ztunnel/values.yaml
deleted file mode 100644
index b3db27dcb..000000000
--- a/resources/v1.25.4/charts/ztunnel/values.yaml
+++ /dev/null
@@ -1,102 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
-  hub: gcr.io/istio-release
-  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
-  tag: 1.25.4
-  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
-  variant: ""
-
-  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
-  # If Image contains a "/", it will replace the entire `image` in the pod.
-  image: ztunnel
-
-  # resourceName, if set, will override the naming of resources. If not set, will default to the release name.
-  # It is recommended to not set this; this is primarily for backwards compatibility.
-  resourceName: ""
-
-  # Labels to apply to all top level resources
-  labels: {}
-  # Annotations to apply to all top level resources
-  annotations: {}
-
-  # Additional volumeMounts to the ztunnel container
-  volumeMounts: []
-
-  # Additional volumes to the ztunnel pod
-  volumes: []
-
-  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-
-  # Additional labels to apply on the pod level
-  podLabels: {}
-
-  # Pod resource configuration
-  resources:
-    requests:
-      cpu: 200m
-      # Ztunnel memory scales with the size of the cluster and traffic load
-      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
-      memory: 512Mi
-
-  # List of secret names to add to the service account as image pull secrets
-  imagePullSecrets: []
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
-
-  # Override for the pod imagePullPolicy
-  imagePullPolicy: ""
-
-  # Settings for multicluster
-  multiCluster:
-    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
-    # with Istiod configuration.
-    clusterName: ""
-
-  # meshConfig defines runtime configuration of components.
-  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
-  # components.
-  # TODO: https://github.com/istio/istio/issues/43248
-  meshConfig:
-    defaultConfig:
-      proxyMetadata: {}
-
-  # This value defines:
-  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
-  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
-  # Default K8S value is 30 seconds
-  terminationGracePeriodSeconds: 30
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
-  revision: ""
-
-  # The customized CA address to retrieve certificates for the pods in the cluster.
-  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-  caAddress: ""
-
-  # The customized XDS address to retrieve configuration.
-  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
-  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
-  xdsAddress: ""
-
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
-  istioNamespace: istio-system
-
-  # Configuration log level of ztunnel binary, default is info.
-  # Valid values are: trace, debug, info, warn, error
-  logLevel: info
-
-  # To output all logs in json format
-  logAsJson: false
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seLinuxOptions: {}
-  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
-  #seLinuxOptions:
-  #  type: spc_t
diff --git a/resources/v1.25.4/cni-1.25.4.tgz.etag b/resources/v1.25.4/cni-1.25.4.tgz.etag
deleted file mode 100644
index ca2a40312..000000000
--- a/resources/v1.25.4/cni-1.25.4.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-bb6f36d35a30597bd8065ef3bfb5d6a6
diff --git a/resources/v1.25.4/commit b/resources/v1.25.4/commit
deleted file mode 100644
index 26a9e99b3..000000000
--- a/resources/v1.25.4/commit
+++ /dev/null
@@ -1 +0,0 @@
-1.25.4
diff --git a/resources/v1.25.4/gateway-1.25.4.tgz.etag b/resources/v1.25.4/gateway-1.25.4.tgz.etag
deleted file mode 100644
index b4d746e5c..000000000
--- a/resources/v1.25.4/gateway-1.25.4.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-833e5c5853d4a351796cb37b9f9ebfd3
diff --git a/resources/v1.25.4/istiod-1.25.4.tgz.etag b/resources/v1.25.4/istiod-1.25.4.tgz.etag
deleted file mode 100644
index 7191a5e79..000000000
--- a/resources/v1.25.4/istiod-1.25.4.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-3a5ad5c4afeaaa7f92064e14765c7c1b
diff --git a/resources/v1.25.4/profiles/ambient.yaml b/resources/v1.25.4/profiles/ambient.yaml
deleted file mode 100644
index 71ea784a8..000000000
--- a/resources/v1.25.4/profiles/ambient.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: ambient
diff --git a/resources/v1.25.4/profiles/demo.yaml b/resources/v1.25.4/profiles/demo.yaml
deleted file mode 100644
index 53c4b4163..000000000
--- a/resources/v1.25.4/profiles/demo.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: demo
diff --git a/resources/v1.25.4/profiles/empty.yaml b/resources/v1.25.4/profiles/empty.yaml
deleted file mode 100644
index 4477cb1fe..000000000
--- a/resources/v1.25.4/profiles/empty.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-# The empty profile has everything disabled
-# This is useful as a base for custom user configuration
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec: {}
diff --git a/resources/v1.25.4/profiles/openshift-ambient.yaml b/resources/v1.25.4/profiles/openshift-ambient.yaml
deleted file mode 100644
index 76edf00cd..000000000
--- a/resources/v1.25.4/profiles/openshift-ambient.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: ambient
-    global:
-      platform: openshift
diff --git a/resources/v1.25.4/profiles/openshift.yaml b/resources/v1.25.4/profiles/openshift.yaml
deleted file mode 100644
index 41492660f..000000000
--- a/resources/v1.25.4/profiles/openshift.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    global:
-      platform: openshift
diff --git a/resources/v1.25.4/profiles/preview.yaml b/resources/v1.25.4/profiles/preview.yaml
deleted file mode 100644
index 59d545c84..000000000
--- a/resources/v1.25.4/profiles/preview.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: preview
diff --git a/resources/v1.25.4/profiles/remote.yaml b/resources/v1.25.4/profiles/remote.yaml
deleted file mode 100644
index 54c65c8ba..000000000
--- a/resources/v1.25.4/profiles/remote.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# The remote profile is used to configure a mesh cluster without a locally deployed control plane.
-# Only the injector mutating webhook configuration is installed.
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: remote
diff --git a/resources/v1.25.4/profiles/stable.yaml b/resources/v1.25.4/profiles/stable.yaml
deleted file mode 100644
index 285feba24..000000000
--- a/resources/v1.25.4/profiles/stable.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: stable
diff --git a/resources/v1.25.4/ztunnel-1.25.4.tgz.etag b/resources/v1.25.4/ztunnel-1.25.4.tgz.etag
deleted file mode 100644
index a86ff0ded..000000000
--- a/resources/v1.25.4/ztunnel-1.25.4.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-24ffa1322560aa0adf2e6b9f53b17abf
diff --git a/resources/v1.25.5/base-1.25.5.tgz.etag b/resources/v1.25.5/base-1.25.5.tgz.etag
deleted file mode 100644
index 842b6dd2e..000000000
--- a/resources/v1.25.5/base-1.25.5.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-d179b0399acefe03cc99ec61c23a77bf
diff --git a/resources/v1.25.5/charts/base/Chart.yaml b/resources/v1.25.5/charts/base/Chart.yaml
deleted file mode 100644
index 0e52926c9..000000000
--- a/resources/v1.25.5/charts/base/Chart.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.5
-description: Helm chart for deploying Istio cluster resources and CRDs
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-name: base
-sources:
-- https://github.com/istio/istio
-version: 1.25.5
diff --git a/resources/v1.25.5/charts/base/README.md b/resources/v1.25.5/charts/base/README.md
deleted file mode 100644
index ae8f6d5b0..000000000
--- a/resources/v1.25.5/charts/base/README.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Istio base Helm Chart
-
-This chart installs resources shared by all Istio revisions. This includes Istio CRDs.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-base`:
-
-```console
-kubectl create namespace istio-system
-helm install istio-base istio/base -n istio-system
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.25.5/charts/base/files/profile-ambient.yaml b/resources/v1.25.5/charts/base/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.5/charts/base/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.5/charts/base/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.5/charts/base/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.5/charts/base/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/base/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.5/charts/base/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.5/charts/base/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/base/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.5/charts/base/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.5/charts/base/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/base/files/profile-platform-gke.yaml b/resources/v1.25.5/charts/base/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.5/charts/base/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.5/charts/base/files/profile-platform-k3d.yaml b/resources/v1.25.5/charts/base/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.5/charts/base/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.5/charts/base/files/profile-platform-microk8s.yaml b/resources/v1.25.5/charts/base/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.5/charts/base/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.5/charts/base/files/profile-platform-minikube.yaml b/resources/v1.25.5/charts/base/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.5/charts/base/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.5/charts/base/files/profile-platform-openshift.yaml b/resources/v1.25.5/charts/base/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.5/charts/base/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.5/charts/base/files/profile-preview.yaml b/resources/v1.25.5/charts/base/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.5/charts/base/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.5/charts/base/files/profile-remote.yaml b/resources/v1.25.5/charts/base/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.5/charts/base/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.5/charts/base/files/profile-stable.yaml b/resources/v1.25.5/charts/base/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.5/charts/base/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.5/charts/base/templates/NOTES.txt b/resources/v1.25.5/charts/base/templates/NOTES.txt
deleted file mode 100644
index f12616f57..000000000
--- a/resources/v1.25.5/charts/base/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-Istio base successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.25.5/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml b/resources/v1.25.5/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
deleted file mode 100644
index 2616b09c9..000000000
--- a/resources/v1.25.5/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,53 +0,0 @@
-{{- if and .Values.experimental.stableValidationPolicy (not (eq .Values.defaultRevision "")) }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-default-policy.istio.io"
-  labels:
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision }}
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-default-policy-binding.istio.io"
-spec:
-  policyName: "stable-channel-default-policy.istio.io"
-  validationActions: [Deny]
-{{- end }}
diff --git a/resources/v1.25.5/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml b/resources/v1.25.5/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
deleted file mode 100644
index 8cb76fd77..000000000
--- a/resources/v1.25.5/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-{{- if not (eq .Values.defaultRevision "") }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istiod-default-validator
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  - name: validation.istio.io
-    clientConfig:
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        {{- if (eq .Values.defaultRevision "default") }}
-        name: istiod
-        {{- else }}
-        name: istiod-{{ .Values.defaultRevision }}
-        {{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-{{- end }}
diff --git a/resources/v1.25.5/charts/base/templates/reader-serviceaccount.yaml b/resources/v1.25.5/charts/base/templates/reader-serviceaccount.yaml
deleted file mode 100644
index ba829a6bf..000000000
--- a/resources/v1.25.5/charts/base/templates/reader-serviceaccount.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-# This singleton service account aggregates reader permissions for the revisions in a given cluster
-# ATM this is a singleton per cluster with Istio installed, and is not revisioned. It maybe should be,
-# as otherwise compromising the token for this SA would give you access to *every* installed revision.
-# Should be used for remote secret creation.
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-    {{- end }}
-    {{- end }}
-metadata:
-  name: istio-reader-service-account
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.25.5/charts/base/templates/zzz_profile.yaml b/resources/v1.25.5/charts/base/templates/zzz_profile.yaml
deleted file mode 100644
index 9c2119b9a..000000000
--- a/resources/v1.25.5/charts/base/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.5/charts/cni/Chart.yaml b/resources/v1.25.5/charts/cni/Chart.yaml
deleted file mode 100644
index 3775bdf5f..000000000
--- a/resources/v1.25.5/charts/cni/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.5
-description: Helm chart for istio-cni components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-cni
-- istio
-name: cni
-sources:
-- https://github.com/istio/istio
-version: 1.25.5
diff --git a/resources/v1.25.5/charts/cni/README.md b/resources/v1.25.5/charts/cni/README.md
deleted file mode 100644
index a8b78d5bd..000000000
--- a/resources/v1.25.5/charts/cni/README.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# Istio CNI Helm Chart
-
-This chart installs the Istio CNI Plugin. See the [CNI installation guide](https://istio.io/latest/docs/setup/additional-setup/cni/)
-for more information.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-cni`:
-
-```console
-helm install istio-cni istio/cni -n kube-system
-```
-
-Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
-`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
-'system-node-critical' outside of kube-system.
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istio-cni
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Ambient
-
-To enable ambient, you can use the ambient profile: `--set profile=ambient`.
-
-#### Calico
-
-For Calico, you must also modify the settings to allow source spoofing:
-
-- if deployed by operator,  `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`
-- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )
-
-### GKE notes
-
-On GKE, 'kube-system' is required.
-
-If using `helm template`, `--set cni.cniBinDir=/home/kubernetes/bin` is required - with `helm install`
-it is auto-detected.
diff --git a/resources/v1.25.5/charts/cni/files/profile-ambient.yaml b/resources/v1.25.5/charts/cni/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.5/charts/cni/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.5/charts/cni/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.5/charts/cni/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.5/charts/cni/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/cni/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.5/charts/cni/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.5/charts/cni/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/cni/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.5/charts/cni/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.5/charts/cni/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/cni/files/profile-platform-gke.yaml b/resources/v1.25.5/charts/cni/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.5/charts/cni/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.5/charts/cni/files/profile-platform-k3d.yaml b/resources/v1.25.5/charts/cni/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.5/charts/cni/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.5/charts/cni/files/profile-platform-microk8s.yaml b/resources/v1.25.5/charts/cni/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.5/charts/cni/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.5/charts/cni/files/profile-platform-minikube.yaml b/resources/v1.25.5/charts/cni/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.5/charts/cni/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.5/charts/cni/files/profile-platform-openshift.yaml b/resources/v1.25.5/charts/cni/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.5/charts/cni/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.5/charts/cni/files/profile-preview.yaml b/resources/v1.25.5/charts/cni/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.5/charts/cni/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.5/charts/cni/files/profile-remote.yaml b/resources/v1.25.5/charts/cni/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.5/charts/cni/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.5/charts/cni/files/profile-stable.yaml b/resources/v1.25.5/charts/cni/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.5/charts/cni/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.5/charts/cni/templates/NOTES.txt b/resources/v1.25.5/charts/cni/templates/NOTES.txt
deleted file mode 100644
index fb35525b9..000000000
--- a/resources/v1.25.5/charts/cni/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-"{{ .Release.Name }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.25.5/charts/cni/templates/_helpers.tpl b/resources/v1.25.5/charts/cni/templates/_helpers.tpl
deleted file mode 100644
index 73cc17b2f..000000000
--- a/resources/v1.25.5/charts/cni/templates/_helpers.tpl
+++ /dev/null
@@ -1,8 +0,0 @@
-{{- define "name" -}}
-    istio-cni
-{{- end }}
-
-
-{{- define "istio-tag" -}}
-    {{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}
-{{- end }}
diff --git a/resources/v1.25.5/charts/cni/templates/clusterrolebinding.yaml b/resources/v1.25.5/charts/cni/templates/clusterrolebinding.yaml
deleted file mode 100644
index 42fedab1f..000000000
--- a/resources/v1.25.5/charts/cni/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-repair-rolebinding
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-repair-role
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "name" . }}
-    namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-ambient
-{{- end }}
diff --git a/resources/v1.25.5/charts/cni/templates/configmap-cni.yaml b/resources/v1.25.5/charts/cni/templates/configmap-cni.yaml
deleted file mode 100644
index 3deb2cb5a..000000000
--- a/resources/v1.25.5/charts/cni/templates/configmap-cni.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: {{ template "name" . }}-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  CURRENT_AGENT_VERSION: {{ .Values.tag | default .Values.global.tag | quote }}
-  AMBIENT_ENABLED: {{ .Values.ambient.enabled | quote }}
-  AMBIENT_DNS_CAPTURE: {{ .Values.ambient.dnsCapture | quote  }}
-  AMBIENT_IPV6: {{ .Values.ambient.ipv6 | quote }}
-  AMBIENT_RECONCILE_POD_RULES_ON_STARTUP: {{ .Values.ambient.reconcileIptablesOnStartup | quote }}
-  {{- if .Values.cniConfFileName }} # K8S < 1.24 doesn't like empty values
-  CNI_CONF_NAME: {{ .Values.cniConfFileName }} # Name of the CNI config file to create. Only override if you know the exact path your CNI requires..
-  {{- end }}
-  CHAINED_CNI_PLUGIN: {{ .Values.chained | quote }}
-  EXCLUDE_NAMESPACES: "{{ range $idx, $ns := .Values.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
-  REPAIR_ENABLED: {{ .Values.repair.enabled | quote }}
-  REPAIR_LABEL_PODS: {{ .Values.repair.labelPods | quote }}
-  REPAIR_DELETE_PODS: {{ .Values.repair.deletePods | quote }}
-  REPAIR_REPAIR_PODS: {{ .Values.repair.repairPods | quote }}
-  REPAIR_INIT_CONTAINER_NAME: {{ .Values.repair.initContainerName | quote }}
-  REPAIR_BROKEN_POD_LABEL_KEY: {{ .Values.repair.brokenPodLabelKey | quote }}
-  REPAIR_BROKEN_POD_LABEL_VALUE: {{ .Values.repair.brokenPodLabelValue | quote }}
-  {{- with .Values.env }}
-  {{- range $key, $val := . }}
-  {{ $key }}: "{{ $val }}"
-  {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.5/charts/cni/templates/daemonset.yaml b/resources/v1.25.5/charts/cni/templates/daemonset.yaml
deleted file mode 100644
index d83c77fce..000000000
--- a/resources/v1.25.5/charts/cni/templates/daemonset.yaml
+++ /dev/null
@@ -1,241 +0,0 @@
-# This manifest installs the Istio install-cni container, as well
-# as the Istio CNI plugin and config on
-# each master and worker node in a Kubernetes cluster.
-#
-# $detectedBinDir exists to support a GKE-specific platform override,
-# and is deprecated in favor of using the explicit `gke` platform profile.
-{{- $detectedBinDir := (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
-    "/home/kubernetes/bin"
-    "/opt/cni/bin"
-}}
-{{- if .Values.cniBinDir }}
-{{ $detectedBinDir = .Values.cniBinDir }}
-{{- end }}
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  # Note that this is templated but evaluates to a fixed name
-  # which the CNI plugin may fall back onto in some failsafe scenarios.
-  # if this name is changed, CNI plugin logic that checks for this name
-  # format should also be updated.
-  name: {{ template "name" . }}-node
-  namespace: {{ .Release.Namespace }}
-  labels:
-    k8s-app: {{ template "name" . }}-node
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  selector:
-    matchLabels:
-      k8s-app: {{ template "name" . }}-node
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  template:
-    metadata:
-      labels:
-        k8s-app: {{ template "name" . }}-node
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: {{ template "name" . }}
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-        # Add Prometheus Scrape annotations
-        prometheus.io/scrape: 'true'
-        prometheus.io/port: "15014"
-        prometheus.io/path: '/metrics'
-        # Add AppArmor annotation
-        # This is required to avoid conflicts with AppArmor profiles which block certain
-        # privileged pod capabilities.
-        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
-        # securityContext which is otherwise preferred.
-        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
-        # Custom annotations
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{if .Values.ambient.enabled }}
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-{{ end }}
-      nodeSelector:
-        kubernetes.io/os: linux
-      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      tolerations:
-        # Make sure istio-cni-node gets scheduled on all nodes.
-        - effect: NoSchedule
-          operator: Exists
-        # Mark the pod as a critical add-on for rescheduling.
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      priorityClassName: system-node-critical
-      serviceAccountName: {{ template "name" . }}
-      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
-      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
-      terminationGracePeriodSeconds: 5
-      containers:
-        # This container installs the Istio CNI binaries
-        # and CNI network config file on each node.
-        - name: install-cni
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
-{{- end }}
-{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
-{{- end }}
-          ports:
-          - containerPort: 15014
-            name: metrics
-            protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8000
-          securityContext:
-            privileged: false
-            runAsGroup: 0
-            runAsUser: 0
-            runAsNonRoot: false
-            # Both ambient and sidecar repair mode require elevated node privileges to function.
-            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
-            # add capabilities based on feature.
-            capabilities:
-              drop:
-              - ALL
-              add:
-              # CAP_NET_ADMIN is required to allow ipset and route table access
-              - NET_ADMIN
-              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
-              - NET_RAW
-              # CAP_SYS_PTRACE is required for repair and ambient mode to describe
-              # the pod's network namespace.
-              - SYS_PTRACE
-              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
-              # network namespaces in `/proc` to obtain descriptors for entering pod network
-              # namespaces. There does not appear to be a more granular capability for this.
-              - SYS_ADMIN
-              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
-              # the typical ability to read/write to folders owned by others.
-              # This can cause problems if the hostPath mounts we use, which we require write access into,
-              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
-              - DAC_OVERRIDE
-{{- if .Values.seLinuxOptions }}
-{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
-            seLinuxOptions:
-{{ toYaml . | trim | indent 14 }}
-{{- end }}
-{{- end }}
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          command: ["install-cni"]
-          args:
-            {{- if or .Values.logging.level .Values.global.logging.level }}
-            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
-            {{- end}}
-            {{- if .Values.global.logAsJson }}
-            - --log_as_json
-            {{- end}}
-          envFrom:
-            - configMapRef:
-                name: {{ template "name" . }}-config
-          env:
-            - name: REPAIR_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: REPAIR_RUN_AS_DAEMON
-              value: "true"
-            - name: REPAIR_SIDECAR_ANNOTATION
-              value: "sidecar.istio.io/status"
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  apiVersion: v1
-                  fieldPath: spec.nodeName
-            - name: GOMEMLIMIT
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.memory
-            - name: GOMAXPROCS
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.cpu
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          volumeMounts:
-            - mountPath: /host/opt/cni/bin
-              name: cni-bin-dir
-            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-            - mountPath: /host/proc
-              name: cni-host-procfs
-              readOnly: true
-            {{- end }}
-            - mountPath: /host/etc/cni/net.d
-              name: cni-net-dir
-            - mountPath: /var/run/istio-cni
-              name: cni-socket-dir
-            {{- if .Values.ambient.enabled }}
-            - mountPath: /host/var/run/netns
-              mountPropagation: HostToContainer
-              name: cni-netns-dir
-            - mountPath: /var/run/ztunnel
-              name: cni-ztunnel-sock-dir
-            {{ end }}
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-      volumes:
-        # Used to install CNI.
-        - name: cni-bin-dir
-          hostPath:
-            path: {{ $detectedBinDir }}
-        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-        - name: cni-host-procfs
-          hostPath:
-            path: /proc
-            type: Directory
-        {{- end }}
-        {{- if .Values.ambient.enabled }}
-        - name: cni-ztunnel-sock-dir
-          hostPath:
-            path: /var/run/ztunnel
-            type: DirectoryOrCreate
-        {{- end }}
-        - name: cni-net-dir
-          hostPath:
-            path: {{ .Values.cniConfDir }}
-        # Used for UDS sockets for logging, ambient eventing
-        - name: cni-socket-dir
-          hostPath:
-            path: /var/run/istio-cni
-        - name: cni-netns-dir
-          hostPath:
-            path: {{ .Values.cniNetnsDir }}
-            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
-            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
-            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.25.5/charts/cni/templates/network-attachment-definition.yaml b/resources/v1.25.5/charts/cni/templates/network-attachment-definition.yaml
deleted file mode 100644
index 86a2eb7c0..000000000
--- a/resources/v1.25.5/charts/cni/templates/network-attachment-definition.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-{{- if eq .Values.provider "multus" }}
-apiVersion: k8s.cni.cncf.io/v1
-kind: NetworkAttachmentDefinition
-metadata:
-  name: {{ template "name" . }}
-  namespace: default
-  labels:
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/cni/templates/resourcequota.yaml b/resources/v1.25.5/charts/cni/templates/resourcequota.yaml
deleted file mode 100644
index 9a6d61ff9..000000000
--- a/resources/v1.25.5/charts/cni/templates/resourcequota.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-{{- if .Values.resourceQuotas.enabled }}
-apiVersion: v1
-kind: ResourceQuota
-metadata:
-  name: {{ template "name" . }}-resource-quota
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  hard:
-    pods: {{ .Values.resourceQuotas.pods | quote }}
-  scopeSelector:
-    matchExpressions:
-    - operator: In
-      scopeName: PriorityClass
-      values:
-      - system-node-critical
-{{- end }}
diff --git a/resources/v1.25.5/charts/cni/templates/serviceaccount.yaml b/resources/v1.25.5/charts/cni/templates/serviceaccount.yaml
deleted file mode 100644
index 3193d7b74..000000000
--- a/resources/v1.25.5/charts/cni/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-{{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-{{- end }}
-{{- end }}
-metadata:
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.25.5/charts/cni/templates/zzy_descope_legacy.yaml b/resources/v1.25.5/charts/cni/templates/zzy_descope_legacy.yaml
deleted file mode 100644
index a9584ac29..000000000
--- a/resources/v1.25.5/charts/cni/templates/zzy_descope_legacy.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-{{/* Copy anything under `.cni` to `.`, to avoid the need to specify a redundant prefix.
-Due to the file naming, this always happens after zzz_profile.yaml */}}
-{{- $_ := mustMergeOverwrite $.Values (index $.Values "cni") }}
\ No newline at end of file
diff --git a/resources/v1.25.5/charts/cni/templates/zzz_profile.yaml b/resources/v1.25.5/charts/cni/templates/zzz_profile.yaml
deleted file mode 100644
index 9c2119b9a..000000000
--- a/resources/v1.25.5/charts/cni/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if false }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.5/charts/cni/values.yaml b/resources/v1.25.5/charts/cni/values.yaml
deleted file mode 100644
index e2f5fe162..000000000
--- a/resources/v1.25.5/charts/cni/values.yaml
+++ /dev/null
@@ -1,150 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  hub: ""
-  tag: ""
-  variant: ""
-  image: install-cni
-  pullPolicy: ""
-
-  # Same as `global.logging.level`, but will override it if set
-  logging:
-    level: ""
-
-  # Configuration file to insert istio-cni plugin configuration
-  # by default this will be the first file found in the cni-conf-dir
-  # Example
-  # cniConfFileName: 10-calico.conflist
-
-  # CNI-and-platform specific path defaults.
-  # These may need to be set to platform-specific values, consult
-  # overrides for your platform in `manifests/helm-profiles/platform-*.yaml`
-  cniBinDir: /opt/cni/bin
-  cniConfDir: /etc/cni/net.d
-  cniConfFileName: ""
-  cniNetnsDir: "/var/run/netns"
-
-  excludeNamespaces:
-    - kube-system
-
-  # Allows user to set custom affinity for the DaemonSet
-  affinity: {}
-
-  # Custom annotations on pod level, if you need them
-  podAnnotations: {}
-
-  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
-  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
-  chained: true
-
-  # Custom configuration happens based on the CNI provider.
-  # Possible values: "default", "multus"
-  provider: "default"
-
-  # Configure ambient settings
-  ambient:
-    # If enabled, ambient redirection will be enabled
-    enabled: false
-    # Set ambient config dir path: defaults to /etc/ambient-config
-    configDir: ""
-    # If enabled, and ambient is enabled, DNS redirection will be enabled
-    dnsCapture: true
-    # If enabled, and ambient is enabled, enables ipv6 support
-    ipv6: true
-    # If enabled, and ambient is enabled, the CNI agent will reconcile incompatible iptables rules and chains at startup.
-    # This will eventually be enabled by default
-    reconcileIptablesOnStartup: false
-
-
-  repair:
-    enabled: true
-    hub: ""
-    tag: ""
-
-    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
-    # This defines the action the controller will take when a pod is detected as broken.
-
-    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
-    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
-    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
-    labelPods: false
-    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
-    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
-    deletePods: false
-    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
-    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
-    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
-    repairPods: true
-
-    initContainerName: "istio-validation"
-
-    brokenPodLabelKey: "cni.istio.io/uninitialized"
-    brokenPodLabelValue: "true"
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
-  seLinuxOptions: {}
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 100Mi
-
-  resourceQuotas:
-    enabled: false
-    pods: 5000
-
-  # The number of pods that can be unavailable during rolling update (see
-  # `updateStrategy.rollingUpdate.maxUnavailable` here:
-  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
-  # May be specified as a number of pods or as a percent of the total number
-  # of pods at the start of the update.
-  rollingMaxUnavailable: 1
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  global:
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-
-    # Default tag for Istio images.
-    tag: 1.25.5
-
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # change cni scope level to control logging out of istio-cni-node DaemonSet
-    logging:
-      level: info
-
-    logAsJson: false
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Default resources allocated
-    defaultResources:
-      requests:
-        cpu: 100m
-        memory: 100Mi
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
diff --git a/resources/v1.25.5/charts/gateway/Chart.yaml b/resources/v1.25.5/charts/gateway/Chart.yaml
deleted file mode 100644
index d1971ec05..000000000
--- a/resources/v1.25.5/charts/gateway/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.5
-description: Helm chart for deploying Istio gateways
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- gateways
-name: gateway
-sources:
-- https://github.com/istio/istio
-type: application
-version: 1.25.5
diff --git a/resources/v1.25.5/charts/gateway/README.md b/resources/v1.25.5/charts/gateway/README.md
deleted file mode 100644
index 5c064d165..000000000
--- a/resources/v1.25.5/charts/gateway/README.md
+++ /dev/null
@@ -1,170 +0,0 @@
-# Istio Gateway Helm Chart
-
-This chart installs an Istio gateway deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-ingressgateway`:
-
-```console
-helm install istio-ingressgateway istio/gateway
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istio-ingressgateway` deployment:
-
-```console
-helm delete istio-ingressgateway
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/gateway
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### OpenShift
-
-When deploying the gateway in an OpenShift cluster, use the `openshift` profile to override the default values, for example:
-
-```console
-helm install istio-ingressgateway istio/gateway --set profile=openshift
-```
-
-### `image: auto` Information
-
-The image used by the chart, `auto`, may be unintuitive.
-This exists because the pod spec will be automatically populated at runtime, using the same mechanism as [Sidecar Injection](istio.io/latest/docs/setup/additional-setup/sidecar-injection).
-This allows the same configurations and lifecycle to apply to gateways as sidecars.
-
-Note: this does mean that the namespace the gateway is deployed in must not have the `istio-injection=disabled` label.
-See [Controlling the injection policy](https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy) for more info.
-
-### Examples
-
-#### Egress Gateway
-
-Deploying a Gateway to be used as an [Egress Gateway](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/):
-
-```yaml
-service:
-  # Egress gateways do not need an external LoadBalancer IP
-  type: ClusterIP
-```
-
-#### Multi-network/VM Gateway
-
-Deploying a Gateway to be used as a [Multi-network Gateway](https://istio.io/latest/docs/setup/install/multicluster/) for network `network-1`:
-
-```yaml
-networkGateway: network-1
-```
-
-### Migrating from other installation methods
-
-Installations from other installation methods (such as istioctl, Istio Operator, other helm charts, etc) can be migrated to use the new Helm charts
-following the guidance below.
-If you are able to, a clean installation is simpler. However, this often requires an external IP migration which can be challenging.
-
-WARNING: when installing over an existing deployment, the two deployments will be merged together by Helm, which may lead to unexpected results.
-
-#### Legacy Gateway Helm charts
-
-Istio historically offered two different charts - `manifests/charts/gateways/istio-ingress` and `manifests/charts/gateways/istio-egress`.
-These are replaced by this chart.
-While not required, it is recommended all new users use this chart, and existing users migrate when possible.
-
-This chart has the following benefits and differences:
-* Designed with Helm best practices in mind (standardized values options, values schema, values are not all nested under `gateways.istio-ingressgateway.*`, release name and namespace taken into account, etc).
-* Utilizes Gateway injection, simplifying upgrades, allowing gateways to run in any namespace, and avoiding repeating config for sidecars and gateways.
-* Published to official Istio Helm repository.
-* Single chart for all gateways (Ingress, Egress, East West).
-
-#### General concerns
-
-For a smooth migration, the resource names and `Deployment.spec.selector` labels must match.
-
-If you install with `helm install istio-gateway istio/gateway`, resources will be named `istio-gateway` and the `selector` labels set to:
-
-```yaml
-app: istio-gateway
-istio: gateway # the release name with leading istio- prefix stripped
-```
-
-If your existing installation doesn't follow these names, you can override them. For example, if you have resources named `my-custom-gateway` with `selector` labels
-`foo=bar,istio=ingressgateway`:
-
-```yaml
-name: my-custom-gateway # Override the name to match existing resources
-labels:
-  app: "" # Unset default app selector label
-  istio: ingressgateway # override default istio selector label
-  foo: bar # Add the existing custom selector label
-```
-
-#### Migrating an existing Helm release
-
-An existing helm release can be `helm upgrade`d to this chart by using the same release name. For example, if a previous
-installation was done like:
-
-```console
-helm install istio-ingress manifests/charts/gateways/istio-ingress -n istio-system
-```
-
-It could be upgraded with
-
-```console
-helm upgrade istio-ingress manifests/charts/gateway -n istio-system --set name=istio-ingressgateway --set labels.app=istio-ingressgateway --set labels.istio=ingressgateway
-```
-
-Note the name and labels are overridden to match the names of the existing installation.
-
-Warning: the helm charts here default to using port 80 and 443, while the old charts used 8080 and 8443.
-If you have AuthorizationPolicies that reference port these ports, you should update them during this process,
-or customize the ports to match the old defaults.
-See the [security advisory](https://istio.io/latest/news/security/istio-security-2021-002/) for more information.
-
-#### Other migrations
-
-If you see errors like `rendered manifests contain a resource that already exists` during installation, you may need to forcibly take ownership.
-
-The script below can handle this for you. Replace `RELEASE` and `NAMESPACE` with the name and namespace of the release:
-
-```console
-KINDS=(service deployment)
-RELEASE=istio-ingressgateway
-NAMESPACE=istio-system
-for KIND in "${KINDS[@]}"; do
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-name=$RELEASE
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-namespace=$NAMESPACE
-    kubectl --namespace $NAMESPACE --overwrite=true label $KIND $RELEASE app.kubernetes.io/managed-by=Helm
-done
-```
-
-You may ignore errors about resources not being found.
diff --git a/resources/v1.25.5/charts/gateway/files/profile-ambient.yaml b/resources/v1.25.5/charts/gateway/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.5/charts/gateway/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.5/charts/gateway/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.5/charts/gateway/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.5/charts/gateway/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/gateway/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.5/charts/gateway/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.5/charts/gateway/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/gateway/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.5/charts/gateway/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.5/charts/gateway/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/gateway/files/profile-platform-gke.yaml b/resources/v1.25.5/charts/gateway/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.5/charts/gateway/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.5/charts/gateway/files/profile-platform-k3d.yaml b/resources/v1.25.5/charts/gateway/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.5/charts/gateway/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.5/charts/gateway/files/profile-platform-microk8s.yaml b/resources/v1.25.5/charts/gateway/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.5/charts/gateway/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.5/charts/gateway/files/profile-platform-minikube.yaml b/resources/v1.25.5/charts/gateway/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.5/charts/gateway/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.5/charts/gateway/files/profile-platform-openshift.yaml b/resources/v1.25.5/charts/gateway/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.5/charts/gateway/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.5/charts/gateway/files/profile-preview.yaml b/resources/v1.25.5/charts/gateway/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.5/charts/gateway/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.5/charts/gateway/files/profile-remote.yaml b/resources/v1.25.5/charts/gateway/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.5/charts/gateway/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.5/charts/gateway/files/profile-stable.yaml b/resources/v1.25.5/charts/gateway/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.5/charts/gateway/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.5/charts/gateway/templates/NOTES.txt b/resources/v1.25.5/charts/gateway/templates/NOTES.txt
deleted file mode 100644
index fd0142911..000000000
--- a/resources/v1.25.5/charts/gateway/templates/NOTES.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-"{{ include "gateway.name" . }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
-
-Next steps:
-  * Deploy an HTTP Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/
-  * Deploy an HTTPS Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/
diff --git a/resources/v1.25.5/charts/gateway/templates/_helpers.tpl b/resources/v1.25.5/charts/gateway/templates/_helpers.tpl
deleted file mode 100644
index e5a0a9b3c..000000000
--- a/resources/v1.25.5/charts/gateway/templates/_helpers.tpl
+++ /dev/null
@@ -1,40 +0,0 @@
-{{- define "gateway.name" -}}
-{{- if eq .Release.Name "RELEASE-NAME" -}}
-  {{- .Values.name | default "istio-ingressgateway" -}}
-{{- else -}}
-  {{- .Values.name | default .Release.Name | default "istio-ingressgateway" -}}
-{{- end -}}
-{{- end }}
-
-{{- define "gateway.labels" -}}
-{{ include "gateway.selectorLabels" . }}
-{{- range $key, $val := .Values.labels }}
-{{- if and (ne $key "app") (ne $key "istio") }}
-{{ $key | quote }}: {{ $val | quote }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{- define "gateway.selectorLabels" -}}
-app: {{ (.Values.labels.app | quote) | default (include "gateway.name" .) }}
-istio: {{ (.Values.labels.istio | quote) | default (include "gateway.name" . | trimPrefix "istio-") }}
-{{- end }}
-
-{{/*
-Keep sidecar injection labels together
-https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy
-*/}}
-{{- define "gateway.sidecarInjectionLabels" -}}
-sidecar.istio.io/inject: "true"
-{{- with .Values.revision }}
-istio.io/rev: {{ . | quote }}
-{{- end }}
-{{- end }}
-
-{{- define "gateway.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create }}
-{{- .Values.serviceAccount.name | default (include "gateway.name" .)    }}
-{{- else }}
-{{- .Values.serviceAccount.name | default "default" }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/gateway/templates/deployment.yaml b/resources/v1.25.5/charts/gateway/templates/deployment.yaml
deleted file mode 100644
index 9db59d8b9..000000000
--- a/resources/v1.25.5/charts/gateway/templates/deployment.yaml
+++ /dev/null
@@ -1,128 +0,0 @@
-apiVersion: apps/v1
-kind: {{ .Values.kind | default "Deployment" }}
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  {{- with .Values.replicaCount }}
-  replicas: {{ . }}
-  {{- end }}
-  {{- end }}
-  {{- with .Values.strategy }}
-  strategy:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.minReadySeconds }}
-  minReadySeconds: {{ . }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "gateway.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
-        {{- include "gateway.selectorLabels" . | nindent 8 }}
-        app.kubernetes.io/name: {{ include "gateway.name" . }}
-        {{- include "istio.labels" .  | nindent 8}}
-        {{- range $key, $val := .Values.labels }}
-        {{- if and (ne $key "app") (ne $key "istio") }}
-        {{ $key | quote }}: {{ $val | quote }}
-        {{- end }}
-        {{- end }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
-      securityContext:
-      {{- if .Values.securityContext }}
-        {{- toYaml .Values.securityContext | nindent 8 }}
-      {{- else }}
-        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- end }}
-      {{- with .Values.volumes }}
-      volumes:
-        {{ toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: istio-proxy
-          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
-          image: auto
-          {{- with .Values.imagePullPolicy }}
-          imagePullPolicy: {{ . }}
-          {{- end }}
-          securityContext:
-          {{- if .Values.containerSecurityContext }}
-            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          {{- else }}
-            capabilities:
-              drop:
-              - ALL
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            {{- if not (eq (.Values.platform | default "") "openshift") }}
-            runAsUser: 1337
-            runAsGroup: 1337
-            {{- end }}
-            runAsNonRoot: true
-          {{- end }}
-          env:
-          {{- with .Values.networkGateway }}
-          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-            value: "{{.}}"
-          {{- end }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: {{ $val | quote }}
-          {{- end }}
-          ports:
-          - containerPort: 15090
-            protocol: TCP
-            name: http-envoy-prom
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          {{- with .Values.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.readinessProbe }}
-          readinessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
-      {{- with .Values.priorityClassName }}
-      priorityClassName: {{ . }}
-      {{- end }}
diff --git a/resources/v1.25.5/charts/gateway/templates/hpa.yaml b/resources/v1.25.5/charts/gateway/templates/hpa.yaml
deleted file mode 100644
index 64ecb6a4c..000000000
--- a/resources/v1.25.5/charts/gateway/templates/hpa.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-{{- if and (.Values.autoscaling.enabled) (eq .Values.kind "Deployment") }}
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: {{ .Values.kind | default "Deployment" }}
-    name: {{ include "gateway.name" . }}
-  minReplicas: {{ .Values.autoscaling.minReplicas }}
-  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
-  metrics:
-    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
-          type: Utilization
-    {{- end }}
-    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
-    - type: Resource
-      resource:
-        name: memory
-        target:
-          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
-          type: Utilization
-    {{- end }}
-  {{- if .Values.autoscaling.autoscaleBehavior }}
-  behavior: {{ toYaml .Values.autoscaling.autoscaleBehavior | nindent 4 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/gateway/templates/poddisruptionbudget.yaml b/resources/v1.25.5/charts/gateway/templates/poddisruptionbudget.yaml
deleted file mode 100644
index b0155cdf0..000000000
--- a/resources/v1.25.5/charts/gateway/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-{{- if .Values.podDisruptionBudget }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-spec:
-  selector:
-    matchLabels:
-  {{- include "gateway.selectorLabels" . | nindent 6 }}
-  {{- with .Values.podDisruptionBudget }}
-    {{- toYaml . | nindent 2 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/gateway/templates/role.yaml b/resources/v1.25.5/charts/gateway/templates/role.yaml
deleted file mode 100644
index 3d1607963..000000000
--- a/resources/v1.25.5/charts/gateway/templates/role.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-{{/*Set up roles for Istio Gateway. Not required for gateway-api*/}}
-{{- if .Values.rbac.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "watch", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "gateway.serviceAccountName" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ include "gateway.serviceAccountName" . }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/gateway/templates/service.yaml b/resources/v1.25.5/charts/gateway/templates/service.yaml
deleted file mode 100644
index 25ce3bcb0..000000000
--- a/resources/v1.25.5/charts/gateway/templates/service.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-{{- if not (eq .Values.service.type "None") }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-    {{- with .Values.networkGateway }}
-    topology.istio.io/network: "{{.}}"
-    {{- end }}
-  annotations:
-    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
-spec:
-{{- with .Values.service.loadBalancerIP }}
-  loadBalancerIP: "{{ . }}"
-{{- end }}
-{{- if eq .Values.service.type "LoadBalancer" }}
-  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
-  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
-  {{- end }}
-{{- end }}
-{{- if .Values.service.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.service.ipFamilies }}
-  ipFamilies:
-{{- range .Values.service.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
-{{- with .Values.service.loadBalancerSourceRanges }}
-  loadBalancerSourceRanges:
-{{ toYaml . | indent 4 }}
-{{- end }}
-{{- with .Values.service.externalTrafficPolicy }}
-  externalTrafficPolicy: "{{ . }}"
-{{- end }}
-  type: {{ .Values.service.type }}
-  ports:
-{{- if .Values.networkGateway }}
-  - name: status-port
-    port: 15021
-    targetPort: 15021
-  - name: tls
-    port: 15443
-    targetPort: 15443
-  - name: tls-istiod
-    port: 15012
-    targetPort: 15012
-  - name: tls-webhook
-    port: 15017
-    targetPort: 15017
-{{- else }}
-{{ .Values.service.ports | toYaml | indent 4 }}
-{{- end }}
-{{- if .Values.service.externalIPs }}
-  externalIPs: {{- range .Values.service.externalIPs }}
-    - {{.}}
-  {{- end }}
-{{- end }}
-  selector:
-    {{- include "gateway.selectorLabels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/gateway/templates/serviceaccount.yaml b/resources/v1.25.5/charts/gateway/templates/serviceaccount.yaml
deleted file mode 100644
index c88afeadd..000000000
--- a/resources/v1.25.5/charts/gateway/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-{{- if .Values.serviceAccount.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/gateway/templates/zzz_profile.yaml b/resources/v1.25.5/charts/gateway/templates/zzz_profile.yaml
deleted file mode 100644
index ded66c5fd..000000000
--- a/resources/v1.25.5/charts/gateway/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.5/charts/gateway/values.yaml b/resources/v1.25.5/charts/gateway/values.yaml
deleted file mode 100644
index d8b70ec15..000000000
--- a/resources/v1.25.5/charts/gateway/values.yaml
+++ /dev/null
@@ -1,168 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Name allows overriding the release name. Generally this should not be set
-  name: ""
-  # revision declares which revision this gateway is a part of
-  revision: ""
-
-  # Controls the spec.replicas setting for the Gateway deployment if set.
-  # Otherwise defaults to Kubernetes Deployment default (1).
-  replicaCount:
-
-  kind: Deployment
-
-  rbac:
-    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
-    # when using http://gateway-api.org/.
-    enabled: true
-
-  serviceAccount:
-    # If set, a service account will be created. Otherwise, the default is used
-    create: true
-    # Annotations to add to the service account
-    annotations: {}
-    # The name of the service account to use.
-    # If not set, the release name is used
-    name: ""
-
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-    prometheus.io/path: "/stats/prometheus"
-    inject.istio.io/templates: "gateway"
-    sidecar.istio.io/inject: "true"
-
-  # Define the security context for the pod.
-  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-  securityContext: {}
-  containerSecurityContext: {}
-
-  service:
-    # Type of service. Set to "None" to disable the service entirely
-    type: LoadBalancer
-    ports:
-    - name: status-port
-      port: 15021
-      protocol: TCP
-      targetPort: 15021
-    - name: http2
-      port: 80
-      protocol: TCP
-      targetPort: 80
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
-    annotations: {}
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    externalTrafficPolicy: ""
-    externalIPs: []
-    ipFamilyPolicy: ""
-    ipFamilies: []
-    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
-    # allocateLoadBalancerNodePorts: false
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: 2000m
-      memory: 1024Mi
-
-  autoscaling:
-    enabled: true
-    minReplicas: 1
-    maxReplicas: 5
-    targetCPUUtilizationPercentage: 80
-    targetMemoryUtilizationPercentage: {}
-    autoscaleBehavior: {}
-
-  # Pod environment variables
-  env: {}
-
-  # Deployment Update strategy
-  strategy: {}
-  
-  # Sets the Deployment minReadySeconds value
-  minReadySeconds:
-  
-  # Optionally configure a custom readinessProbe. By default the control plane
-  # automatically injects the readinessProbe. If you wish to override that
-  # behavior, you may define your own readinessProbe here.
-  readinessProbe: {}
-
-  # Labels to apply to all resources
-  labels:
-    # By default, don't enroll gateways into the ambient dataplane
-    "istio.io/dataplane-mode": none
-
-  # Annotations to apply to all resources
-  annotations: {}
-
-  nodeSelector: {}
-
-  tolerations: []
-
-  topologySpreadConstraints: []
-
-  affinity: {}
-
-  # If specified, the gateway will act as a network gateway for the given network.
-  networkGateway: ""
-
-  # Specify image pull policy if default behavior isn't desired.
-  # Default behavior: latest images will be Always else IfNotPresent
-  imagePullPolicy: ""
-
-  imagePullSecrets: []
-
-  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
-  #
-  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
-  # which means that no PodDisruptionBudget resource will be created.
-  #
-  # To enable the PodDisruptionBudget, configure it by specifying the
-  # `minAvailable` or `maxUnavailable`. For example, to set the
-  # minimum number of available replicas to 1, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #
-  # Or, to allow a maximum of 1 unavailable replica, you can set:
-  #
-  # podDisruptionBudget:
-  #   maxUnavailable: 1
-  #
-  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
-  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
-  #
-  # podDisruptionBudget:
-  #   minAvailable: 1
-  #   unhealthyPodEvictionPolicy: AlwaysAllow
-  #
-  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
-  #
-  # podDisruptionBudget: {}
-  #
-  podDisruptionBudget: {}
-
-  # Sets the per-pod terminationGracePeriodSeconds setting.
-  terminationGracePeriodSeconds: 30
-
-  # A list of `Volumes` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumes: []
-
-  # A list of `VolumeMounts` added into the Gateway Pods. See
-  # https://kubernetes.io/docs/concepts/storage/volumes/.
-  volumeMounts: []
-
-  # Configure this to a higher priority class in order to make sure your Istio gateway pods
-  # will not be killed because of low priority class.
-  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-  # for more detail.
-  priorityClassName: ""
diff --git a/resources/v1.25.5/charts/istiod/Chart.yaml b/resources/v1.25.5/charts/istiod/Chart.yaml
deleted file mode 100644
index 0f93263b4..000000000
--- a/resources/v1.25.5/charts/istiod/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.5
-description: Helm chart for istio control plane
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- istiod
-- istio-discovery
-name: istiod
-sources:
-- https://github.com/istio/istio
-version: 1.25.5
diff --git a/resources/v1.25.5/charts/istiod/README.md b/resources/v1.25.5/charts/istiod/README.md
deleted file mode 100644
index ddbfbc8fe..000000000
--- a/resources/v1.25.5/charts/istiod/README.md
+++ /dev/null
@@ -1,73 +0,0 @@
-# Istiod Helm Chart
-
-This chart installs an Istiod deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-Before installing, ensure CRDs are installed in the cluster (from the `istio/base` chart).
-
-To install the chart with the release name `istiod`:
-
-```console
-kubectl create namespace istio-system
-helm install istiod istio/istiod --namespace istio-system
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istiod` deployment:
-
-```console
-helm delete istiod --namespace istio-system
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istiod
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Examples
-
-#### Configuring mesh configuration settings
-
-Any [Mesh Config](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/) options can be configured like below:
-
-```yaml
-meshConfig:
-  accessLogFile: /dev/stdout
-```
-
-#### Revisions
-
-Control plane revisions allow deploying multiple versions of the control plane in the same cluster.
-This allows safe [canary upgrades](https://istio.io/latest/docs/setup/upgrade/canary/)
-
-```yaml
-revision: my-revision-name
-```
diff --git a/resources/v1.25.5/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.25.5/charts/istiod/files/gateway-injection-template.yaml
deleted file mode 100644
index dbd83cc57..000000000
--- a/resources/v1.25.5/charts/istiod/files/gateway-injection-template.yaml
+++ /dev/null
@@ -1,253 +0,0 @@
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations:
-    istio.io/rev: {{ .Revision | default "default" | quote }}
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}"
-    {{- end }}
-    {{- end }}
-spec:
-  securityContext:
-  {{- if .Values.gateways.securityContext }}
-    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
-  {{- else }}
-    sysctls:
-    - name: net.ipv4.ip_unprivileged_port_start
-      value: "0"
-  {{- end }}
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - router
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- end }}
-    securityContext:
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-    env:
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-  volumes:
-  - emptyDir: {}
-    name: workload-socket
-  - emptyDir: {}
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else}}
-  - emptyDir: {}
-    name: workload-certs
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.5/charts/istiod/files/grpc-agent.yaml b/resources/v1.25.5/charts/istiod/files/grpc-agent.yaml
deleted file mode 100644
index 7290fcdca..000000000
--- a/resources/v1.25.5/charts/istiod/files/grpc-agent.yaml
+++ /dev/null
@@ -1,310 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-    sidecar.istio.io/rewriteAppHTTPProbers: "false",
-  }
-spec:
-  containers:
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    ports:
-    - containerPort: 15020
-      protocol: TCP
-      name: mesh-metrics
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-          - --url=http://localhost:15020/healthz/ready
-    env:
-    - name: ISTIO_META_GENERATOR
-      value: grpc
-    - name: OUTPUT_CERTS
-      value: /var/lib/istio/data
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- if .DeploymentMeta.Name }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ .DeploymentMeta.Name }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    # grpc uses xds:/// to resolve – no need to resolve VIP
-    - name: ISTIO_META_DNS_CAPTURE
-      value: "false"
-    - name: DISABLE_ENVOY
-      value: "true"
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15020
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    # UDS channel between istioagent and gRPC client for XDS/SDS
-    - mountPath: /etc/istio/proxy
-      name: istio-xds
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-{{- range $index, $container := .Spec.Containers  }}
-{{ if not (eq $container.Name "istio-proxy") }}
-  - name: {{ $container.Name }}
-    env:
-      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
-        value: "true"
-      - name: "GRPC_XDS_BOOTSTRAP"
-        value: "/etc/istio/proxy/grpc-bootstrap.json"
-    volumeMounts:
-      - mountPath: /var/lib/istio/data
-        name: istio-data
-      # UDS channel between istioagent and gRPC client for XDS/SDS
-      - mountPath: /etc/istio/proxy
-        name: istio-xds
-      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-        readOnly: true
-      {{- else }}
-      - name: workload-certs
-        mountPath: /var/run/secrets/workload-spiffe-credentials
-      {{- end }}
-{{- end }}
-{{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-xds
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.5/charts/istiod/files/grpc-simple.yaml b/resources/v1.25.5/charts/istiod/files/grpc-simple.yaml
deleted file mode 100644
index 9ba0c7a46..000000000
--- a/resources/v1.25.5/charts/istiod/files/grpc-simple.yaml
+++ /dev/null
@@ -1,65 +0,0 @@
-metadata:
-  annotations:
-    sidecar.istio.io/rewriteAppHTTPProbers: "false"
-spec:
-  initContainers:
-    - name: grpc-bootstrap-init
-      image: busybox:1.28
-      volumeMounts:
-        - mountPath: /var/lib/grpc/data/
-          name: grpc-io-proxyless-bootstrap
-      env:
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: ISTIO_NAMESPACE
-          value: |
-             {{ .Values.global.istioNamespace }}
-      command:
-        - sh
-        - "-c"
-        - |-
-          NODE_ID="sidecar~${INSTANCE_IP}~${POD_NAME}.${POD_NAMESPACE}~cluster.local"
-          SERVER_URI="dns:///istiod.${ISTIO_NAMESPACE}.svc:15010"
-          echo '
-          {
-            "xds_servers": [
-              {
-                "server_uri": "'${SERVER_URI}'",
-                "channel_creds": [{"type": "insecure"}],
-                "server_features" : ["xds_v3"]
-              }
-            ],
-            "node": {
-              "id": "'${NODE_ID}'",
-              "metadata": {
-                "GENERATOR": "grpc"
-              }
-            }
-          }' > /var/lib/grpc/data/bootstrap.json
-  containers:
-  {{- range $index, $container := .Spec.Containers }}
-  - name: {{ $container.Name }}
-    env:
-      - name: GRPC_XDS_BOOTSTRAP
-        value: /var/lib/grpc/data/bootstrap.json
-      - name: GRPC_GO_LOG_VERBOSITY_LEVEL
-        value: "99"
-      - name: GRPC_GO_LOG_SEVERITY_LEVEL
-        value: info
-    volumeMounts:
-      - mountPath: /var/lib/grpc/data/
-        name: grpc-io-proxyless-bootstrap
-  {{- end }}
-  volumes:
-    - name: grpc-io-proxyless-bootstrap
-      emptyDir: {}
diff --git a/resources/v1.25.5/charts/istiod/files/injection-template.yaml b/resources/v1.25.5/charts/istiod/files/injection-template.yaml
deleted file mode 100644
index 55c6f563c..000000000
--- a/resources/v1.25.5/charts/istiod/files/injection-template.yaml
+++ /dev/null
@@ -1,517 +0,0 @@
-{{- define "resources"  }}
-  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
-      requests:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
-        {{ end }}
-    {{- end }}
-    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
-      limits:
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
-        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
-        {{ end }}
-        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
-        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
-        {{ end }}
-    {{- end }}
-  {{- else }}
-    {{- if .Values.global.proxy.resources }}
-      {{ toYaml .Values.global.proxy.resources | indent 6 }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
-{{ $tproxy := (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) }}
-{{- $containers := list }}
-{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
-metadata:
-  labels:
-    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
-    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
-    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
-    {{- end }}
-    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
-    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
-  annotations: {
-    istio.io/rev: {{ .Revision | default "default" | quote }},
-    {{- if ge (len $containers) 1 }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
-    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
-    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
-    {{- end }}
-    {{- end }}
-{{- if .Values.pilot.cni.enabled }}
-    {{- if eq .Values.pilot.cni.provider "multus" }}
-    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
-    {{- end }}
-    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
-    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
-    traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}",
-    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
-    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
-    {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
-    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
-    {{- end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}istio.io/reroute-virtual-interfaces: "{{.}}",{{ end }}
-    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
-{{- end }}
-  }
-spec:
-  {{- $holdProxy := and
-      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
-      (not $nativeSidecar) }}
-  initContainers:
-  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
-  {{ if .Values.pilot.cni.enabled -}}
-  - name: istio-validation
-  {{ else -}}
-  - name: istio-init
-  {{ end -}}
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    args:
-    - istio-iptables
-    - "-p"
-    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
-    - "-z"
-    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
-    - "-u"
-    - {{ if $tproxy }} "1337" {{ else }} {{ .ProxyUID | default "1337" | quote }} {{ end }}
-    - "-m"
-    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
-    - "-i"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
-    - "-x"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
-    - "-b"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
-    - "-d"
-  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
-    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
-  {{- else }}
-    - "15090,15021"
-  {{- end }}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
-    - "-q"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
-    {{ end -}}
-    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
-    - "-o"
-    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
-    {{ end -}}
-    {{ if (isset .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces`) -}}
-    - "-k"
-    - "{{ index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}"
-    {{ end -}}
-     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
-    - "-c"
-    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
-    {{ end -}}
-    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
-    {{ if .Values.global.logAsJson -}}
-    - "--log_as_json"
-    {{ end -}}
-    {{ if .Values.pilot.cni.enabled -}}
-    - "--run-validation"
-    - "--skip-rule-apply"
-    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
-    - "--force-apply"
-    {{ end -}}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-  {{- if .ProxyConfig.ProxyMetadata }}
-    env:
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-  {{- end }}
-    resources:
-  {{ template "resources" . }}
-    securityContext:
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      privileged: {{ .Values.global.proxy.privileged }}
-      capabilities:
-    {{- if not .Values.pilot.cni.enabled }}
-        add:
-        - NET_ADMIN
-        - NET_RAW
-    {{- end }}
-        drop:
-        - ALL
-    {{- if not .Values.pilot.cni.enabled }}
-      readOnlyRootFilesystem: false
-      runAsGroup: 0
-      runAsNonRoot: false
-      runAsUser: 0
-    {{- else }}
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyGID | default "1337" }} {{ end }}
-      runAsUser: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyUID | default "1337" }} {{ end }}
-      runAsNonRoot: true
-    {{- end }}
-  {{ end -}}
-  {{ if not $nativeSidecar }}
-  containers:
-  {{ end }}
-  - name: istio-proxy
-  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-  {{- else }}
-    image: "{{ .ProxyImage }}"
-  {{- end }}
-    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
-    ports:
-    - containerPort: 15090
-      protocol: TCP
-      name: http-envoy-prom
-    args:
-    - proxy
-    - sidecar
-    - --domain
-    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
-    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
-    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
-  {{- if .Values.global.sts.servicePort }}
-    - --stsPort={{ .Values.global.sts.servicePort }}
-  {{- end }}
-  {{- if .Values.global.logAsJson }}
-    - --log_as_json
-  {{- end }}
-  {{- if .Values.global.proxy.outlierLogPath }}
-    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-  {{- end}}
-  {{- if .Values.global.proxy.lifecycle }}
-    lifecycle:
-      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
-  {{- else if $holdProxy }}
-    lifecycle:
-      postStart:
-        exec:
-          command:
-          - pilot-agent
-          - wait
-  {{- else if $nativeSidecar }}
-    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
-    lifecycle:
-      preStop:
-        exec:
-          command:
-          - pilot-agent
-          - request
-          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
-          - POST
-          - drain
-  {{- end }}
-    env:
-    {{- if eq .InboundTrafficPolicyMode "localhost" }}
-    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
-      value: "true"
-    {{- end }}
-    - name: PILOT_CERT_PROVIDER
-      value: {{ .Values.global.pilotCertProvider }}
-    - name: CA_ADDR
-    {{- if .Values.global.caAddress }}
-      value: {{ .Values.global.caAddress }}
-    {{- else }}
-      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-    {{- end }}
-    - name: POD_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.name
-    - name: POD_NAMESPACE
-      valueFrom:
-        fieldRef:
-          fieldPath: metadata.namespace
-    - name: INSTANCE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.podIP
-    - name: SERVICE_ACCOUNT
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.serviceAccountName
-    - name: HOST_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: ISTIO_CPU_LIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    - name: PROXY_CONFIG
-      value: |
-             {{ protoToJSON .ProxyConfig }}
-    - name: ISTIO_META_POD_PORTS
-      value: |-
-        [
-        {{- $first := true }}
-        {{- range $index1, $c := .Spec.Containers }}
-          {{- range $index2, $p := $c.Ports }}
-            {{- if (structToJSON $p) }}
-            {{if not $first}},{{end}}{{ structToJSON $p }}
-            {{- $first = false }}
-            {{- end }}
-          {{- end}}
-        {{- end}}
-        ]
-    - name: ISTIO_META_APP_CONTAINERS
-      value: "{{ $containers | join "," }}"
-    - name: GOMEMLIMIT
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-    - name: GOMAXPROCS
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.cpu
-    {{- if .CompliancePolicy }}
-    - name: COMPLIANCE_POLICY
-      value: "{{ .CompliancePolicy }}"
-    {{- end }}
-    - name: ISTIO_META_CLUSTER_ID
-      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-    - name: ISTIO_META_NODE_NAME
-      valueFrom:
-        fieldRef:
-          fieldPath: spec.nodeName
-    - name: ISTIO_META_INTERCEPTION_MODE
-      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
-    {{- if .Values.global.network }}
-    - name: ISTIO_META_NETWORK
-      value: "{{ .Values.global.network }}"
-    {{- end }}
-    {{- with (index .ObjectMeta.Labels `service.istio.io/workload-name` | default .DeploymentMeta.Name) }}
-    - name: ISTIO_META_WORKLOAD_NAME
-      value: "{{ . }}"
-    {{ end }}
-    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
-    - name: ISTIO_META_OWNER
-      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
-    {{- end}}
-    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - name: ISTIO_BOOTSTRAP_OVERRIDE
-      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
-    {{- end }}
-    {{- if .Values.global.meshID }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ .Values.global.meshID }}"
-    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-    - name: ISTIO_META_MESH_ID
-      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-    {{- end }}
-    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-    - name: TRUST_DOMAIN
-      value: "{{ . }}"
-    {{- end }}
-    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{- end }}
-    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-    - name: {{ $key }}
-      value: "{{ $value }}"
-    {{- end }}
-    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
-  {{ if .Values.global.proxy.startupProbe.enabled }}
-    startupProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: 0
-      periodSeconds: 1
-      timeoutSeconds: 3
-      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
-  {{ end }}
-    readinessProbe:
-      httpGet:
-        path: /healthz/ready
-        port: 15021
-      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
-      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
-      timeoutSeconds: 3
-      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
-    {{ end -}}
-    securityContext:
-      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
-      allowPrivilegeEscalation: true
-      capabilities:
-        add:
-        - NET_ADMIN
-        drop:
-        - ALL
-      privileged: true
-      readOnlyRootFilesystem: true
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      runAsNonRoot: false
-      runAsUser: 0
-      {{- else }}
-      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
-      capabilities:
-        {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-        add:
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
-        - NET_ADMIN
-        {{- end }}
-        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
-        - NET_BIND_SERVICE
-        {{- end }}
-        {{- end }}
-        drop:
-        - ALL
-      privileged: {{ .Values.global.proxy.privileged }}
-      readOnlyRootFilesystem: true
-      {{ if or ($tproxy) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
-      runAsNonRoot: false
-      runAsUser: 0
-      runAsGroup: 1337
-      {{- else -}}
-      runAsNonRoot: true
-      runAsUser: {{ .ProxyUID | default "1337" }}
-      runAsGroup: {{ .ProxyGID | default "1337" }}
-      {{- end }}
-      {{- end }}
-    resources:
-  {{ template "resources" . }}
-    volumeMounts:
-    - name: workload-socket
-      mountPath: /var/run/secrets/workload-spiffe-uds
-    - name: credential-socket
-      mountPath: /var/run/secrets/credential-uds
-    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-    - name: gke-workload-certificate
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-      readOnly: true
-    {{- else }}
-    - name: workload-certs
-      mountPath: /var/run/secrets/workload-spiffe-credentials
-    {{- end }}
-    {{- if eq .Values.global.pilotCertProvider "istiod" }}
-    - mountPath: /var/run/secrets/istio
-      name: istiod-ca-cert
-    {{- end }}
-    - mountPath: /var/lib/istio/data
-      name: istio-data
-    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-    - mountPath: /etc/istio/custom-bootstrap
-      name: custom-bootstrap-volume
-    {{- end }}
-    # SDS channel between istioagent and Envoy
-    - mountPath: /etc/istio/proxy
-      name: istio-envoy
-    - mountPath: /var/run/secrets/tokens
-      name: istio-token
-    {{- if .Values.global.mountMtlsCerts }}
-    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-    - mountPath: /etc/certs/
-      name: istio-certs
-      readOnly: true
-    {{- end }}
-    - name: istio-podinfo
-      mountPath: /etc/istio/pod
-     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
-      name: lightstep-certs
-      readOnly: true
-    {{- end }}
-      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
-      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
-    - name: "{{  $index }}"
-      {{ toYaml $value | indent 6 }}
-      {{ end }}
-      {{- end }}
-  volumes:
-  - emptyDir:
-    name: workload-socket
-  - emptyDir:
-    name: credential-socket
-  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-  - name: gke-workload-certificate
-    csi:
-      driver: workloadcertificates.security.cloud.google.com
-  {{- else }}
-  - emptyDir:
-    name: workload-certs
-  {{- end }}
-  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
-  - name: custom-bootstrap-volume
-    configMap:
-      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
-  {{- end }}
-  # SDS channel between istioagent and Envoy
-  - emptyDir:
-      medium: Memory
-    name: istio-envoy
-  - name: istio-data
-    emptyDir: {}
-  - name: istio-podinfo
-    downwardAPI:
-      items:
-        - path: "labels"
-          fieldRef:
-            fieldPath: metadata.labels
-        - path: "annotations"
-          fieldRef:
-            fieldPath: metadata.annotations
-  - name: istio-token
-    projected:
-      sources:
-      - serviceAccountToken:
-          path: istio-token
-          expirationSeconds: 43200
-          audience: {{ .Values.global.sds.token.aud }}
-  {{- if eq .Values.global.pilotCertProvider "istiod" }}
-  - name: istiod-ca-cert
-    configMap:
-      name: istio-ca-root-cert
-  {{- end }}
-  {{- if .Values.global.mountMtlsCerts }}
-  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
-  - name: istio-certs
-    secret:
-      optional: true
-      {{ if eq .Spec.ServiceAccountName "" }}
-      secretName: istio.default
-      {{ else -}}
-      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
-      {{  end -}}
-  {{- end }}
-    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
-    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
-  - name: "{{ $index }}"
-    {{ toYaml $value | indent 4 }}
-    {{ end }}
-    {{ end }}
-  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
-  - name: lightstep-certs
-    secret:
-      optional: true
-      secretName: lightstep.cacert
-  {{- end }}
-  {{- if .Values.global.imagePullSecrets }}
-  imagePullSecrets:
-    {{- range .Values.global.imagePullSecrets }}
-    - name: {{ . }}
-    {{- end }}
-  {{- end }}
diff --git a/resources/v1.25.5/charts/istiod/files/kube-gateway.yaml b/resources/v1.25.5/charts/istiod/files/kube-gateway.yaml
deleted file mode 100644
index dbe158de1..000000000
--- a/resources/v1.25.5/charts/istiod/files/kube-gateway.yaml
+++ /dev/null
@@ -1,345 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-gateway-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": {{.Name}}
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-gateway-controller"
-          ) | nindent 8 }}
-    spec:
-      securityContext:
-      {{- if .Values.gateways.securityContext }}
-        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
-      {{- else }}
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- if .Values.gateways.seccompProfile }}
-        seccompProfile:
-      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
-      {{- end }}
-      {{- end }}
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-      {{- else }}
-        image: "{{ .ProxyImage }}"
-      {{- end }}
-        {{- if .Values.global.proxy.resources }}
-        resources:
-          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-          allowPrivilegeEscalation: false
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsUser: {{ .ProxyUID | default "1337" }}
-          runAsGroup: {{ .ProxyGID | default "1337" }}
-          runAsNonRoot: true
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        args:
-        - proxy
-        - router
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-      {{- if .Values.global.sts.servicePort }}
-        - --stsPort={{ .Values.global.sts.servicePort }}
-      {{- end }}
-      {{- if .Values.global.logAsJson }}
-        - --log_as_json
-      {{- end }}
-      {{- if .Values.global.proxy.lifecycle }}
-        lifecycle:
-          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
-      {{- end }}
-        env:
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        - name: ISTIO_META_POD_PORTS
-          value: "[]"
-        - name: ISTIO_META_APP_CONTAINERS
-          value: ""
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: "{{ .ProxyConfig.InterceptionMode.String }}"
-        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
-        - name: ISTIO_META_NETWORK
-          value: {{.|quote}}
-        {{- end }}
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName|quote}}
-        - name: ISTIO_META_OWNER
-          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
-        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-          value: {{.|quote}}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        volumeMounts:
-        - name: workload-socket
-          mountPath: /var/run/secrets/workload-spiffe-uds
-        - name: credential-socket
-          mountPath: /var/run/secrets/credential-uds
-        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-        - name: gke-workload-certificate
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-          readOnly: true
-        {{- else }}
-        - name: workload-certs
-          mountPath: /var/run/secrets/workload-spiffe-credentials
-        {{- end }}
-        {{- if eq .Values.global.pilotCertProvider "istiod" }}
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        {{- end }}
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        # SDS channel between istioagent and Envoy
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - name: istio-podinfo
-          mountPath: /etc/istio/pod
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir: {}
-        name: credential-socket
-      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
-      - name: gke-workload-certificate
-        csi:
-          driver: workloadcertificates.security.cloud.google.com
-      {{- else}}
-      - emptyDir: {}
-        name: workload-certs
-      {{- end }}
-      # SDS channel between istioagent and Envoy
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - name: istio-data
-        emptyDir: {}
-      - name: istio-podinfo
-        downwardAPI:
-          items:
-            - path: "labels"
-              fieldRef:
-                fieldPath: metadata.labels
-            - path: "annotations"
-              fieldRef:
-                fieldPath: metadata.annotations
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: {{ .Values.global.sds.token.aud }}
-      {{- if eq .Values.global.pilotCertProvider "istiod" }}
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      {{- end }}
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: {{.Name}}
-    uid: {{.UID}}
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": {{.Name}}
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.25.5/charts/istiod/files/profile-ambient.yaml b/resources/v1.25.5/charts/istiod/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.5/charts/istiod/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.5/charts/istiod/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.5/charts/istiod/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.5/charts/istiod/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/istiod/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.5/charts/istiod/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.5/charts/istiod/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/istiod/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.5/charts/istiod/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.5/charts/istiod/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/istiod/files/profile-platform-gke.yaml b/resources/v1.25.5/charts/istiod/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.5/charts/istiod/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.5/charts/istiod/files/profile-platform-k3d.yaml b/resources/v1.25.5/charts/istiod/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.5/charts/istiod/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.5/charts/istiod/files/profile-platform-microk8s.yaml b/resources/v1.25.5/charts/istiod/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.5/charts/istiod/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.5/charts/istiod/files/profile-platform-minikube.yaml b/resources/v1.25.5/charts/istiod/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.5/charts/istiod/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.5/charts/istiod/files/profile-platform-openshift.yaml b/resources/v1.25.5/charts/istiod/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.5/charts/istiod/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.5/charts/istiod/files/profile-preview.yaml b/resources/v1.25.5/charts/istiod/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.5/charts/istiod/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.5/charts/istiod/files/profile-remote.yaml b/resources/v1.25.5/charts/istiod/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.5/charts/istiod/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.5/charts/istiod/files/profile-stable.yaml b/resources/v1.25.5/charts/istiod/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.5/charts/istiod/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.5/charts/istiod/files/waypoint.yaml b/resources/v1.25.5/charts/istiod/files/waypoint.yaml
deleted file mode 100644
index 2600e98e2..000000000
--- a/resources/v1.25.5/charts/istiod/files/waypoint.yaml
+++ /dev/null
@@ -1,340 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{.ServiceAccount | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  {{- if ge .KubeVersion 128 }}
-  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-  {{- end }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  annotations:
-    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-        "gateway.istio.io/managed" "istio.io-mesh-controller"
-      ) | nindent 4 }}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  selector:
-    matchLabels:
-      "{{.GatewayNameLabel}}": "{{.Name}}"
-  template:
-    metadata:
-      annotations:
-        {{- toJsonMap
-          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
-          (strdict "istio.io/rev" (.Revision | default "default"))
-          (strdict
-            "prometheus.io/path" "/stats/prometheus"
-            "prometheus.io/port" "15020"
-            "prometheus.io/scrape" "true"
-          ) | nindent 8 }}
-      labels:
-        {{- toJsonMap
-          (strdict
-            "sidecar.istio.io/inject" "false"
-            "istio.io/dataplane-mode" "none"
-            "service.istio.io/canonical-name" .DeploymentName
-            "service.istio.io/canonical-revision" "latest"
-           )
-          .InfrastructureLabels
-          (strdict
-            "gateway.networking.k8s.io/gateway-name" .Name
-            "gateway.istio.io/managed" "istio.io-mesh-controller"
-          ) | nindent 8}}
-    spec:
-      {{- if .Values.global.waypoint.affinity }}
-      affinity:
-      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.topologySpreadConstraints }}
-      topologySpreadConstraints:
-      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.nodeSelector }}
-      nodeSelector:
-      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
-      {{- end }}
-      {{- if .Values.global.waypoint.tolerations }}
-      tolerations:
-      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: 2
-      serviceAccountName: {{.ServiceAccount | quote}}
-      containers:
-      - name: istio-proxy
-        ports:
-        - containerPort: 15020
-          name: metrics
-          protocol: TCP
-        - containerPort: 15021
-          name: status-port
-          protocol: TCP
-        - containerPort: 15090
-          protocol: TCP
-          name: http-envoy-prom
-        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
-        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
-        {{- else }}
-        image: "{{ .ProxyImage }}"
-        {{- end }}
-        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
-        args:
-        - proxy
-        - waypoint
-        - --domain
-        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
-        - --serviceCluster
-        - {{.ServiceAccount}}.$(POD_NAMESPACE)
-        - --proxyLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
-        - --proxyComponentLogLevel
-        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
-        - --log_output_level
-        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
-        {{- if .Values.global.logAsJson }}
-        - --log_as_json
-        {{- end }}
-        {{- if .Values.global.proxy.outlierLogPath }}
-        - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
-        {{- end}}
-        env:
-        - name: ISTIO_META_SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: ISTIO_META_NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: PILOT_CERT_PROVIDER
-          value: {{ .Values.global.pilotCertProvider }}
-        - name: CA_ADDR
-        {{- if .Values.global.caAddress }}
-          value: {{ .Values.global.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        - name: HOST_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.hostIP
-        - name: ISTIO_CPU_LIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: PROXY_CONFIG
-          value: |
-                 {{ protoToJSON .ProxyConfig }}
-        {{- if .ProxyConfig.ProxyMetadata }}
-        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        - name: GOMEMLIMIT
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.memory
-        - name: GOMAXPROCS
-          valueFrom:
-            resourceFieldRef:
-              resource: limits.cpu
-        - name: ISTIO_META_CLUSTER_ID
-          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
-        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
-        {{- if $network }}
-        - name: ISTIO_META_NETWORK
-          value: "{{ $network }}"
-        {{- end }}
-        - name: ISTIO_META_INTERCEPTION_MODE
-          value: REDIRECT
-        - name: ISTIO_META_WORKLOAD_NAME
-          value: {{.DeploymentName}}
-        - name: ISTIO_META_OWNER
-          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
-        {{- if .Values.global.meshID }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ .Values.global.meshID }}"
-        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: ISTIO_META_MESH_ID
-          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
-        {{- end }}
-        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
-        - name: TRUST_DOMAIN
-          value: "{{ . }}"
-        {{- end }}
-        {{- if .Values.global.waypoint.resources }}
-        resources:
-        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
-        {{- end }}
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 1
-          periodSeconds: 1
-          successThreshold: 1
-          timeoutSeconds: 1
-        readinessProbe:
-          failureThreshold: 4
-          httpGet:
-            path: /healthz/ready
-            port: 15021
-            scheme: HTTP
-          initialDelaySeconds: 0
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 1
-        securityContext:
-          privileged: false
-        {{- if not (eq .Values.global.platform "openshift") }}
-          runAsGroup: 1337
-          runAsUser: 1337
-        {{- end }}
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          capabilities:
-            drop:
-            - ALL
-{{- if .Values.gateways.seccompProfile }}
-          seccompProfile:
-{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
-{{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/workload-spiffe-uds
-          name: workload-socket
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/lib/istio/data
-          name: istio-data
-        - mountPath: /etc/istio/proxy
-          name: istio-envoy
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /etc/istio/pod
-          name: istio-podinfo
-      volumes:
-      - emptyDir: {}
-        name: workload-socket
-      - emptyDir:
-          medium: Memory
-        name: istio-envoy
-      - emptyDir:
-          medium: Memory
-        name: go-proxy-envoy
-      - emptyDir: {}
-        name: istio-data
-      - emptyDir: {}
-        name: go-proxy-data
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.labels
-            path: labels
-          - fieldRef:
-              fieldPath: metadata.annotations
-            path: annotations
-        name: istio-podinfo
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              audience: istio-ca
-              expirationSeconds: 43200
-              path: istio-token
-      - configMap:
-          name: istio-ca-root-cert
-        name: istiod-ca-cert
-      {{- if .Values.global.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range .Values.global.imagePullSecrets }}
-        - name: {{ . }}
-        {{- end }}
-      {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    {{ toJsonMap
-      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
-      (omit .InfrastructureAnnotations
-        "kubectl.kubernetes.io/last-applied-configuration"
-        "gateway.istio.io/name-override"
-        "gateway.istio.io/service-account"
-        "gateway.istio.io/controller-version"
-      ) | nindent 4 }}
-  labels:
-    {{- toJsonMap
-      .InfrastructureLabels
-      (strdict
-        "gateway.networking.k8s.io/gateway-name" .Name
-      ) | nindent 4 }}
-  name: {{.DeploymentName | quote}}
-  namespace: {{.Namespace | quote}}
-  ownerReferences:
-  - apiVersion: gateway.networking.k8s.io/v1beta1
-    kind: Gateway
-    name: "{{.Name}}"
-    uid: "{{.UID}}"
-spec:
-  ipFamilyPolicy: PreferDualStack
-  ports:
-  {{- range $key, $val := .Ports }}
-  - name: {{ $val.Name | quote }}
-    port: {{ $val.Port }}
-    protocol: TCP
-    appProtocol: {{ $val.AppProtocol }}
-  {{- end }}
-  selector:
-    "{{.GatewayNameLabel}}": "{{.Name}}"
-  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
-  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
-  {{- end }}
-  type: {{ .ServiceType | quote }}
----
diff --git a/resources/v1.25.5/charts/istiod/templates/NOTES.txt b/resources/v1.25.5/charts/istiod/templates/NOTES.txt
deleted file mode 100644
index 0d07ea7f4..000000000
--- a/resources/v1.25.5/charts/istiod/templates/NOTES.txt
+++ /dev/null
@@ -1,82 +0,0 @@
-"istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
-
-Next steps:
-{{- $profile := default "" .Values.profile }}
-{{- if (eq $profile "ambient") }}
-  * Get started with ambient: https://istio.io/latest/docs/ops/ambient/getting-started/
-  * Review ambient's architecture: https://istio.io/latest/docs/ops/ambient/architecture/
-{{- else }}
-  * Deploy a Gateway: https://istio.io/latest/docs/setup/additional-setup/gateway/
-  * Try out our tasks to get started on common configurations:
-    * https://istio.io/latest/docs/tasks/traffic-management
-    * https://istio.io/latest/docs/tasks/security/
-    * https://istio.io/latest/docs/tasks/policy-enforcement/
-{{- end }}
-  * Review the list of actively supported releases, CVE publications and our hardening guide:
-    * https://istio.io/latest/docs/releases/supported-releases/
-    * https://istio.io/latest/news/security/
-    * https://istio.io/latest/docs/ops/best-practices/security/
-
-For further documentation see https://istio.io website
-
-{{-
-  $deps := dict
-    "global.outboundTrafficPolicy" "meshConfig.outboundTrafficPolicy"
-    "global.certificates" "meshConfig.certificates"
-    "global.localityLbSetting" "meshConfig.localityLbSetting"
-    "global.policyCheckFailOpen" "meshConfig.policyCheckFailOpen"
-    "global.enableTracing" "meshConfig.enableTracing"
-    "global.proxy.accessLogFormat" "meshConfig.accessLogFormat"
-    "global.proxy.accessLogFile" "meshConfig.accessLogFile"
-    "global.proxy.concurrency" "meshConfig.defaultConfig.concurrency"
-    "global.proxy.envoyAccessLogService" "meshConfig.defaultConfig.envoyAccessLogService"
-    "global.proxy.envoyAccessLogService.enabled" "meshConfig.enableEnvoyAccessLogService"
-    "global.proxy.envoyMetricsService" "meshConfig.defaultConfig.envoyMetricsService"
-    "global.proxy.protocolDetectionTimeout" "meshConfig.protocolDetectionTimeout"
-    "global.proxy.holdApplicationUntilProxyStarts" "meshConfig.defaultConfig.holdApplicationUntilProxyStarts"
-    "pilot.ingress" "meshConfig.ingressService, meshConfig.ingressControllerMode, and meshConfig.ingressClass"
-    "global.mtls.enabled" "the PeerAuthentication resource"
-    "global.mtls.auto" "meshConfig.enableAutoMtls"
-    "global.tracer.lightstep.address" "meshConfig.defaultConfig.tracing.lightstep.address"
-    "global.tracer.lightstep.accessToken" "meshConfig.defaultConfig.tracing.lightstep.accessToken"
-    "global.tracer.zipkin.address" "meshConfig.defaultConfig.tracing.zipkin.address"
-    "global.tracer.datadog.address" "meshConfig.defaultConfig.tracing.datadog.address"
-    "global.meshExpansion.enabled" "Gateway and other Istio networking resources, such as in samples/multicluster/"
-    "istiocoredns.enabled" "the in-proxy DNS capturing (ISTIO_META_DNS_CAPTURE)"
-}}
-{{- range $dep, $replace := $deps }}
-{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
-{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
-{{- if not (eq $res "")}}
-WARNING: {{$dep|quote}} is deprecated; use {{$replace|quote}} instead.
-{{- end }}
-{{- end }}
-{{-
-  $failDeps := dict
-    "telemetry.v2.prometheus.configOverride"
-    "telemetry.v2.stackdriver.configOverride"
-    "telemetry.v2.stackdriver.disableOutbound"
-    "telemetry.v2.stackdriver.outboundAccessLogging"
-    "global.tracer.stackdriver.debug" "meshConfig.defaultConfig.tracing.stackdriver.debug"
-    "global.tracer.stackdriver.maxNumberOfAttributes" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes"
-    "global.tracer.stackdriver.maxNumberOfAnnotations" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations"
-    "global.tracer.stackdriver.maxNumberOfMessageEvents" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents"
-    "meshConfig.defaultConfig.tracing.stackdriver.debug" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents" "Istio supported tracers"
-}}
-{{- range $dep, $replace := $failDeps }}
-{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
-{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
-{{- if not (eq $res "")}}
-{{fail (print $dep " is removed")}}
-{{- end }}
-{{- end }}
-{{- if eq $.Values.global.pilotCertProvider "kubernetes" }}
-{{- fail "pilotCertProvider=kubernetes is not supported" }}
-{{- end }}
\ No newline at end of file
diff --git a/resources/v1.25.5/charts/istiod/templates/_helpers.tpl b/resources/v1.25.5/charts/istiod/templates/_helpers.tpl
deleted file mode 100644
index 042c92538..000000000
--- a/resources/v1.25.5/charts/istiod/templates/_helpers.tpl
+++ /dev/null
@@ -1,23 +0,0 @@
-{{/* Default Prometheus is enabled if its enabled and there are no config overrides set */}}
-{{ define "default-prometheus" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.prometheus.enabled
-}}
-{{- end }}
-
-{{/* SD has metrics and logging split. Default metrics are enabled if SD is enabled */}}
-{{ define "default-sd-metrics" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
-}}
-{{- end }}
-
-{{/* SD has metrics and logging split. */}}
-{{ define "default-sd-logs" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
-}}
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/autoscale.yaml b/resources/v1.25.5/charts/istiod/templates/autoscale.yaml
deleted file mode 100644
index 09cd6258c..000000000
--- a/resources/v1.25.5/charts/istiod/templates/autoscale.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if and .Values.autoscaleEnabled .Values.autoscaleMin .Values.autoscaleMax }}
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  maxReplicas: {{ .Values.autoscaleMax }}
-  minReplicas: {{ .Values.autoscaleMin }}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  metrics:
-  - type: Resource
-    resource:
-      name: cpu
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.cpu.targetAverageUtilization }}
-  {{- if .Values.memory.targetAverageUtilization }}
-  - type: Resource
-    resource:
-      name: memory
-      target:
-        type: Utilization
-        averageUtilization: {{ .Values.memory.targetAverageUtilization }}
-  {{- end }}
-  {{- if .Values.autoscaleBehavior }}
-  behavior: {{ toYaml .Values.autoscaleBehavior | nindent 4 }}
-  {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/clusterrole.yaml b/resources/v1.25.5/charts/istiod/templates/clusterrole.yaml
deleted file mode 100644
index 0c340b5b3..000000000
--- a/resources/v1.25.5/charts/istiod/templates/clusterrole.yaml
+++ /dev/null
@@ -1,187 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  # sidecar injection controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-
-  # configuration validation webhook controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-
-  # istio configuration
-  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
-  # please proceed with caution
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["get", "watch", "list"]
-    resources: ["*"]
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["update", "patch"]
-    resources:
-    - authorizationpolicies/status
-    - destinationrules/status
-    - envoyfilters/status
-    - gateways/status
-    - peerauthentications/status
-    - proxyconfigs/status
-    - requestauthentications/status
-    - serviceentries/status
-    - sidecars/status
-    - telemetries/status
-    - virtualservices/status
-    - wasmplugins/status
-    - workloadentries/status
-    - workloadgroups/status
-{{- end }}
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries/status",  "serviceentries/status" ]
-  - apiGroups: ["security.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "authorizationpolicies/status" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services/status" ]
-
-  # auto-detect installed CRD definitions
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-
-  # discovery and routing
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-
-{{- if .Values.taint.enabled }}
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["patch"]
-{{- end }}
-
-  # ingress controller
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-{{- end}}
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses", "ingressclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-
-  # required for CA's namespace controller
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-
-  # Istiod and bootstrap.
-{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
-{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "certificatesigningrequests"
-      - "certificatesigningrequests/approval"
-      - "certificatesigningrequests/status"
-    verbs: ["update", "create", "get", "delete", "watch"]
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "signers"
-    resourceNames:
-{{- range .Values.global.certSigners }}
-    - {{ . | quote }}
-{{- end }}
-    verbs: ["approve"]
-{{- end}}
-
-  # Used by Istiod to verify the JWT tokens
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-
-  # Used by Istiod to verify gateway SDS
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-
-  # Use for Kubernetes Service APIs
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources:
-    - backendtlspolicies/status
-    - gatewayclasses/status
-    - gateways/status
-    - grpcroutes/status
-    - httproutes/status
-    - referencegrants/status
-    - tcproutes/status
-    - tlsroutes/status
-    - udproutes/status
-    verbs: ["update", "patch"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["gatewayclasses"]
-    verbs: ["create", "update", "patch", "delete"]
-
-  # Needed for multicluster secret reading, possibly ingress certs in the future
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "watch", "list"]
-
-  # Used for MCS serviceexport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: [ "get", "watch", "list", "create", "delete"]
-
-  # Used for MCS serviceimport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "watch", "list"]
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: ["apps"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "deployments" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "serviceaccounts"]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.25.5/charts/istiod/templates/clusterrolebinding.yaml
deleted file mode 100644
index 10781b407..000000000
--- a/resources/v1.25.5/charts/istiod/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-- kind: ServiceAccount
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.25.5/charts/istiod/templates/configmap-jwks.yaml
deleted file mode 100644
index 3505d2822..000000000
--- a/resources/v1.25.5/charts/istiod/templates/configmap-jwks.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.jwksResolverExtraRootCA }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  extra.pem: {{ .Values.jwksResolverExtraRootCA | quote }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/configmap-values.yaml b/resources/v1.25.5/charts/istiod/templates/configmap-values.yaml
deleted file mode 100644
index a7e60369d..000000000
--- a/resources/v1.25.5/charts/istiod/templates/configmap-values.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-  original-values: |-
-{{ .Values._original | toPrettyJson | indent 4 }}
-{{- $_ := unset $.Values "_original" }}
-  merged-values: |-
-{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.25.5/charts/istiod/templates/configmap.yaml b/resources/v1.25.5/charts/istiod/templates/configmap.yaml
deleted file mode 100644
index 3098d300f..000000000
--- a/resources/v1.25.5/charts/istiod/templates/configmap.yaml
+++ /dev/null
@@ -1,106 +0,0 @@
-{{- define "mesh" }}
-    # The trust domain corresponds to the trust root of a system.
-    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
-    trustDomain: "cluster.local"
-
-    # The namespace to treat as the administrative root namespace for Istio configuration.
-    # When processing a leaf namespace Istio will search for declarations in that namespace first
-    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
-    # is processed as if it were declared in the leaf namespace.
-    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
-
-  {{ $prom := include "default-prometheus" . | eq "true" }}
-  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
-  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
-  {{- if or $prom $sdMetrics $sdLogs }}
-    defaultProviders:
-    {{- if or $prom $sdMetrics }}
-      metrics:
-      {{ if $prom }}- prometheus{{ end }}
-      {{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
-    {{- end }}
-    {{- if and $sdMetrics $sdLogs }}
-      accessLogging:
-      - stackdriver
-    {{- end }}
-  {{- end }}
-
-    defaultConfig:
-      {{- if .Values.global.meshID }}
-      meshId: "{{ .Values.global.meshID }}"
-      {{- end }}
-      {{- with (.Values.global.proxy.variant | default .Values.global.variant) }}
-      image:
-        imageType: {{. | quote}}
-      {{- end }}
-      {{- if not (eq .Values.global.proxy.tracer "none") }}
-      tracing:
-      {{- if eq .Values.global.proxy.tracer "lightstep" }}
-        lightstep:
-          # Address of the LightStep Satellite pool
-          address: {{ .Values.global.tracer.lightstep.address }}
-          # Access Token used to communicate with the Satellite pool
-          accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
-      {{- else if eq .Values.global.proxy.tracer "zipkin" }}
-        zipkin:
-          # Address of the Zipkin collector
-          address: {{ ((.Values.global.tracer).zipkin).address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
-      {{- else if eq .Values.global.proxy.tracer "datadog" }}
-        datadog:
-          # Address of the Datadog Agent
-          address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
-      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
-        stackdriver:
-          # enables trace output to stdout.
-          debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}
-          # The global default max number of attributes per span.
-          maxNumberOfAttributes: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAttributes | default "200" }}
-          # The global default max number of annotation events per span.
-          maxNumberOfAnnotations: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAnnotations | default "200" }}
-          # The global default max number of message events per span.
-          maxNumberOfMessageEvents: {{ (($.Values.global.tracer).stackdriver).maxNumberOfMessageEvents | default "200" }}
-      {{- end }}
-      {{- end }}
-      {{- if .Values.global.remotePilotAddress }}
-      discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
-      {{- else }}
-      discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
-      {{- end }}
-{{- end }}
-
-{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
-{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
-{{- $originalMesh := include "mesh" . | fromYaml }}
-{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
-
-{{- if .Values.configMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-
-  # Configuration file for the mesh networks to be used by the Split Horizon EDS.
-  meshNetworks: |-
-  {{- if .Values.global.meshNetworks }}
-    networks:
-{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
-  {{- else }}
-    networks: {}
-  {{- end }}
-
-  mesh: |-
-{{- if .Values.meshConfig }}
-{{ $mesh | toYaml | indent 4 }}
-{{- else }}
-{{- include "mesh" . }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/deployment.yaml b/resources/v1.25.5/charts/istiod/templates/deployment.yaml
deleted file mode 100644
index 5380805e9..000000000
--- a/resources/v1.25.5/charts/istiod/templates/deployment.yaml
+++ /dev/null
@@ -1,291 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- range $key, $val := .Values.deploymentLabels }}
-    {{ $key }}: "{{ $val }}"
-{{- end }}
-spec:
-{{- if not .Values.autoscaleEnabled }}
-{{- if .Values.replicaCount }}
-  replicas: {{ .Values.replicaCount }}
-{{- end }}
-{{- end }}
-  strategy:
-    rollingUpdate:
-      maxSurge: {{ .Values.rollingMaxSurge }}
-      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
-  selector:
-    matchLabels:
-      {{- if ne .Values.revision "" }}
-      app: istiod
-      istio.io/rev: {{ .Values.revision | default "default" | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
-  template:
-    metadata:
-      labels:
-        app: istiod
-        istio.io/rev: {{ .Values.revision | default "default" | quote }}
-        sidecar.istio.io/inject: "false"
-        operator.istio.io/component: "Pilot"
-        {{- if ne .Values.revision "" }}
-        istio: istiod
-        {{- else }}
-        istio: pilot
-        {{- end }}
-        {{- range $key, $val := .Values.podLabels }}
-        {{ $key }}: "{{ $val }}"
-        {{- end }}
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: "istiod"
-        {{- include "istio.labels" . | nindent 8 }}
-      annotations:
-        prometheus.io/port: "15014"
-        prometheus.io/scrape: "true"
-        sidecar.istio.io/inject: "false"
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{- if .Values.nodeSelector }}
-      nodeSelector:
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- with .Values.affinity }}
-      affinity:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      tolerations:
-        - key: cni.istio.io/not-ready
-          operator: "Exists"
-{{- with .Values.tolerations }}
-{{- toYaml . | nindent 8 }}
-{{- end }}
-{{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-{{- toYaml . | nindent 8 }}
-{{- end }}
-      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- if .Values.global.priorityClassName }}
-      priorityClassName: "{{ .Values.global.priorityClassName }}"
-{{- end }}
-{{- with .Values.initContainers }}
-      initContainers:
-        {{- tpl (toYaml .) $ | nindent 8 }}
-{{- end }}
-      containers:
-        - name: discovery
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
-{{- end }}
-{{- if .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
-{{- end }}
-          args:
-          - "discovery"
-          - --monitoringAddr=:15014
-{{- if .Values.global.logging.level }}
-          - --log_output_level={{ .Values.global.logging.level }}
-{{- end}}
-{{- if .Values.global.logAsJson }}
-          - --log_as_json
-{{- end }}
-          - --domain
-          - {{ .Values.global.proxy.clusterDomain }}
-{{- if .Values.taint.namespace }}
-          - --cniNamespace={{ .Values.taint.namespace }}
-{{- end }}
-          - --keepaliveMaxServerConnectionAge
-          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
-{{- if .Values.extraContainerArgs }}
-          {{- with .Values.extraContainerArgs }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-{{- end }}
-          ports:
-          - containerPort: 8080
-            protocol: TCP
-            name: http-debug
-          - containerPort: 15010
-            protocol: TCP
-            name: grpc-xds
-          - containerPort: 15012
-            protocol: TCP
-            name: tls-xds
-          - containerPort: 15017
-            protocol: TCP
-            name: https-webhooks
-          - containerPort: 15014
-            protocol: TCP
-            name: http-monitoring
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 8080
-            initialDelaySeconds: 1
-            periodSeconds: 3
-            timeoutSeconds: 5
-          env:
-          - name: REVISION
-            value: "{{ .Values.revision | default `default` }}"
-          - name: PILOT_CERT_PROVIDER
-            value: {{ .Values.global.pilotCertProvider }}
-          - name: POD_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.name
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.namespace
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: spec.serviceAccountName
-          - name: KUBECONFIG
-            value: /var/run/secrets/remote/config
-          # If you explicitly told us where ztunnel lives, use that.
-          # Otherwise, assume it lives in our namespace
-          # Also, check for an explicit ENV override (legacy approach) and prefer that
-          # if present
-          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
-          {{ $ztTrustedName := or .Values.trustedZtunnelName "ztunnel" }}
-          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
-          - name: CA_TRUSTED_NODE_ACCOUNTS
-            value: "{{ $ztTrustedNS }}/{{ $ztTrustedName }}"
-          {{- end }}
-          {{- if .Values.env }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: "{{ $val }}"
-          {{- end }}
-          {{- end }}
-{{- if .Values.traceSampling }}
-          - name: PILOT_TRACE_SAMPLING
-            value: "{{ .Values.traceSampling }}"
-{{- end }}
-# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
-# don't set it here to avoid duplication.
-# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
-{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
-          - name: EXTERNAL_ISTIOD
-            value: "{{ .Values.global.externalIstiod }}"
-{{- end }}
-          - name: PILOT_ENABLE_ANALYSIS
-            value: "{{ .Values.global.istiod.enableAnalysis }}"
-          - name: CLUSTER_ID
-            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
-          - name: GOMEMLIMIT
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.memory
-          - name: GOMAXPROCS
-            valueFrom:
-              resourceFieldRef:
-                resource: limits.cpu
-                divisor: "1"
-          - name: PLATFORM
-            value: "{{ coalesce .Values.global.platform .Values.platform }}"
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            capabilities:
-              drop:
-              - ALL
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          volumeMounts:
-          - name: istio-token
-            mountPath: /var/run/secrets/tokens
-            readOnly: true
-          - name: local-certs
-            mountPath: /var/run/secrets/istio-dns
-          - name: cacerts
-            mountPath: /etc/cacerts
-            readOnly: true
-          - name: istio-kubeconfig
-            mountPath: /var/run/secrets/remote
-            readOnly: true
-          {{- if .Values.jwksResolverExtraRootCA }}
-          - name: extracacerts
-            mountPath: /cacerts
-          {{- end }}
-          - name: istio-csr-dns-cert
-            mountPath: /var/run/secrets/istiod/tls
-            readOnly: true
-          - name: istio-csr-ca-configmap
-            mountPath: /var/run/secrets/istiod/ca
-            readOnly: true
-          {{- with .Values.volumeMounts }}
-            {{- toYaml . | nindent 10 }}
-          {{- end }}
-      volumes:
-      # Technically not needed on this pod - but it helps debugging/testing SDS
-      # Should be removed after everything works.
-      - emptyDir:
-          medium: Memory
-        name: local-certs
-      - name: istio-token
-        projected:
-          sources:
-            - serviceAccountToken:
-                audience: {{ .Values.global.sds.token.aud }}
-                expirationSeconds: 43200
-                path: istio-token
-      # Optional: user-generated root
-      - name: cacerts
-        secret:
-          secretName: cacerts
-          optional: true
-      - name: istio-kubeconfig
-        secret:
-          secretName: istio-kubeconfig
-          optional: true
-      # Optional: istio-csr dns pilot certs
-      - name: istio-csr-dns-cert
-        secret:
-          secretName: istiod-tls
-          optional: true
-      - name: istio-csr-ca-configmap
-        configMap:
-          name: istio-ca-root-cert
-          defaultMode: 420
-          optional: true
-  {{- if .Values.jwksResolverExtraRootCA }}
-      - name: extracacerts
-        configMap:
-          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  {{- end }}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
-
----
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.25.5/charts/istiod/templates/istiod-injector-configmap.yaml
deleted file mode 100644
index 560c284ff..000000000
--- a/resources/v1.25.5/charts/istiod/templates/istiod-injector-configmap.yaml
+++ /dev/null
@@ -1,81 +0,0 @@
-{{- if not .Values.global.omitSidecarInjectorConfigMap }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-data:
-{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
-  values: |-
-{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
-{{ $pilotVals := pick .Values "cni" -}}
-{{ $vals = set $vals "pilot" $pilotVals -}}
-{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
-{{ $vals = set $vals "gateways" $gatewayVals -}}
-{{ $vals | toPrettyJson | indent 4 }}
-
-  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
-  # and istiod webhook functionality.
-  #
-  # New fields should not use Values - it is a 'primary' config object, users should be able
-  # to fine tune it or use it with kube-inject.
-  config: |-
-    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
-    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
-    defaultTemplates:
-{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
-    - {{ . }}
-{{- end }}
-    {{- else }}
-    defaultTemplates: [sidecar]
-    {{- end }}
-    policy: {{ .Values.global.proxy.autoInject }}
-    alwaysInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
-    neverInjectSelector:
-{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
-    injectedAnnotations:
-      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
-      "{{ $key }}": {{ $val | quote }}
-      {{- end }}
-    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
-         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
-         This should make it obvious that their installation is broken.
-     */}}
-    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
-    templates:
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
-      sidecar: |
-{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
-      gateway: |
-{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
-      grpc-simple: |
-{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
-      grpc-agent: |
-{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
-      waypoint: |
-{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
-{{- end }}
-{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
-      kube-gateway: |
-{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
-{{- end }}
-{{- with .Values.sidecarInjectorWebhook.templates }}
-{{ toYaml . | trim | indent 6 }}
-{{- end }}
-
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.25.5/charts/istiod/templates/mutatingwebhook.yaml
deleted file mode 100644
index 22160f70a..000000000
--- a/resources/v1.25.5/charts/istiod/templates/mutatingwebhook.yaml
+++ /dev/null
@@ -1,164 +0,0 @@
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- /* Core defines the common configuration used by all webhook segments */}}
-{{/* Copy just what we need to avoid expensive deepCopy */}}
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "caBundle" .Values.istiodRemote.injectionCABundle
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-    {{- if .caBundle }}
-    caBundle: "{{ .caBundle }}"
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  reinvocationPolicy: "{{ .reinvocationPolicy }}"
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
-{{- if not .Values.global.operatorManageWebhooks }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq .Release.Namespace "istio-system"}}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-{{- else }}
-  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
-
-{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
-{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      {{- if (eq .Values.revision "") }}
-      - "default"
-      {{- else }}
-      - "{{ .Values.revision }}"
-      {{- end }}
-
-
-{{- /* Webhooks for default revision */}}
-{{- if (eq .Values.revision "") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.25.5/charts/istiod/templates/poddisruptionbudget.yaml
deleted file mode 100644
index 1eacf16e6..000000000
--- a/resources/v1.25.5/charts/istiod/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    istio: pilot
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app: istiod
-      {{- if ne .Values.revision "" }}
-      istio.io/rev: {{ .Values.revision | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.25.5/charts/istiod/templates/reader-clusterrole.yaml
deleted file mode 100644
index dbaa80503..000000000
--- a/resources/v1.25.5/charts/istiod/templates/reader-clusterrole.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - "config.istio.io"
-      - "security.istio.io"
-      - "networking.istio.io"
-      - "authentication.istio.io"
-      - "rbac.istio.io"
-      - "telemetry.istio.io"
-      - "extensions.istio.io"
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
-    resources: ["gateways"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: ["get", "list", "watch", "create", "delete"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["apps"]
-    resources: ["replicasets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-{{- if .Values.istiodRemote.enabled }}
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-{{- end}}
diff --git a/resources/v1.25.5/charts/istiod/templates/reader-clusterrolebinding.yaml b/resources/v1.25.5/charts/istiod/templates/reader-clusterrolebinding.yaml
deleted file mode 100644
index aea9f01f7..000000000
--- a/resources/v1.25.5/charts/istiod/templates/reader-clusterrolebinding.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istio-reader-service-account
-    namespace: {{ .Values.global.istioNamespace }}
diff --git a/resources/v1.25.5/charts/istiod/templates/remote-istiod-endpoints.yaml b/resources/v1.25.5/charts/istiod/templates/remote-istiod-endpoints.yaml
deleted file mode 100644
index a6de571da..000000000
--- a/resources/v1.25.5/charts/istiod/templates/remote-istiod-endpoints.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.istiodRemote.enabled }}
-# if the remotePilotAddress is an IP addr
-{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-subsets:
-- addresses:
-  - ip: {{ .Values.global.remotePilotAddress }}
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 15017
-    name: tcp-webhook
-    protocol: TCP
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.25.5/charts/istiod/templates/remote-istiod-service.yaml
deleted file mode 100644
index d3f872f74..000000000
--- a/resources/v1.25.5/charts/istiod/templates/remote-istiod-service.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# This file is only used for remote `istiod` installs.
-{{- if .Values.global.remotePilotAddress }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-  - port: 15012
-    name: tcp-istiod
-    protocol: TCP
-  - port: 443
-    targetPort: 15017
-    name: tcp-webhook
-    protocol: TCP
-  {{- if and .Values.global.remotePilotAddress (not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress)) }}
-  # if the remotePilotAddress is not an IP addr, we use ExternalName
-  type: ExternalName
-  externalName: {{ .Values.global.remotePilotAddress }}
-  {{- end }}
-{{- if .Values.global.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
-{{- end }}
-{{- if .Values.global.ipFamilies }}
-  ipFamilies:
-{{- range .Values.global.ipFamilies }}
-  - {{ . }}
-{{- end }}
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/revision-tags.yaml b/resources/v1.25.5/charts/istiod/templates/revision-tags.yaml
deleted file mode 100644
index 607358aa0..000000000
--- a/resources/v1.25.5/charts/istiod/templates/revision-tags.yaml
+++ /dev/null
@@ -1,147 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/role.yaml b/resources/v1.25.5/charts/istiod/templates/role.yaml
deleted file mode 100644
index 10d89e8d1..000000000
--- a/resources/v1.25.5/charts/istiod/templates/role.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-# permissions to verify the webhook is ready and rejecting
-# invalid config. We use --server-dry-run so no config is persisted.
-- apiGroups: ["networking.istio.io"]
-  verbs: ["create"]
-  resources: ["gateways"]
-
-# For storing CA secret
-- apiGroups: [""]
-  resources: ["secrets"]
-  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
-  verbs: ["create", "get", "watch", "list", "update", "delete"]
-
-# For status controller, so it can delete the distribution report configmap
-- apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["delete"]
-
-# For gateway deployment controller
-- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
-  verbs: ["get", "update", "patch", "create"]
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/rolebinding.yaml b/resources/v1.25.5/charts/istiod/templates/rolebinding.yaml
deleted file mode 100644
index a42f4ec44..000000000
--- a/resources/v1.25.5/charts/istiod/templates/rolebinding.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
-subjects:
-  - kind: ServiceAccount
-    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-    namespace: {{ .Values.global.istioNamespace }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/service.yaml b/resources/v1.25.5/charts/istiod/templates/service.yaml
deleted file mode 100644
index 30d5b8912..000000000
--- a/resources/v1.25.5/charts/istiod/templates/service.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
-# Not created if istiod is running remotely
-{{- if not .Values.istiodRemote.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  {{- if .Values.serviceAnnotations }}
-  annotations:
-{{ toYaml .Values.serviceAnnotations | indent 4 }}
-  {{- end }}
-  labels:
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: istiod
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  ports:
-    - port: 15010
-      name: grpc-xds # plaintext
-      protocol: TCP
-    - port: 15012
-      name: https-dns # mTLS with k8s-signed cert
-      protocol: TCP
-    - port: 443
-      name: https-webhook # validation and injection
-      targetPort: 15017
-      protocol: TCP
-    - port: 15014
-      name: http-monitoring # prometheus stats
-      protocol: TCP
-  selector:
-    app: istiod
-    {{- if ne .Values.revision "" }}
-    istio.io/rev: {{ .Values.revision | quote }}
-    {{- else }}
-    # Label used by the 'default' service. For versioned deployments we match with app and version.
-    # This avoids default deployment picking the canary
-    istio: pilot
-    {{- end }}
-  {{- if .Values.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ .Values.ipFamilyPolicy }}
-  {{- end }}
-  {{- if .Values.ipFamilies }}
-  ipFamilies:
-  {{- range .Values.ipFamilies }}
-  - {{ . }}
-  {{- end }}
-  {{- end }}
----
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/serviceaccount.yaml b/resources/v1.25.5/charts/istiod/templates/serviceaccount.yaml
deleted file mode 100644
index a673a4d07..000000000
--- a/resources/v1.25.5/charts/istiod/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-  {{- if .Values.serviceAccountAnnotations }}
-  annotations:
-{{- toYaml .Values.serviceAccountAnnotations | nindent 4 }}
-  {{- end }}
-{{- end }}
----
diff --git a/resources/v1.25.5/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.25.5/charts/istiod/templates/validatingadmissionpolicy.yaml
deleted file mode 100644
index d36eef68e..000000000
--- a/resources/v1.25.5/charts/istiod/templates/validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.experimental.stableValidationPolicy }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  labels:
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-policy-binding{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-spec:
-  policyName: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
-  validationActions: [Deny]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.25.5/charts/istiod/templates/validatingwebhookconfiguration.yaml
deleted file mode 100644
index fb28836a0..000000000
--- a/resources/v1.25.5/charts/istiod/templates/validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,68 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
-{{- if .Values.global.configValidation }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  # Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
-  # are rejecting invalid configs on a per-revision basis.
-  - name: rev.validation.istio.io
-    clientConfig:
-      # Should change from base but cannot for API compat
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-    objectSelector:
-      matchExpressions:
-        - key: istio.io/rev
-          operator: In
-          values:
-          {{- if (eq .Values.revision "") }}
-          - "default"
-          {{- else }}
-          - "{{ .Values.revision }}"
-          {{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.25.5/charts/istiod/templates/zzy_descope_legacy.yaml b/resources/v1.25.5/charts/istiod/templates/zzy_descope_legacy.yaml
deleted file mode 100644
index ae8fced29..000000000
--- a/resources/v1.25.5/charts/istiod/templates/zzy_descope_legacy.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-{{/* Copy anything under `.pilot` to `.`, to avoid the need to specify a redundant prefix.
-Due to the file naming, this always happens after zzz_profile.yaml */}}
-{{- $_ := mustMergeOverwrite $.Values (index $.Values "pilot") }}
\ No newline at end of file
diff --git a/resources/v1.25.5/charts/istiod/values.yaml b/resources/v1.25.5/charts/istiod/values.yaml
deleted file mode 100644
index d0b1ef9c8..000000000
--- a/resources/v1.25.5/charts/istiod/values.yaml
+++ /dev/null
@@ -1,541 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-  # Set this if you install ztunnel with a name different from the default.
-  trustedZtunnelName: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.25.5
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.25.5/charts/revisiontags/Chart.yaml b/resources/v1.25.5/charts/revisiontags/Chart.yaml
deleted file mode 100644
index 775739c52..000000000
--- a/resources/v1.25.5/charts/revisiontags/Chart.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.5
-description: Helm chart for istio revision tags
-name: revisiontags
-sources:
-- https://github.com/istio-ecosystem/sail-operator
-version: 0.1.0
-
diff --git a/resources/v1.25.5/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.25.5/charts/revisiontags/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.5/charts/revisiontags/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.5/charts/revisiontags/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.5/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.5/charts/revisiontags/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/revisiontags/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.5/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.5/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/revisiontags/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.5/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.5/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/revisiontags/files/profile-platform-gke.yaml b/resources/v1.25.5/charts/revisiontags/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.5/charts/revisiontags/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.5/charts/revisiontags/files/profile-platform-k3d.yaml b/resources/v1.25.5/charts/revisiontags/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.5/charts/revisiontags/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.5/charts/revisiontags/files/profile-platform-microk8s.yaml b/resources/v1.25.5/charts/revisiontags/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.5/charts/revisiontags/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.5/charts/revisiontags/files/profile-platform-minikube.yaml b/resources/v1.25.5/charts/revisiontags/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.5/charts/revisiontags/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.5/charts/revisiontags/files/profile-platform-openshift.yaml b/resources/v1.25.5/charts/revisiontags/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.5/charts/revisiontags/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.5/charts/revisiontags/files/profile-preview.yaml b/resources/v1.25.5/charts/revisiontags/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.5/charts/revisiontags/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.5/charts/revisiontags/files/profile-remote.yaml b/resources/v1.25.5/charts/revisiontags/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.5/charts/revisiontags/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.5/charts/revisiontags/files/profile-stable.yaml b/resources/v1.25.5/charts/revisiontags/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.5/charts/revisiontags/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.5/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.25.5/charts/revisiontags/templates/revision-tags.yaml
deleted file mode 100644
index 607358aa0..000000000
--- a/resources/v1.25.5/charts/revisiontags/templates/revision-tags.yaml
+++ /dev/null
@@ -1,147 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
- "revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
diff --git a/resources/v1.25.5/charts/revisiontags/values.yaml b/resources/v1.25.5/charts/revisiontags/values.yaml
deleted file mode 100644
index d0b1ef9c8..000000000
--- a/resources/v1.25.5/charts/revisiontags/values.yaml
+++ /dev/null
@@ -1,541 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-  # Set this if you install ztunnel with a name different from the default.
-  trustedZtunnelName: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-release
-    # Default tag for Istio images.
-    tag: 1.25.5
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Set to true to connect two kubernetes clusters via their respective
-      # ingressgateway services when pods in each cluster cannot directly
-      # talk to one another. All clusters should be using Istio mTLS and must
-      # have a shared root CA for this model to work.
-      enabled: false
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
diff --git a/resources/v1.25.5/charts/ztunnel/Chart.yaml b/resources/v1.25.5/charts/ztunnel/Chart.yaml
deleted file mode 100644
index 843a46c96..000000000
--- a/resources/v1.25.5/charts/ztunnel/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.25.5
-description: Helm chart for istio ztunnel components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-ztunnel
-- istio
-name: ztunnel
-sources:
-- https://github.com/istio/istio
-version: 1.25.5
diff --git a/resources/v1.25.5/charts/ztunnel/README.md b/resources/v1.25.5/charts/ztunnel/README.md
deleted file mode 100644
index ffe0b94fe..000000000
--- a/resources/v1.25.5/charts/ztunnel/README.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# Istio Ztunnel Helm Chart
-
-This chart installs an Istio ztunnel.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart:
-
-```console
-helm install ztunnel istio/ztunnel
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the chart:
-
-```console
-helm delete ztunnel
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/ztunnel
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.25.5/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.25.5/charts/ztunnel/files/profile-ambient.yaml
deleted file mode 100644
index 2805fe46b..000000000
--- a/resources/v1.25.5/charts/ztunnel/files/profile-ambient.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      ISTIO_META_ENABLE_HBONE: "true"
-global:
-  variant: distroless
-pilot:
-  env:
-    PILOT_ENABLE_AMBIENT: "true"
-cni:
-  ambient:
-    enabled: true
diff --git a/resources/v1.25.5/charts/ztunnel/files/profile-compatibility-version-1.22.yaml b/resources/v1.25.5/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
deleted file mode 100644
index 62420fe5f..000000000
--- a/resources/v1.25.5/charts/ztunnel/files/profile-compatibility-version-1.22.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.23 behavioral changes
-    ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-    
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.22 behavioral changes
-      ENABLE_DEFERRED_CLUSTER_CREATION: "false"
-      # 1.23 behavioral changes
-      ENABLE_DELIMITED_STATS_TAG_REGEX: "false"
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/ztunnel/files/profile-compatibility-version-1.23.yaml b/resources/v1.25.5/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
deleted file mode 100644
index 6b636e607..000000000
--- a/resources/v1.25.5/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    ENABLE_INBOUND_RETRY_POLICY: "false"
-    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
-    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
-    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
-    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
-
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # 1.24 behaviour changes
-      ENABLE_DEFERRED_STATS_CREATION: "false"
-      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
-
-# Not present in <1.24, defaults to `true` in 1.25+
-ambient:
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/ztunnel/files/profile-compatibility-version-1.24.yaml b/resources/v1.25.5/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
deleted file mode 100644
index a2dc35489..000000000
--- a/resources/v1.25.5/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-pilot:
-  env:
-    # 1.24 behavioral changes
-    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
-ambient:
-  dnsCapture: false
-  reconcileIptablesOnStartup: false
diff --git a/resources/v1.25.5/charts/ztunnel/files/profile-platform-gke.yaml b/resources/v1.25.5/charts/ztunnel/files/profile-platform-gke.yaml
deleted file mode 100644
index 521bf1b1e..000000000
--- a/resources/v1.25.5/charts/ztunnel/files/profile-platform-gke.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
diff --git a/resources/v1.25.5/charts/ztunnel/files/profile-platform-k3d.yaml b/resources/v1.25.5/charts/ztunnel/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.25.5/charts/ztunnel/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.25.5/charts/ztunnel/files/profile-platform-microk8s.yaml b/resources/v1.25.5/charts/ztunnel/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.25.5/charts/ztunnel/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.25.5/charts/ztunnel/files/profile-platform-minikube.yaml b/resources/v1.25.5/charts/ztunnel/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.25.5/charts/ztunnel/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.25.5/charts/ztunnel/files/profile-platform-openshift.yaml b/resources/v1.25.5/charts/ztunnel/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.25.5/charts/ztunnel/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.25.5/charts/ztunnel/files/profile-preview.yaml b/resources/v1.25.5/charts/ztunnel/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.25.5/charts/ztunnel/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.25.5/charts/ztunnel/files/profile-remote.yaml b/resources/v1.25.5/charts/ztunnel/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.25.5/charts/ztunnel/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.25.5/charts/ztunnel/files/profile-stable.yaml b/resources/v1.25.5/charts/ztunnel/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.25.5/charts/ztunnel/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.25.5/charts/ztunnel/templates/NOTES.txt b/resources/v1.25.5/charts/ztunnel/templates/NOTES.txt
deleted file mode 100644
index 244f59db0..000000000
--- a/resources/v1.25.5/charts/ztunnel/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-ztunnel successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.25.5/charts/ztunnel/templates/_helpers.tpl b/resources/v1.25.5/charts/ztunnel/templates/_helpers.tpl
deleted file mode 100644
index 82740e441..000000000
--- a/resources/v1.25.5/charts/ztunnel/templates/_helpers.tpl
+++ /dev/null
@@ -1 +0,0 @@
-{{ define "ztunnel.release-name" }}{{ .Values.resourceName| default .Release.Name }}{{ end }}
diff --git a/resources/v1.25.5/charts/ztunnel/templates/daemonset.yaml b/resources/v1.25.5/charts/ztunnel/templates/daemonset.yaml
deleted file mode 100644
index ee5775d70..000000000
--- a/resources/v1.25.5/charts/ztunnel/templates/daemonset.yaml
+++ /dev/null
@@ -1,197 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: {{ include "ztunnel.release-name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-spec:
-  updateStrategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-  selector:
-    matchLabels:
-      app: ztunnel
-  template:
-    metadata:
-      labels:
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app: ztunnel
-        app.kubernetes.io/name: ztunnel
-        {{- include "istio.labels" . | nindent 8}}
-{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-{{- if .Values.revision }}
-        istio.io/rev: {{ .Values.revision }}
-{{- end }}
-{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-{{- if .Values.nodeSelector }}
-{{ toYaml .Values.nodeSelector | indent 8 }}
-{{- end }}
-{{- if .Values.affinity }}
-      affinity:
-{{ toYaml .Values.affinity | trim | indent 8 }}
-{{- end }}
-      serviceAccountName: {{ include "ztunnel.release-name" . }}
-      tolerations:
-        - effect: NoSchedule
-          operator: Exists
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
-      containers:
-      - name: istio-proxy
-{{- if contains "/" .Values.image }}
-        image: "{{ .Values.image }}"
-{{- else }}
-        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
-{{- end }}
-        ports:
-        - containerPort: 15020
-          name: ztunnel-stats
-          protocol: TCP
-        resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 10 }}
-{{- end }}
-{{- with .Values.imagePullPolicy }}
-        imagePullPolicy: {{ . }}
-{{- end }}
-        securityContext:
-          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
-          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
-          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
-          allowPrivilegeEscalation: true
-          privileged: false
-          capabilities:
-            drop:
-            - ALL
-            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
-            - NET_ADMIN # Required for TPROXY and setsockopt
-            - SYS_ADMIN # Required for `setns` - doing things in other netns
-            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
-          readOnlyRootFilesystem: true
-          runAsGroup: 1337
-          runAsNonRoot: false
-          runAsUser: 0
-{{- if .Values.seLinuxOptions }}
-          seLinuxOptions:
-{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
-{{- end }}
-        readinessProbe:
-          httpGet:
-            port: 15021
-            path: /healthz/ready
-        args:
-        - proxy
-        - ztunnel
-        env:
-        - name: CA_ADDRESS
-        {{- if .Values.caAddress }}
-          value: {{ .Values.caAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        - name: XDS_ADDRESS
-        {{- if .Values.xdsAddress }}
-          value: {{ .Values.xdsAddress }}
-        {{- else }}
-          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
-        {{- end }}
-        {{- if .Values.logAsJson }}
-        - name: LOG_FORMAT
-          value: json
-        {{- end}}
-        - name: RUST_LOG
-          value: {{ .Values.logLevel | quote }}
-        - name: RUST_BACKTRACE
-          value: "1"
-        - name: ISTIO_META_CLUSTER_ID
-          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
-        - name: INPOD_ENABLED
-          value: "true"
-        - name: TERMINATION_GRACE_PERIOD_SECONDS
-          value: "{{ .Values.terminationGracePeriodSeconds }}"
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: NODE_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.nodeName
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: SERVICE_ACCOUNT
-          valueFrom:
-            fieldRef:
-              fieldPath: spec.serviceAccountName
-        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
-        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
-        - name: {{ $key }}
-          value: "{{ $value }}"
-        {{- end }}
-        {{- end }}
-        {{- with .Values.env }}
-        {{- range $key, $val := . }}
-        - name: {{ $key }}
-          value: "{{ $val }}"
-        {{- end }}
-        {{- end }}
-        volumeMounts:
-        - mountPath: /var/run/secrets/istio
-          name: istiod-ca-cert
-        - mountPath: /var/run/secrets/tokens
-          name: istio-token
-        - mountPath: /var/run/ztunnel
-          name: cni-ztunnel-sock-dir
-        - mountPath: /tmp
-          name: tmp
-        {{- with .Values.volumeMounts }}
-          {{- toYaml . | nindent 8 }}
-        {{- end }}
-      priorityClassName: system-node-critical
-      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
-      volumes:
-      - name: istio-token
-        projected:
-          sources:
-          - serviceAccountToken:
-              path: istio-token
-              expirationSeconds: 43200
-              audience: istio-ca
-      - name: istiod-ca-cert
-        configMap:
-          name: istio-ca-root-cert
-      - name: cni-ztunnel-sock-dir
-        hostPath:
-          path: /var/run/ztunnel
-          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
-      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
-      - name: tmp
-        emptyDir: {}
-      {{- with .Values.volumes }}
-        {{- toYaml . | nindent 6}}
-      {{- end }}
diff --git a/resources/v1.25.5/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.25.5/charts/ztunnel/templates/zzz_profile.yaml
deleted file mode 100644
index ded66c5fd..000000000
--- a/resources/v1.25.5/charts/ztunnel/templates/zzz_profile.yaml
+++ /dev/null
@@ -1,74 +0,0 @@
-{{/*
-WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
-The original version of this file is located at /manifests directory.
-If you want to make a change in this file, edit the original one and run "make gen".
-
-Complex logic ahead...
-We have three sets of values, in order of precedence (last wins):
-1. The builtin values.yaml defaults
-2. The profile the user selects
-3. Users input (-f or --set)
-
-Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
-
-However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
-We can then merge the profile onto the defaults, then the user settings onto that.
-Finally, we can set all of that under .Values so the chart behaves without awareness.
-*/}}
-{{- if $.Values.defaults}}
-{{ fail (cat
-  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
-  ($.Values.defaults | toYaml |nindent 4)
-) }}
-{{- end }}
-{{- $defaults := $.Values._internal_defaults_do_not_set }}
-{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
-{{- $profile := dict }}
-{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
-{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
-{{- $profile = (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown profile" .) }}
-{{- end }}
-{{- end }}
-{{- with .Values.compatibilityVersion }}
-{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
-{{- end }}
-{{- end }}
-{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
-{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
-{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
-{{- else }}
-{{ fail (cat "unknown platform" .) }}
-{{- end }}
-{{- end }}
-{{- if $profile }}
-{{- $a := mustMergeOverwrite $defaults $profile }}
-{{- end }}
-#  Flatten globals, if defined on a per-chart basis
-{{- if true }}
-{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
-{{- end }}
-{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
-
-{{/*
-Labels that should be applied to ALL resources.
-*/}}
-{{- define "istio.labels" -}}
-{{- if .Release.Service -}}
-app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-{{- end }}
-{{- if .Release.Name }}
-app.kubernetes.io/instance: {{ .Release.Name | quote }}
-{{- end }}
-app.kubernetes.io/part-of: "istio"
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-{{- if and .Chart.Name .Chart.Version }}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end -}}
diff --git a/resources/v1.25.5/charts/ztunnel/values.yaml b/resources/v1.25.5/charts/ztunnel/values.yaml
deleted file mode 100644
index b3a235ef1..000000000
--- a/resources/v1.25.5/charts/ztunnel/values.yaml
+++ /dev/null
@@ -1,102 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
-  hub: gcr.io/istio-release
-  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
-  tag: 1.25.5
-  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
-  variant: ""
-
-  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
-  # If Image contains a "/", it will replace the entire `image` in the pod.
-  image: ztunnel
-
-  # resourceName, if set, will override the naming of resources. If not set, will default to the release name.
-  # It is recommended to not set this; this is primarily for backwards compatibility.
-  resourceName: ""
-
-  # Labels to apply to all top level resources
-  labels: {}
-  # Annotations to apply to all top level resources
-  annotations: {}
-
-  # Additional volumeMounts to the ztunnel container
-  volumeMounts: []
-
-  # Additional volumes to the ztunnel pod
-  volumes: []
-
-  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-
-  # Additional labels to apply on the pod level
-  podLabels: {}
-
-  # Pod resource configuration
-  resources:
-    requests:
-      cpu: 200m
-      # Ztunnel memory scales with the size of the cluster and traffic load
-      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
-      memory: 512Mi
-
-  # List of secret names to add to the service account as image pull secrets
-  imagePullSecrets: []
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
-
-  # Override for the pod imagePullPolicy
-  imagePullPolicy: ""
-
-  # Settings for multicluster
-  multiCluster:
-    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
-    # with Istiod configuration.
-    clusterName: ""
-
-  # meshConfig defines runtime configuration of components.
-  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
-  # components.
-  # TODO: https://github.com/istio/istio/issues/43248
-  meshConfig:
-    defaultConfig:
-      proxyMetadata: {}
-
-  # This value defines:
-  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
-  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
-  # Default K8S value is 30 seconds
-  terminationGracePeriodSeconds: 30
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
-  revision: ""
-
-  # The customized CA address to retrieve certificates for the pods in the cluster.
-  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-  caAddress: ""
-
-  # The customized XDS address to retrieve configuration.
-  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
-  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
-  xdsAddress: ""
-
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
-  istioNamespace: istio-system
-
-  # Configuration log level of ztunnel binary, default is info.
-  # Valid values are: trace, debug, info, warn, error
-  logLevel: info
-
-  # To output all logs in json format
-  logAsJson: false
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seLinuxOptions: {}
-  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
-  #seLinuxOptions:
-  #  type: spc_t
diff --git a/resources/v1.25.5/cni-1.25.5.tgz.etag b/resources/v1.25.5/cni-1.25.5.tgz.etag
deleted file mode 100644
index 02b14cc51..000000000
--- a/resources/v1.25.5/cni-1.25.5.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-ee91957bed46386cd33958521c29ee2b
diff --git a/resources/v1.25.5/commit b/resources/v1.25.5/commit
deleted file mode 100644
index b45fe3106..000000000
--- a/resources/v1.25.5/commit
+++ /dev/null
@@ -1 +0,0 @@
-1.25.5
diff --git a/resources/v1.25.5/gateway-1.25.5.tgz.etag b/resources/v1.25.5/gateway-1.25.5.tgz.etag
deleted file mode 100644
index a78f5161c..000000000
--- a/resources/v1.25.5/gateway-1.25.5.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-6f5e017bf3b68a38683c4329d44b415d
diff --git a/resources/v1.25.5/istiod-1.25.5.tgz.etag b/resources/v1.25.5/istiod-1.25.5.tgz.etag
deleted file mode 100644
index 52c0a5264..000000000
--- a/resources/v1.25.5/istiod-1.25.5.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-3e966e68b09ad72a4e5caa7361eb83fb
diff --git a/resources/v1.25.5/profiles/ambient.yaml b/resources/v1.25.5/profiles/ambient.yaml
deleted file mode 100644
index 71ea784a8..000000000
--- a/resources/v1.25.5/profiles/ambient.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: ambient
diff --git a/resources/v1.25.5/profiles/demo.yaml b/resources/v1.25.5/profiles/demo.yaml
deleted file mode 100644
index 53c4b4163..000000000
--- a/resources/v1.25.5/profiles/demo.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: demo
diff --git a/resources/v1.25.5/profiles/empty.yaml b/resources/v1.25.5/profiles/empty.yaml
deleted file mode 100644
index 4477cb1fe..000000000
--- a/resources/v1.25.5/profiles/empty.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-# The empty profile has everything disabled
-# This is useful as a base for custom user configuration
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec: {}
diff --git a/resources/v1.25.5/profiles/openshift-ambient.yaml b/resources/v1.25.5/profiles/openshift-ambient.yaml
deleted file mode 100644
index 76edf00cd..000000000
--- a/resources/v1.25.5/profiles/openshift-ambient.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: ambient
-    global:
-      platform: openshift
diff --git a/resources/v1.25.5/profiles/openshift.yaml b/resources/v1.25.5/profiles/openshift.yaml
deleted file mode 100644
index 41492660f..000000000
--- a/resources/v1.25.5/profiles/openshift.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    global:
-      platform: openshift
diff --git a/resources/v1.25.5/profiles/preview.yaml b/resources/v1.25.5/profiles/preview.yaml
deleted file mode 100644
index 59d545c84..000000000
--- a/resources/v1.25.5/profiles/preview.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: preview
diff --git a/resources/v1.25.5/profiles/remote.yaml b/resources/v1.25.5/profiles/remote.yaml
deleted file mode 100644
index 54c65c8ba..000000000
--- a/resources/v1.25.5/profiles/remote.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# The remote profile is used to configure a mesh cluster without a locally deployed control plane.
-# Only the injector mutating webhook configuration is installed.
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: remote
diff --git a/resources/v1.25.5/profiles/stable.yaml b/resources/v1.25.5/profiles/stable.yaml
deleted file mode 100644
index 285feba24..000000000
--- a/resources/v1.25.5/profiles/stable.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: stable
diff --git a/resources/v1.25.5/ztunnel-1.25.5.tgz.etag b/resources/v1.25.5/ztunnel-1.25.5.tgz.etag
deleted file mode 100644
index 4abafeff2..000000000
--- a/resources/v1.25.5/ztunnel-1.25.5.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-9fa287945740682b31ad6bb862120427
diff --git a/resources/v1.26.1/base-1.26.1.tgz.etag b/resources/v1.26.1/base-1.26.1.tgz.etag
new file mode 100644
index 000000000..1d1672c16
--- /dev/null
+++ b/resources/v1.26.1/base-1.26.1.tgz.etag
@@ -0,0 +1 @@
+87c2e78844289d11f821b7f480839ecc
diff --git a/resources/v1.26.1/charts/base/Chart.yaml b/resources/v1.26.1/charts/base/Chart.yaml
new file mode 100644
index 000000000..75dcdff34
--- /dev/null
+++ b/resources/v1.26.1/charts/base/Chart.yaml
@@ -0,0 +1,10 @@
+apiVersion: v2
+appVersion: 1.26.1
+description: Helm chart for deploying Istio cluster resources and CRDs
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+name: base
+sources:
+- https://github.com/istio/istio
+version: 1.26.1
diff --git a/resources/v1.24.0/charts/base/README.md b/resources/v1.26.1/charts/base/README.md
similarity index 100%
rename from resources/v1.24.0/charts/base/README.md
rename to resources/v1.26.1/charts/base/README.md
diff --git a/resources/v1.24.0/charts/base/files/profile-ambient.yaml b/resources/v1.26.1/charts/base/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.0/charts/base/files/profile-ambient.yaml
rename to resources/v1.26.1/charts/base/files/profile-ambient.yaml
diff --git a/resources/v1.26.1/charts/base/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.1/charts/base/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.1/charts/base/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.1/charts/base/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.1/charts/base/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.1/charts/base/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.1/charts/base/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.1/charts/base/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.1/charts/base/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.1/charts/base/files/profile-demo.yaml b/resources/v1.26.1/charts/base/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.1/charts/base/files/profile-demo.yaml
rename to resources/v1.26.1/charts/base/files/profile-demo.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-gke.yaml b/resources/v1.26.1/charts/base/files/profile-platform-gke.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-gke.yaml
rename to resources/v1.26.1/charts/base/files/profile-platform-gke.yaml
diff --git a/resources/v1.24.0/charts/base/files/profile-platform-k3d.yaml b/resources/v1.26.1/charts/base/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.0/charts/base/files/profile-platform-k3d.yaml
rename to resources/v1.26.1/charts/base/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.1/charts/base/files/profile-platform-k3s.yaml b/resources/v1.26.1/charts/base/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.1/charts/base/files/profile-platform-k3s.yaml
rename to resources/v1.26.1/charts/base/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.0/charts/base/files/profile-platform-microk8s.yaml b/resources/v1.26.1/charts/base/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.0/charts/base/files/profile-platform-microk8s.yaml
rename to resources/v1.26.1/charts/base/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.0/charts/base/files/profile-platform-minikube.yaml b/resources/v1.26.1/charts/base/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.0/charts/base/files/profile-platform-minikube.yaml
rename to resources/v1.26.1/charts/base/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.0/charts/base/files/profile-platform-openshift.yaml b/resources/v1.26.1/charts/base/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.0/charts/base/files/profile-platform-openshift.yaml
rename to resources/v1.26.1/charts/base/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.0/charts/base/files/profile-preview.yaml b/resources/v1.26.1/charts/base/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.0/charts/base/files/profile-preview.yaml
rename to resources/v1.26.1/charts/base/files/profile-preview.yaml
diff --git a/resources/v1.24.0/charts/base/files/profile-remote.yaml b/resources/v1.26.1/charts/base/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.0/charts/base/files/profile-remote.yaml
rename to resources/v1.26.1/charts/base/files/profile-remote.yaml
diff --git a/resources/v1.24.0/charts/base/files/profile-stable.yaml b/resources/v1.26.1/charts/base/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.0/charts/base/files/profile-stable.yaml
rename to resources/v1.26.1/charts/base/files/profile-stable.yaml
diff --git a/resources/v1.24.0/charts/base/templates/NOTES.txt b/resources/v1.26.1/charts/base/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.0/charts/base/templates/NOTES.txt
rename to resources/v1.26.1/charts/base/templates/NOTES.txt
diff --git a/resources/v1.24.0/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml b/resources/v1.26.1/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
similarity index 100%
rename from resources/v1.24.0/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
rename to resources/v1.26.1/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
diff --git a/resources/v1.24.0/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml b/resources/v1.26.1/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
similarity index 100%
rename from resources/v1.24.0/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
rename to resources/v1.26.1/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
diff --git a/resources/v1.24.0/charts/base/templates/reader-serviceaccount.yaml b/resources/v1.26.1/charts/base/templates/reader-serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.0/charts/base/templates/reader-serviceaccount.yaml
rename to resources/v1.26.1/charts/base/templates/reader-serviceaccount.yaml
diff --git a/resources/v1.25.1/charts/istiod/templates/zzz_profile.yaml b/resources/v1.26.1/charts/base/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.25.1/charts/istiod/templates/zzz_profile.yaml
rename to resources/v1.26.1/charts/base/templates/zzz_profile.yaml
diff --git a/resources/v1.25.1/charts/base/values.yaml b/resources/v1.26.1/charts/base/values.yaml
similarity index 100%
rename from resources/v1.25.1/charts/base/values.yaml
rename to resources/v1.26.1/charts/base/values.yaml
diff --git a/resources/v1.26.1/charts/cni/Chart.yaml b/resources/v1.26.1/charts/cni/Chart.yaml
new file mode 100644
index 000000000..66570c3c1
--- /dev/null
+++ b/resources/v1.26.1/charts/cni/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+appVersion: 1.26.1
+description: Helm chart for istio-cni components
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio-cni
+- istio
+name: cni
+sources:
+- https://github.com/istio/istio
+version: 1.26.1
diff --git a/resources/v1.24.0/charts/cni/README.md b/resources/v1.26.1/charts/cni/README.md
similarity index 100%
rename from resources/v1.24.0/charts/cni/README.md
rename to resources/v1.26.1/charts/cni/README.md
diff --git a/resources/v1.24.0/charts/cni/files/profile-ambient.yaml b/resources/v1.26.1/charts/cni/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.0/charts/cni/files/profile-ambient.yaml
rename to resources/v1.26.1/charts/cni/files/profile-ambient.yaml
diff --git a/resources/v1.26.1/charts/cni/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.1/charts/cni/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.1/charts/cni/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.1/charts/cni/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.1/charts/cni/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.1/charts/cni/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.1/charts/cni/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.1/charts/cni/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.1/charts/cni/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.1/charts/cni/files/profile-demo.yaml b/resources/v1.26.1/charts/cni/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.1/charts/cni/files/profile-demo.yaml
rename to resources/v1.26.1/charts/cni/files/profile-demo.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-gke.yaml b/resources/v1.26.1/charts/cni/files/profile-platform-gke.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-gke.yaml
rename to resources/v1.26.1/charts/cni/files/profile-platform-gke.yaml
diff --git a/resources/v1.24.0/charts/cni/files/profile-platform-k3d.yaml b/resources/v1.26.1/charts/cni/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.0/charts/cni/files/profile-platform-k3d.yaml
rename to resources/v1.26.1/charts/cni/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.1/charts/cni/files/profile-platform-k3s.yaml b/resources/v1.26.1/charts/cni/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.1/charts/cni/files/profile-platform-k3s.yaml
rename to resources/v1.26.1/charts/cni/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.0/charts/cni/files/profile-platform-microk8s.yaml b/resources/v1.26.1/charts/cni/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.0/charts/cni/files/profile-platform-microk8s.yaml
rename to resources/v1.26.1/charts/cni/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.0/charts/cni/files/profile-platform-minikube.yaml b/resources/v1.26.1/charts/cni/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.0/charts/cni/files/profile-platform-minikube.yaml
rename to resources/v1.26.1/charts/cni/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.0/charts/cni/files/profile-platform-openshift.yaml b/resources/v1.26.1/charts/cni/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.0/charts/cni/files/profile-platform-openshift.yaml
rename to resources/v1.26.1/charts/cni/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.0/charts/cni/files/profile-preview.yaml b/resources/v1.26.1/charts/cni/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.0/charts/cni/files/profile-preview.yaml
rename to resources/v1.26.1/charts/cni/files/profile-preview.yaml
diff --git a/resources/v1.24.0/charts/cni/files/profile-remote.yaml b/resources/v1.26.1/charts/cni/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.0/charts/cni/files/profile-remote.yaml
rename to resources/v1.26.1/charts/cni/files/profile-remote.yaml
diff --git a/resources/v1.24.0/charts/cni/files/profile-stable.yaml b/resources/v1.26.1/charts/cni/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.0/charts/cni/files/profile-stable.yaml
rename to resources/v1.26.1/charts/cni/files/profile-stable.yaml
diff --git a/resources/v1.24.0/charts/cni/templates/NOTES.txt b/resources/v1.26.1/charts/cni/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.0/charts/cni/templates/NOTES.txt
rename to resources/v1.26.1/charts/cni/templates/NOTES.txt
diff --git a/resources/v1.24.0/charts/cni/templates/_helpers.tpl b/resources/v1.26.1/charts/cni/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.0/charts/cni/templates/_helpers.tpl
rename to resources/v1.26.1/charts/cni/templates/_helpers.tpl
diff --git a/resources/v1.25.1/charts/cni/templates/clusterrole.yaml b/resources/v1.26.1/charts/cni/templates/clusterrole.yaml
similarity index 100%
rename from resources/v1.25.1/charts/cni/templates/clusterrole.yaml
rename to resources/v1.26.1/charts/cni/templates/clusterrole.yaml
diff --git a/resources/v1.24.0/charts/cni/templates/clusterrolebinding.yaml b/resources/v1.26.1/charts/cni/templates/clusterrolebinding.yaml
similarity index 100%
rename from resources/v1.24.0/charts/cni/templates/clusterrolebinding.yaml
rename to resources/v1.26.1/charts/cni/templates/clusterrolebinding.yaml
diff --git a/resources/v1.25.2/charts/cni/templates/configmap-cni.yaml b/resources/v1.26.1/charts/cni/templates/configmap-cni.yaml
similarity index 100%
rename from resources/v1.25.2/charts/cni/templates/configmap-cni.yaml
rename to resources/v1.26.1/charts/cni/templates/configmap-cni.yaml
diff --git a/resources/v1.26.1/charts/cni/templates/daemonset.yaml b/resources/v1.26.1/charts/cni/templates/daemonset.yaml
new file mode 100644
index 000000000..cdccd3654
--- /dev/null
+++ b/resources/v1.26.1/charts/cni/templates/daemonset.yaml
@@ -0,0 +1,245 @@
+# This manifest installs the Istio install-cni container, as well
+# as the Istio CNI plugin and config on
+# each master and worker node in a Kubernetes cluster.
+#
+# $detectedBinDir exists to support a GKE-specific platform override,
+# and is deprecated in favor of using the explicit `gke` platform profile.
+{{- $detectedBinDir := (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
+    "/home/kubernetes/bin"
+    "/opt/cni/bin"
+}}
+{{- if .Values.cniBinDir }}
+{{ $detectedBinDir = .Values.cniBinDir }}
+{{- end }}
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  # Note that this is templated but evaluates to a fixed name
+  # which the CNI plugin may fall back onto in some failsafe scenarios.
+  # if this name is changed, CNI plugin logic that checks for this name
+  # format should also be updated.
+  name: {{ template "name" . }}-node
+  namespace: {{ .Release.Namespace }}
+  labels:
+    k8s-app: {{ template "name" . }}-node
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      k8s-app: {{ template "name" . }}-node
+  {{- with .Values.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  template:
+    metadata:
+      labels:
+        k8s-app: {{ template "name" . }}-node
+        sidecar.istio.io/inject: "false"
+        istio.io/dataplane-mode: none
+        app.kubernetes.io/name: {{ template "name" . }}
+        {{- include "istio.labels" . | nindent 8 }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+        # Add Prometheus Scrape annotations
+        prometheus.io/scrape: 'true'
+        prometheus.io/port: "15014"
+        prometheus.io/path: '/metrics'
+        # Add AppArmor annotation
+        # This is required to avoid conflicts with AppArmor profiles which block certain
+        # privileged pod capabilities.
+        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
+        # securityContext which is otherwise preferred.
+        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
+        # Custom annotations
+        {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+        {{- end }}
+    spec:
+{{- if and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace }}
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+{{- end }}
+      nodeSelector:
+        kubernetes.io/os: linux
+      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      tolerations:
+        # Make sure istio-cni-node gets scheduled on all nodes.
+        - effect: NoSchedule
+          operator: Exists
+        # Mark the pod as a critical add-on for rescheduling.
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - effect: NoExecute
+          operator: Exists
+      priorityClassName: system-node-critical
+      serviceAccountName: {{ template "name" . }}
+      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
+      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
+      terminationGracePeriodSeconds: 5
+      containers:
+        # This container installs the Istio CNI binaries
+        # and CNI network config file on each node.
+        - name: install-cni
+{{- if contains "/" .Values.image }}
+          image: "{{ .Values.image }}"
+{{- else }}
+          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
+{{- end }}
+{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
+          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
+{{- end }}
+          ports:
+          - containerPort: 15014
+            name: metrics
+            protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8000
+          securityContext:
+            privileged: false
+            runAsGroup: 0
+            runAsUser: 0
+            runAsNonRoot: false
+            # Both ambient and sidecar repair mode require elevated node privileges to function.
+            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
+            # add capabilities based on feature.
+            capabilities:
+              drop:
+              - ALL
+              add:
+              # CAP_NET_ADMIN is required to allow ipset and route table access
+              - NET_ADMIN
+              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
+              - NET_RAW
+              # CAP_SYS_PTRACE is required for repair and ambient mode to describe
+              # the pod's network namespace.
+              - SYS_PTRACE
+              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
+              # network namespaces in `/proc` to obtain descriptors for entering pod network
+              # namespaces. There does not appear to be a more granular capability for this.
+              - SYS_ADMIN
+              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
+              # the typical ability to read/write to folders owned by others.
+              # This can cause problems if the hostPath mounts we use, which we require write access into,
+              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
+              - DAC_OVERRIDE
+{{- if .Values.seLinuxOptions }}
+{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
+            seLinuxOptions:
+{{ toYaml . | trim | indent 14 }}
+{{- end }}
+{{- end }}
+{{- if .Values.seccompProfile }}
+            seccompProfile:
+{{ toYaml .Values.seccompProfile | trim | indent 14 }}
+{{- end }}
+          command: ["install-cni"]
+          args:
+            {{- if or .Values.logging.level .Values.global.logging.level }}
+            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
+            {{- end}}
+            {{- if .Values.global.logAsJson }}
+            - --log_as_json
+            {{- end}}
+          envFrom:
+            - configMapRef:
+                name: {{ template "name" . }}-config
+          env:
+            - name: REPAIR_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: REPAIR_RUN_AS_DAEMON
+              value: "true"
+            - name: REPAIR_SIDECAR_ANNOTATION
+              value: "sidecar.istio.io/status"
+            {{- if not (and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace) }}
+            - name: ALLOW_SWITCH_TO_HOST_NS
+              value: "true"
+            {{- end }}
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+            - name: GOMEMLIMIT
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.memory
+            - name: GOMAXPROCS
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.cpu
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+          volumeMounts:
+            - mountPath: /host/opt/cni/bin
+              name: cni-bin-dir
+            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
+            - mountPath: /host/proc
+              name: cni-host-procfs
+              readOnly: true
+            {{- end }}
+            - mountPath: /host/etc/cni/net.d
+              name: cni-net-dir
+            - mountPath: /var/run/istio-cni
+              name: cni-socket-dir
+            {{- if .Values.ambient.enabled }}
+            - mountPath: /host/var/run/netns
+              mountPropagation: HostToContainer
+              name: cni-netns-dir
+            - mountPath: /var/run/ztunnel
+              name: cni-ztunnel-sock-dir
+            {{ end }}
+          resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 12 }}
+{{- else }}
+{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
+{{- end }}
+      volumes:
+        # Used to install CNI.
+        - name: cni-bin-dir
+          hostPath:
+            path: {{ $detectedBinDir }}
+        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
+        - name: cni-host-procfs
+          hostPath:
+            path: /proc
+            type: Directory
+        {{- end }}
+        {{- if .Values.ambient.enabled }}
+        - name: cni-ztunnel-sock-dir
+          hostPath:
+            path: /var/run/ztunnel
+            type: DirectoryOrCreate
+        {{- end }}
+        - name: cni-net-dir
+          hostPath:
+            path: {{ .Values.cniConfDir }}
+        # Used for UDS sockets for logging, ambient eventing
+        - name: cni-socket-dir
+          hostPath:
+            path: /var/run/istio-cni
+        - name: cni-netns-dir
+          hostPath:
+            path: {{ .Values.cniNetnsDir }}
+            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
+            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
+            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.24.0/charts/cni/templates/network-attachment-definition.yaml b/resources/v1.26.1/charts/cni/templates/network-attachment-definition.yaml
similarity index 100%
rename from resources/v1.24.0/charts/cni/templates/network-attachment-definition.yaml
rename to resources/v1.26.1/charts/cni/templates/network-attachment-definition.yaml
diff --git a/resources/v1.24.0/charts/cni/templates/resourcequota.yaml b/resources/v1.26.1/charts/cni/templates/resourcequota.yaml
similarity index 100%
rename from resources/v1.24.0/charts/cni/templates/resourcequota.yaml
rename to resources/v1.26.1/charts/cni/templates/resourcequota.yaml
diff --git a/resources/v1.24.0/charts/cni/templates/serviceaccount.yaml b/resources/v1.26.1/charts/cni/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.0/charts/cni/templates/serviceaccount.yaml
rename to resources/v1.26.1/charts/cni/templates/serviceaccount.yaml
diff --git a/resources/v1.24.0/charts/cni/templates/zzy_descope_legacy.yaml b/resources/v1.26.1/charts/cni/templates/zzy_descope_legacy.yaml
similarity index 100%
rename from resources/v1.24.0/charts/cni/templates/zzy_descope_legacy.yaml
rename to resources/v1.26.1/charts/cni/templates/zzy_descope_legacy.yaml
diff --git a/resources/v1.25.1/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.26.1/charts/cni/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.25.1/charts/revisiontags/templates/zzz_profile.yaml
rename to resources/v1.26.1/charts/cni/templates/zzz_profile.yaml
diff --git a/resources/v1.26.1/charts/cni/values.yaml b/resources/v1.26.1/charts/cni/values.yaml
new file mode 100644
index 000000000..995440123
--- /dev/null
+++ b/resources/v1.26.1/charts/cni/values.yaml
@@ -0,0 +1,152 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  hub: ""
+  tag: ""
+  variant: ""
+  image: install-cni
+  pullPolicy: ""
+
+  # Same as `global.logging.level`, but will override it if set
+  logging:
+    level: ""
+
+  # Configuration file to insert istio-cni plugin configuration
+  # by default this will be the first file found in the cni-conf-dir
+  # Example
+  # cniConfFileName: 10-calico.conflist
+
+  # CNI-and-platform specific path defaults.
+  # These may need to be set to platform-specific values, consult
+  # overrides for your platform in `manifests/helm-profiles/platform-*.yaml`
+  cniBinDir: /opt/cni/bin
+  cniConfDir: /etc/cni/net.d
+  cniConfFileName: ""
+  cniNetnsDir: "/var/run/netns"
+
+  excludeNamespaces:
+    - kube-system
+
+  # Allows user to set custom affinity for the DaemonSet
+  affinity: {}
+
+  # Custom annotations on pod level, if you need them
+  podAnnotations: {}
+
+  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
+  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
+  chained: true
+
+  # Custom configuration happens based on the CNI provider.
+  # Possible values: "default", "multus"
+  provider: "default"
+
+  # Configure ambient settings
+  ambient:
+    # If enabled, ambient redirection will be enabled
+    enabled: false
+    # Set ambient config dir path: defaults to /etc/ambient-config
+    configDir: ""
+    # If enabled, and ambient is enabled, DNS redirection will be enabled
+    dnsCapture: true
+    # If enabled, and ambient is enabled, enables ipv6 support
+    ipv6: true
+    # If enabled, and ambient is enabled, the CNI agent will reconcile incompatible iptables rules and chains at startup.
+    # This will eventually be enabled by default
+    reconcileIptablesOnStartup: false
+    # If enabled, and ambient is enabled, the CNI agent will always share the network namespace of the host node it is running on
+    shareHostNetworkNamespace: false
+
+
+  repair:
+    enabled: true
+    hub: ""
+    tag: ""
+
+    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
+    # This defines the action the controller will take when a pod is detected as broken.
+
+    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
+    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
+    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
+    labelPods: false
+    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
+    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
+    deletePods: false
+    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
+    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
+    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
+    repairPods: true
+
+    initContainerName: "istio-validation"
+
+    brokenPodLabelKey: "cni.istio.io/uninitialized"
+    brokenPodLabelValue: "true"
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
+  seLinuxOptions: {}
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 100Mi
+
+  resourceQuotas:
+    enabled: false
+    pods: 5000
+
+  # K8s DaemonSet update strategy.
+  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  global:
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+
+    # Default tag for Istio images.
+    tag: 1.26.1
+
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # change cni scope level to control logging out of istio-cni-node DaemonSet
+    logging:
+      level: info
+
+    logAsJson: false
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Default resources allocated
+    defaultResources:
+      requests:
+        cpu: 100m
+        memory: 100Mi
+
+  # A `key: value` mapping of environment variables to add to the pod
+  env: {}
diff --git a/resources/v1.26.1/charts/gateway/Chart.yaml b/resources/v1.26.1/charts/gateway/Chart.yaml
new file mode 100644
index 000000000..23b199769
--- /dev/null
+++ b/resources/v1.26.1/charts/gateway/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+appVersion: 1.26.1
+description: Helm chart for deploying Istio gateways
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+- gateways
+name: gateway
+sources:
+- https://github.com/istio/istio
+type: application
+version: 1.26.1
diff --git a/resources/v1.24.0/charts/gateway/README.md b/resources/v1.26.1/charts/gateway/README.md
similarity index 100%
rename from resources/v1.24.0/charts/gateway/README.md
rename to resources/v1.26.1/charts/gateway/README.md
diff --git a/resources/v1.24.0/charts/gateway/files/profile-ambient.yaml b/resources/v1.26.1/charts/gateway/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.0/charts/gateway/files/profile-ambient.yaml
rename to resources/v1.26.1/charts/gateway/files/profile-ambient.yaml
diff --git a/resources/v1.26.1/charts/gateway/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.1/charts/gateway/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.1/charts/gateway/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.1/charts/gateway/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.1/charts/gateway/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.1/charts/gateway/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.1/charts/gateway/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.1/charts/gateway/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.1/charts/gateway/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.1/charts/gateway/files/profile-demo.yaml b/resources/v1.26.1/charts/gateway/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.1/charts/gateway/files/profile-demo.yaml
rename to resources/v1.26.1/charts/gateway/files/profile-demo.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-gke.yaml b/resources/v1.26.1/charts/gateway/files/profile-platform-gke.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-gke.yaml
rename to resources/v1.26.1/charts/gateway/files/profile-platform-gke.yaml
diff --git a/resources/v1.24.0/charts/gateway/files/profile-platform-k3d.yaml b/resources/v1.26.1/charts/gateway/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.0/charts/gateway/files/profile-platform-k3d.yaml
rename to resources/v1.26.1/charts/gateway/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.1/charts/gateway/files/profile-platform-k3s.yaml b/resources/v1.26.1/charts/gateway/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.1/charts/gateway/files/profile-platform-k3s.yaml
rename to resources/v1.26.1/charts/gateway/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.0/charts/gateway/files/profile-platform-microk8s.yaml b/resources/v1.26.1/charts/gateway/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.0/charts/gateway/files/profile-platform-microk8s.yaml
rename to resources/v1.26.1/charts/gateway/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.0/charts/gateway/files/profile-platform-minikube.yaml b/resources/v1.26.1/charts/gateway/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.0/charts/gateway/files/profile-platform-minikube.yaml
rename to resources/v1.26.1/charts/gateway/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.0/charts/gateway/files/profile-platform-openshift.yaml b/resources/v1.26.1/charts/gateway/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.0/charts/gateway/files/profile-platform-openshift.yaml
rename to resources/v1.26.1/charts/gateway/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.0/charts/gateway/files/profile-preview.yaml b/resources/v1.26.1/charts/gateway/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.0/charts/gateway/files/profile-preview.yaml
rename to resources/v1.26.1/charts/gateway/files/profile-preview.yaml
diff --git a/resources/v1.24.0/charts/gateway/files/profile-remote.yaml b/resources/v1.26.1/charts/gateway/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.0/charts/gateway/files/profile-remote.yaml
rename to resources/v1.26.1/charts/gateway/files/profile-remote.yaml
diff --git a/resources/v1.24.0/charts/gateway/files/profile-stable.yaml b/resources/v1.26.1/charts/gateway/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.0/charts/gateway/files/profile-stable.yaml
rename to resources/v1.26.1/charts/gateway/files/profile-stable.yaml
diff --git a/resources/v1.24.0/charts/gateway/templates/NOTES.txt b/resources/v1.26.1/charts/gateway/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.0/charts/gateway/templates/NOTES.txt
rename to resources/v1.26.1/charts/gateway/templates/NOTES.txt
diff --git a/resources/v1.24.0/charts/gateway/templates/_helpers.tpl b/resources/v1.26.1/charts/gateway/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.0/charts/gateway/templates/_helpers.tpl
rename to resources/v1.26.1/charts/gateway/templates/_helpers.tpl
diff --git a/resources/v1.26.1/charts/gateway/templates/deployment.yaml b/resources/v1.26.1/charts/gateway/templates/deployment.yaml
new file mode 100644
index 000000000..d83ff3b49
--- /dev/null
+++ b/resources/v1.26.1/charts/gateway/templates/deployment.yaml
@@ -0,0 +1,131 @@
+apiVersion: apps/v1
+kind: {{ .Values.kind | default "Deployment" }}
+metadata:
+  name: {{ include "gateway.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "gateway.name" . }}
+    {{- include "istio.labels" . | nindent 4}}
+    {{- include "gateway.labels" . | nindent 4}}
+  annotations:
+    {{- .Values.annotations | toYaml | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  {{- if and (hasKey .Values "replicaCount") (ne .Values.replicaCount nil) }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  {{- end }}
+  {{- with .Values.strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.minReadySeconds }}
+  minReadySeconds: {{ . }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "gateway.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
+        {{- include "gateway.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/name: {{ include "gateway.name" . }}
+        {{- include "istio.labels" .  | nindent 8}}
+        {{- range $key, $val := .Values.labels }}
+        {{- if and (ne $key "app") (ne $key "istio") }}
+        {{ $key | quote }}: {{ $val | quote }}
+        {{- end }}
+        {{- end }}
+        {{- with .Values.networkGateway }}
+        topology.istio.io/network: "{{.}}"
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
+      securityContext:
+      {{- if .Values.securityContext }}
+        {{- toYaml .Values.securityContext | nindent 8 }}
+      {{- else }}
+        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
+        sysctls:
+        - name: net.ipv4.ip_unprivileged_port_start
+          value: "0"
+      {{- end }}
+      {{- with .Values.volumes }}
+      volumes:
+        {{ toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: istio-proxy
+          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
+          image: auto
+          {{- with .Values.imagePullPolicy }}
+          imagePullPolicy: {{ . }}
+          {{- end }}
+          securityContext:
+          {{- if .Values.containerSecurityContext }}
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          {{- else }}
+            capabilities:
+              drop:
+              - ALL
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: true
+            {{- if not (eq (.Values.platform | default "") "openshift") }}
+            runAsUser: 1337
+            runAsGroup: 1337
+            {{- end }}
+            runAsNonRoot: true
+          {{- end }}
+          env:
+          {{- with .Values.networkGateway }}
+          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
+            value: "{{.}}"
+          {{- end }}
+          {{- range $key, $val := .Values.env }}
+          - name: {{ $key }}
+            value: {{ $val | quote }}
+          {{- end }}
+          ports:
+          - containerPort: 15090
+            protocol: TCP
+            name: http-envoy-prom
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          {{- with .Values.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
+      {{- with .Values.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
diff --git a/resources/v1.24.0/charts/gateway/templates/hpa.yaml b/resources/v1.26.1/charts/gateway/templates/hpa.yaml
similarity index 100%
rename from resources/v1.24.0/charts/gateway/templates/hpa.yaml
rename to resources/v1.26.1/charts/gateway/templates/hpa.yaml
diff --git a/resources/v1.24.0/charts/gateway/templates/poddisruptionbudget.yaml b/resources/v1.26.1/charts/gateway/templates/poddisruptionbudget.yaml
similarity index 100%
rename from resources/v1.24.0/charts/gateway/templates/poddisruptionbudget.yaml
rename to resources/v1.26.1/charts/gateway/templates/poddisruptionbudget.yaml
diff --git a/resources/v1.24.0/charts/gateway/templates/role.yaml b/resources/v1.26.1/charts/gateway/templates/role.yaml
similarity index 100%
rename from resources/v1.24.0/charts/gateway/templates/role.yaml
rename to resources/v1.26.1/charts/gateway/templates/role.yaml
diff --git a/resources/v1.26.1/charts/gateway/templates/service.yaml b/resources/v1.26.1/charts/gateway/templates/service.yaml
new file mode 100644
index 000000000..3e28418f7
--- /dev/null
+++ b/resources/v1.26.1/charts/gateway/templates/service.yaml
@@ -0,0 +1,69 @@
+{{- if not (eq .Values.service.type "None") }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "gateway.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "gateway.name" . }}
+    {{- include "istio.labels" . | nindent 4}}
+    {{- include "gateway.labels" . | nindent 4 }}
+    {{- with .Values.networkGateway }}
+    topology.istio.io/network: "{{.}}"
+    {{- end }}
+  annotations:
+    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
+spec:
+{{- with .Values.service.loadBalancerIP }}
+  loadBalancerIP: "{{ . }}"
+{{- end }}
+{{- if eq .Values.service.type "LoadBalancer" }}
+  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
+  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
+  {{- end }}
+  {{- if hasKey .Values.service "loadBalancerClass" }}
+  loadBalancerClass: {{ .Values.service.loadBalancerClass }}
+  {{- end }}
+{{- end }}
+{{- if .Values.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
+{{- end }}
+{{- if .Values.service.ipFamilies }}
+  ipFamilies:
+{{- range .Values.service.ipFamilies }}
+  - {{ . }}
+{{- end }}
+{{- end }}
+{{- with .Values.service.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+{{ toYaml . | indent 4 }}
+{{- end }}
+{{- with .Values.service.externalTrafficPolicy }}
+  externalTrafficPolicy: "{{ . }}"
+{{- end }}
+  type: {{ .Values.service.type }}
+  ports:
+{{- if .Values.networkGateway }}
+  - name: status-port
+    port: 15021
+    targetPort: 15021
+  - name: tls
+    port: 15443
+    targetPort: 15443
+  - name: tls-istiod
+    port: 15012
+    targetPort: 15012
+  - name: tls-webhook
+    port: 15017
+    targetPort: 15017
+{{- else }}
+{{ .Values.service.ports | toYaml | indent 4 }}
+{{- end }}
+{{- if .Values.service.externalIPs }}
+  externalIPs: {{- range .Values.service.externalIPs }}
+    - {{.}}
+  {{- end }}
+{{- end }}
+  selector:
+    {{- include "gateway.selectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/resources/v1.24.0/charts/gateway/templates/serviceaccount.yaml b/resources/v1.26.1/charts/gateway/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.0/charts/gateway/templates/serviceaccount.yaml
rename to resources/v1.26.1/charts/gateway/templates/serviceaccount.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/templates/zzz_profile.yaml b/resources/v1.26.1/charts/gateway/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/gateway/templates/zzz_profile.yaml
rename to resources/v1.26.1/charts/gateway/templates/zzz_profile.yaml
diff --git a/resources/v1.24.0/charts/gateway/values.schema.json b/resources/v1.26.1/charts/gateway/values.schema.json
similarity index 100%
rename from resources/v1.24.0/charts/gateway/values.schema.json
rename to resources/v1.26.1/charts/gateway/values.schema.json
diff --git a/resources/v1.26.1/charts/gateway/values.yaml b/resources/v1.26.1/charts/gateway/values.yaml
new file mode 100644
index 000000000..4e65676ba
--- /dev/null
+++ b/resources/v1.26.1/charts/gateway/values.yaml
@@ -0,0 +1,170 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  # Name allows overriding the release name. Generally this should not be set
+  name: ""
+  # revision declares which revision this gateway is a part of
+  revision: ""
+
+  # Controls the spec.replicas setting for the Gateway deployment if set.
+  # Otherwise defaults to Kubernetes Deployment default (1).
+  replicaCount:
+
+  kind: Deployment
+
+  rbac:
+    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
+    # when using http://gateway-api.org/.
+    enabled: true
+
+  serviceAccount:
+    # If set, a service account will be created. Otherwise, the default is used
+    create: true
+    # Annotations to add to the service account
+    annotations: {}
+    # The name of the service account to use.
+    # If not set, the release name is used
+    name: ""
+
+  podAnnotations:
+    prometheus.io/port: "15020"
+    prometheus.io/scrape: "true"
+    prometheus.io/path: "/stats/prometheus"
+    inject.istio.io/templates: "gateway"
+    sidecar.istio.io/inject: "true"
+
+  # Define the security context for the pod.
+  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+  securityContext: {}
+  containerSecurityContext: {}
+
+  service:
+    # Type of service. Set to "None" to disable the service entirely
+    type: LoadBalancer
+    ports:
+    - name: status-port
+      port: 15021
+      protocol: TCP
+      targetPort: 15021
+    - name: http2
+      port: 80
+      protocol: TCP
+      targetPort: 80
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 443
+    annotations: {}
+    loadBalancerIP: ""
+    loadBalancerSourceRanges: []
+    externalTrafficPolicy: ""
+    externalIPs: []
+    ipFamilyPolicy: ""
+    ipFamilies: []
+    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
+    # allocateLoadBalancerNodePorts: false
+    ## Set LoadBalancer class (only for LoadBalancers).
+    # loadBalancerClass: ""
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 2000m
+      memory: 1024Mi
+
+  autoscaling:
+    enabled: true
+    minReplicas: 1
+    maxReplicas: 5
+    targetCPUUtilizationPercentage: 80
+    targetMemoryUtilizationPercentage: {}
+    autoscaleBehavior: {}
+
+  # Pod environment variables
+  env: {}
+
+  # Deployment Update strategy
+  strategy: {}
+  
+  # Sets the Deployment minReadySeconds value
+  minReadySeconds:
+  
+  # Optionally configure a custom readinessProbe. By default the control plane
+  # automatically injects the readinessProbe. If you wish to override that
+  # behavior, you may define your own readinessProbe here.
+  readinessProbe: {}
+
+  # Labels to apply to all resources
+  labels:
+    # By default, don't enroll gateways into the ambient dataplane
+    "istio.io/dataplane-mode": none
+
+  # Annotations to apply to all resources
+  annotations: {}
+
+  nodeSelector: {}
+
+  tolerations: []
+
+  topologySpreadConstraints: []
+
+  affinity: {}
+
+  # If specified, the gateway will act as a network gateway for the given network.
+  networkGateway: ""
+
+  # Specify image pull policy if default behavior isn't desired.
+  # Default behavior: latest images will be Always else IfNotPresent
+  imagePullPolicy: ""
+
+  imagePullSecrets: []
+
+  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
+  #
+  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
+  # which means that no PodDisruptionBudget resource will be created.
+  #
+  # To enable the PodDisruptionBudget, configure it by specifying the
+  # `minAvailable` or `maxUnavailable`. For example, to set the
+  # minimum number of available replicas to 1, you can update this value as follows:
+  #
+  # podDisruptionBudget:
+  #   minAvailable: 1
+  #
+  # Or, to allow a maximum of 1 unavailable replica, you can set:
+  #
+  # podDisruptionBudget:
+  #   maxUnavailable: 1
+  #
+  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
+  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
+  #
+  # podDisruptionBudget:
+  #   minAvailable: 1
+  #   unhealthyPodEvictionPolicy: AlwaysAllow
+  #
+  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
+  #
+  # podDisruptionBudget: {}
+  #
+  podDisruptionBudget: {}
+
+  # Sets the per-pod terminationGracePeriodSeconds setting.
+  terminationGracePeriodSeconds: 30
+
+  # A list of `Volumes` added into the Gateway Pods. See
+  # https://kubernetes.io/docs/concepts/storage/volumes/.
+  volumes: []
+
+  # A list of `VolumeMounts` added into the Gateway Pods. See
+  # https://kubernetes.io/docs/concepts/storage/volumes/.
+  volumeMounts: []
+
+  # Configure this to a higher priority class in order to make sure your Istio gateway pods
+  # will not be killed because of low priority class.
+  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+  # for more detail.
+  priorityClassName: ""
diff --git a/resources/v1.26.1/charts/istiod/Chart.yaml b/resources/v1.26.1/charts/istiod/Chart.yaml
new file mode 100644
index 000000000..fd94f0a1f
--- /dev/null
+++ b/resources/v1.26.1/charts/istiod/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+appVersion: 1.26.1
+description: Helm chart for istio control plane
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+- istiod
+- istio-discovery
+name: istiod
+sources:
+- https://github.com/istio/istio
+version: 1.26.1
diff --git a/resources/v1.24.0/charts/istiod/README.md b/resources/v1.26.1/charts/istiod/README.md
similarity index 100%
rename from resources/v1.24.0/charts/istiod/README.md
rename to resources/v1.26.1/charts/istiod/README.md
diff --git a/resources/v1.26.1/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.26.1/charts/istiod/files/gateway-injection-template.yaml
new file mode 100644
index 000000000..fdeab1adb
--- /dev/null
+++ b/resources/v1.26.1/charts/istiod/files/gateway-injection-template.yaml
@@ -0,0 +1,261 @@
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations:
+    istio.io/rev: {{ .Revision | default "default" | quote }}
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}"
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}"
+    {{- end }}
+    {{- end }}
+spec:
+  securityContext:
+  {{- if .Values.gateways.securityContext }}
+    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
+  {{- else }}
+    sysctls:
+    - name: net.ipv4.ip_unprivileged_port_start
+      value: "0"
+  {{- end }}
+  containers:
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    ports:
+    - containerPort: 15090
+      protocol: TCP
+      name: http-envoy-prom
+    args:
+    - proxy
+    - router
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+  {{- if .Values.global.proxy.lifecycle }}
+    lifecycle:
+      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
+  {{- end }}
+    securityContext:
+      runAsUser: {{ .ProxyUID | default "1337" }}
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+    env:
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: ISTIO_CPU_LIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: GOMEMLIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.memory
+    - name: GOMAXPROCS
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    {{- if .CompliancePolicy }}
+    - name: COMPLIANCE_POLICY
+      value: "{{ .CompliancePolicy }}"
+    {{- end }}
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    - name: ISTIO_META_INTERCEPTION_MODE
+      value: "{{ .ProxyConfig.InterceptionMode.String }}"
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- if .DeploymentMeta.Name }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ .DeploymentMeta.Name }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    - name: credential-socket
+      mountPath: /var/run/secrets/credential-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    # SDS channel between istioagent and Envoy
+    - mountPath: /etc/istio/proxy
+      name: istio-envoy
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+  volumes:
+  - emptyDir: {}
+    name: workload-socket
+  - emptyDir: {}
+    name: credential-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else}}
+  - emptyDir: {}
+    name: workload-certs
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-envoy
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+        name: istio.io:istiod-ca:root-cert
+        path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: istio-ca-root-cert
+  {{- end }}
+  {{- end }}
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.26.1/charts/istiod/files/grpc-agent.yaml b/resources/v1.26.1/charts/istiod/files/grpc-agent.yaml
new file mode 100644
index 000000000..6f3315b35
--- /dev/null
+++ b/resources/v1.26.1/charts/istiod/files/grpc-agent.yaml
@@ -0,0 +1,318 @@
+{{- define "resources"  }}
+  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
+      requests:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
+        {{ end }}
+    {{- end }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+      limits:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
+        {{ end }}
+    {{- end }}
+  {{- else }}
+    {{- if .Values.global.proxy.resources }}
+      {{ toYaml .Values.global.proxy.resources | indent 6 }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations: {
+    istio.io/rev: {{ .Revision | default "default" | quote }},
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- end }}
+    sidecar.istio.io/rewriteAppHTTPProbers: "false",
+  }
+spec:
+  containers:
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    ports:
+    - containerPort: 15020
+      protocol: TCP
+      name: mesh-metrics
+    args:
+    - proxy
+    - sidecar
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+    lifecycle:
+      postStart:
+        exec:
+          command:
+          - pilot-agent
+          - wait
+          - --url=http://localhost:15020/healthz/ready
+    env:
+    - name: ISTIO_META_GENERATOR
+      value: grpc
+    - name: OUTPUT_CERTS
+      value: /var/lib/istio/data
+    {{- if eq .InboundTrafficPolicyMode "localhost" }}
+    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
+      value: "true"
+    {{- end }}
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- if .DeploymentMeta.Name }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ .DeploymentMeta.Name }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    # grpc uses xds:/// to resolve – no need to resolve VIP
+    - name: ISTIO_META_DNS_CAPTURE
+      value: "false"
+    - name: DISABLE_ENVOY
+      value: "true"
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15020
+      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
+    resources:
+  {{ template "resources" . }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    # UDS channel between istioagent and gRPC client for XDS/SDS
+    - mountPath: /etc/istio/proxy
+      name: istio-xds
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+    {{- end }}
+      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
+      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
+    - name: "{{  $index }}"
+      {{ toYaml $value | indent 6 }}
+      {{ end }}
+      {{- end }}
+{{- range $index, $container := .Spec.Containers  }}
+{{ if not (eq $container.Name "istio-proxy") }}
+  - name: {{ $container.Name }}
+    env:
+      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
+        value: "true"
+      - name: "GRPC_XDS_BOOTSTRAP"
+        value: "/etc/istio/proxy/grpc-bootstrap.json"
+    volumeMounts:
+      - mountPath: /var/lib/istio/data
+        name: istio-data
+      # UDS channel between istioagent and gRPC client for XDS/SDS
+      - mountPath: /etc/istio/proxy
+        name: istio-xds
+      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
+      - name: gke-workload-certificate
+        mountPath: /var/run/secrets/workload-spiffe-credentials
+        readOnly: true
+      {{- else }}
+      - name: workload-certs
+        mountPath: /var/run/secrets/workload-spiffe-credentials
+      {{- end }}
+{{- end }}
+{{- end }}
+  volumes:
+  - emptyDir:
+    name: workload-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else }}
+  - emptyDir:
+    name: workload-certs
+  {{- end }}
+  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+  - name: custom-bootstrap-volume
+    configMap:
+      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-xds
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+        name: istio.io:istiod-ca:root-cert
+        path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: istio-ca-root-cert
+  {{- end }}
+  {{- end }}
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
+    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
+  - name: "{{ $index }}"
+    {{ toYaml $value | indent 4 }}
+    {{ end }}
+    {{ end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.24.0/charts/istiod/files/grpc-simple.yaml b/resources/v1.26.1/charts/istiod/files/grpc-simple.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/files/grpc-simple.yaml
rename to resources/v1.26.1/charts/istiod/files/grpc-simple.yaml
diff --git a/resources/v1.26.1/charts/istiod/files/injection-template.yaml b/resources/v1.26.1/charts/istiod/files/injection-template.yaml
new file mode 100644
index 000000000..d8b96ffdc
--- /dev/null
+++ b/resources/v1.26.1/charts/istiod/files/injection-template.yaml
@@ -0,0 +1,530 @@
+{{- define "resources"  }}
+  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
+      requests:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
+        {{ end }}
+    {{- end }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+      limits:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
+        {{ end }}
+    {{- end }}
+  {{- else }}
+    {{- if .Values.global.proxy.resources }}
+      {{ toYaml .Values.global.proxy.resources | indent 6 }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
+    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
+    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
+    {{- end }}
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations: {
+    istio.io/rev: {{ .Revision | default "default" | quote }},
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- end }}
+{{- if .Values.pilot.cni.enabled }}
+    {{- if eq .Values.pilot.cni.provider "multus" }}
+    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
+    {{- end }}
+    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
+    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
+    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
+    traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}",
+    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
+    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
+    {{- end }}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
+    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
+    {{- end }}
+    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
+    {{ with index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}istio.io/reroute-virtual-interfaces: "{{.}}",{{ end }}
+    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
+{{- end }}
+  }
+spec:
+  {{- $holdProxy := and
+      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
+      (not $nativeSidecar) }}
+  {{- $noInitContainer := and
+      (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE`)
+      (not $nativeSidecar) }}
+  {{ if $noInitContainer }}
+  initContainers: []
+  {{ else -}}
+  initContainers:
+  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
+  {{ if .Values.pilot.cni.enabled -}}
+  - name: istio-validation
+  {{ else -}}
+  - name: istio-init
+  {{ end -}}
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    args:
+    - istio-iptables
+    - "-p"
+    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
+    - "-z"
+    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
+    - "-u"
+    - {{ .ProxyUID | default "1337" | quote }}
+    - "-m"
+    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
+    - "-i"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
+    - "-x"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
+    - "-b"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
+    - "-d"
+  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
+    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
+  {{- else }}
+    - "15090,15021"
+  {{- end }}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
+    - "-q"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
+    {{ end -}}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
+    - "-o"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
+    {{ end -}}
+    {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
+    - "-k"
+    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
+    {{ end -}}
+    {{ if (isset .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces`) -}}
+    - "-k"
+    - "{{ index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}"
+    {{ end -}}
+     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
+    - "-c"
+    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
+    {{ end -}}
+    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
+    {{ if .Values.global.logAsJson -}}
+    - "--log_as_json"
+    {{ end -}}
+    {{ if .Values.pilot.cni.enabled -}}
+    - "--run-validation"
+    - "--skip-rule-apply"
+    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
+    - "--force-apply"
+    {{ end -}}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+  {{- if .ProxyConfig.ProxyMetadata }}
+    env:
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+  {{- end }}
+    resources:
+  {{ template "resources" . }}
+    securityContext:
+      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
+      privileged: {{ .Values.global.proxy.privileged }}
+      capabilities:
+    {{- if not .Values.pilot.cni.enabled }}
+        add:
+        - NET_ADMIN
+        - NET_RAW
+    {{- end }}
+        drop:
+        - ALL
+    {{- if not .Values.pilot.cni.enabled }}
+      readOnlyRootFilesystem: false
+      runAsGroup: 0
+      runAsNonRoot: false
+      runAsUser: 0
+    {{- else }}
+      readOnlyRootFilesystem: true
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+      runAsUser: {{ .ProxyUID | default "1337" }}
+      runAsNonRoot: true
+    {{- end }}
+  {{ end -}}
+  {{ end -}}
+  {{ if not $nativeSidecar }}
+  containers:
+  {{ end }}
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
+    ports:
+    - containerPort: 15090
+      protocol: TCP
+      name: http-envoy-prom
+    args:
+    - proxy
+    - sidecar
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+  {{- if .Values.global.proxy.outlierLogPath }}
+    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
+  {{- end}}
+  {{- if .Values.global.proxy.lifecycle }}
+    lifecycle:
+      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
+  {{- else if $holdProxy }}
+    lifecycle:
+      postStart:
+        exec:
+          command:
+          - pilot-agent
+          - wait
+  {{- else if $nativeSidecar }}
+    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
+    lifecycle:
+      preStop:
+        exec:
+          command:
+          - pilot-agent
+          - request
+          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
+          - POST
+          - drain
+  {{- end }}
+    env:
+    {{- if eq .InboundTrafficPolicyMode "localhost" }}
+    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
+      value: "true"
+    {{- end }}
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: ISTIO_CPU_LIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: GOMEMLIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.memory
+    - name: GOMAXPROCS
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    {{- if .CompliancePolicy }}
+    - name: COMPLIANCE_POLICY
+      value: "{{ .CompliancePolicy }}"
+    {{- end }}
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    - name: ISTIO_META_INTERCEPTION_MODE
+      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- with (index .ObjectMeta.Labels `service.istio.io/workload-name` | default .DeploymentMeta.Name) }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ . }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - name: ISTIO_BOOTSTRAP_OVERRIDE
+      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
+    {{- end }}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
+    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
+  {{ if .Values.global.proxy.startupProbe.enabled }}
+    startupProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: 0
+      periodSeconds: 1
+      timeoutSeconds: 3
+      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
+  {{ end }}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
+    {{ end -}}
+    securityContext:
+      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
+      allowPrivilegeEscalation: true
+      capabilities:
+        add:
+        - NET_ADMIN
+        drop:
+        - ALL
+      privileged: true
+      readOnlyRootFilesystem: true
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+      runAsNonRoot: false
+      runAsUser: 0
+      {{- else }}
+      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
+      capabilities:
+        {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
+        add:
+        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
+        - NET_ADMIN
+        {{- end }}
+        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
+        - NET_BIND_SERVICE
+        {{- end }}
+        {{- end }}
+        drop:
+        - ALL
+      privileged: {{ .Values.global.proxy.privileged }}
+      readOnlyRootFilesystem: true
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+      {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
+      runAsNonRoot: false
+      runAsUser: 0
+      {{- else -}}
+      runAsNonRoot: true
+      runAsUser: {{ .ProxyUID | default "1337" }}
+      {{- end }}
+      {{- end }}
+    resources:
+  {{ template "resources" . }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    - name: credential-socket
+      mountPath: /var/run/secrets/credential-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - mountPath: /etc/istio/custom-bootstrap
+      name: custom-bootstrap-volume
+    {{- end }}
+    # SDS channel between istioagent and Envoy
+    - mountPath: /etc/istio/proxy
+      name: istio-envoy
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
+    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
+      name: lightstep-certs
+      readOnly: true
+    {{- end }}
+      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
+      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
+    - name: "{{  $index }}"
+      {{ toYaml $value | indent 6 }}
+      {{ end }}
+      {{- end }}
+  volumes:
+  - emptyDir:
+    name: workload-socket
+  - emptyDir:
+    name: credential-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else }}
+  - emptyDir:
+    name: workload-certs
+  {{- end }}
+  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+  - name: custom-bootstrap-volume
+    configMap:
+      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-envoy
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+        name: istio.io:istiod-ca:root-cert
+        path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: istio-ca-root-cert
+  {{- end }}
+  {{- end }}
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
+    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
+  - name: "{{ $index }}"
+    {{ toYaml $value | indent 4 }}
+    {{ end }}
+    {{ end }}
+  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
+  - name: lightstep-certs
+    secret:
+      optional: true
+      secretName: lightstep.cacert
+  {{- end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.26.1/charts/istiod/files/kube-gateway.yaml b/resources/v1.26.1/charts/istiod/files/kube-gateway.yaml
new file mode 100644
index 000000000..447ecae83
--- /dev/null
+++ b/resources/v1.26.1/charts/istiod/files/kube-gateway.yaml
@@ -0,0 +1,401 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{.ServiceAccount | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  {{- if ge .KubeVersion 128 }}
+  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+  {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.istio.io/managed" "istio.io-gateway-controller"
+      ) | nindent 4 }}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: {{.Name}}
+    uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      "{{.GatewayNameLabel}}": {{.Name}}
+  template:
+    metadata:
+      annotations:
+        {{- toJsonMap
+          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
+          (strdict "istio.io/rev" (.Revision | default "default"))
+          (strdict
+            "prometheus.io/path" "/stats/prometheus"
+            "prometheus.io/port" "15020"
+            "prometheus.io/scrape" "true"
+          ) | nindent 8 }}
+      labels:
+        {{- toJsonMap
+          (strdict
+            "sidecar.istio.io/inject" "false"
+            "service.istio.io/canonical-name" .DeploymentName
+            "service.istio.io/canonical-revision" "latest"
+           )
+          .InfrastructureLabels
+          (strdict
+            "gateway.networking.k8s.io/gateway-name" .Name
+            "gateway.istio.io/managed" "istio.io-gateway-controller"
+          ) | nindent 8 }}
+    spec:
+      securityContext:
+      {{- if .Values.gateways.securityContext }}
+        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
+      {{- else }}
+        sysctls:
+        - name: net.ipv4.ip_unprivileged_port_start
+          value: "0"
+      {{- if .Values.gateways.seccompProfile }}
+        seccompProfile:
+      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
+      {{- end }}
+      {{- end }}
+      serviceAccountName: {{.ServiceAccount | quote}}
+      containers:
+      - name: istio-proxy
+      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+      {{- else }}
+        image: "{{ .ProxyImage }}"
+      {{- end }}
+        {{- if .Values.global.proxy.resources }}
+        resources:
+          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
+        {{- end }}
+        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
+          allowPrivilegeEscalation: false
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsUser: {{ .ProxyUID | default "1337" }}
+          runAsGroup: {{ .ProxyGID | default "1337" }}
+          runAsNonRoot: true
+        ports:
+        - containerPort: 15020
+          name: metrics
+          protocol: TCP
+        - containerPort: 15021
+          name: status-port
+          protocol: TCP
+        - containerPort: 15090
+          protocol: TCP
+          name: http-envoy-prom
+        args:
+        - proxy
+        - router
+        - --domain
+        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+        - --proxyLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
+        - --proxyComponentLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
+        - --log_output_level
+        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
+      {{- if .Values.global.sts.servicePort }}
+        - --stsPort={{ .Values.global.sts.servicePort }}
+      {{- end }}
+      {{- if .Values.global.logAsJson }}
+        - --log_as_json
+      {{- end }}
+      {{- if .Values.global.proxy.lifecycle }}
+        lifecycle:
+          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
+      {{- end }}
+        env:
+        - name: PILOT_CERT_PROVIDER
+          value: {{ .Values.global.pilotCertProvider }}
+        - name: CA_ADDR
+        {{- if .Values.global.caAddress }}
+          value: {{ .Values.global.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        - name: ISTIO_CPU_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: PROXY_CONFIG
+          value: |
+                 {{ protoToJSON .ProxyConfig }}
+        - name: ISTIO_META_POD_PORTS
+          value: "[]"
+        - name: ISTIO_META_APP_CONTAINERS
+          value: ""
+        - name: GOMEMLIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.memory
+        - name: GOMAXPROCS
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: ISTIO_META_CLUSTER_ID
+          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
+        - name: ISTIO_META_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: ISTIO_META_INTERCEPTION_MODE
+          value: "{{ .ProxyConfig.InterceptionMode.String }}"
+        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
+        - name: ISTIO_META_NETWORK
+          value: {{.|quote}}
+        {{- end }}
+        - name: ISTIO_META_WORKLOAD_NAME
+          value: {{.DeploymentName|quote}}
+        - name: ISTIO_META_OWNER
+          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
+        {{- if .Values.global.meshID }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ .Values.global.meshID }}"
+        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+        {{- end }}
+        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+        - name: TRUST_DOMAIN
+          value: "{{ . }}"
+        {{- end }}
+        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
+        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
+          value: {{.|quote}}
+        {{- end }}
+        startupProbe:
+          failureThreshold: 30
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 1
+          periodSeconds: 1
+          successThreshold: 1
+          timeoutSeconds: 1
+        readinessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 0
+          periodSeconds: 15
+          successThreshold: 1
+          timeoutSeconds: 1
+        volumeMounts:
+        - name: workload-socket
+          mountPath: /var/run/secrets/workload-spiffe-uds
+        - name: credential-socket
+          mountPath: /var/run/secrets/credential-uds
+        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+        - name: gke-workload-certificate
+          mountPath: /var/run/secrets/workload-spiffe-credentials
+          readOnly: true
+        {{- else }}
+        - name: workload-certs
+          mountPath: /var/run/secrets/workload-spiffe-credentials
+        {{- end }}
+        {{- if eq .Values.global.pilotCertProvider "istiod" }}
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        {{- end }}
+        - mountPath: /var/lib/istio/data
+          name: istio-data
+        # SDS channel between istioagent and Envoy
+        - mountPath: /etc/istio/proxy
+          name: istio-envoy
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - name: istio-podinfo
+          mountPath: /etc/istio/pod
+      volumes:
+      - emptyDir: {}
+        name: workload-socket
+      - emptyDir: {}
+        name: credential-socket
+      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+      - name: gke-workload-certificate
+        csi:
+          driver: workloadcertificates.security.cloud.google.com
+      {{- else}}
+      - emptyDir: {}
+        name: workload-certs
+      {{- end }}
+      # SDS channel between istioagent and Envoy
+      - emptyDir:
+          medium: Memory
+        name: istio-envoy
+      - name: istio-data
+        emptyDir: {}
+      - name: istio-podinfo
+        downwardAPI:
+          items:
+            - path: "labels"
+              fieldRef:
+                fieldPath: metadata.labels
+            - path: "annotations"
+              fieldRef:
+                fieldPath: metadata.annotations
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: istio-token
+              expirationSeconds: 43200
+              audience: {{ .Values.global.sds.token.aud }}
+      {{- if eq .Values.global.pilotCertProvider "istiod" }}
+      - name: istiod-ca-cert
+      {{- if eq ((.Values.pilot).env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:root-cert
+              path: root-cert.pem
+      {{- else }}
+        configMap:
+          name: istio-ca-root-cert
+      {{- end }}
+      {{- end }}
+      {{- if .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: {{.Name}}
+    uid: {{.UID}}
+spec:
+  ipFamilyPolicy: PreferDualStack
+  ports:
+  {{- range $key, $val := .Ports }}
+  - name: {{ $val.Name | quote }}
+    port: {{ $val.Port }}
+    protocol: TCP
+    appProtocol: {{ $val.AppProtocol }}
+  {{- end }}
+  selector:
+    "{{.GatewayNameLabel}}": {{.Name}}
+  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
+  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
+  {{- end }}
+  type: {{ .ServiceType | quote }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name:  {{.DeploymentName | quote}}
+  maxReplicas: 1
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
+
diff --git a/resources/v1.24.0/charts/istiod/files/profile-ambient.yaml b/resources/v1.26.1/charts/istiod/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/files/profile-ambient.yaml
rename to resources/v1.26.1/charts/istiod/files/profile-ambient.yaml
diff --git a/resources/v1.26.1/charts/istiod/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.1/charts/istiod/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.1/charts/istiod/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.1/charts/istiod/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.1/charts/istiod/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.1/charts/istiod/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.1/charts/istiod/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.1/charts/istiod/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.1/charts/istiod/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.1/charts/istiod/files/profile-demo.yaml b/resources/v1.26.1/charts/istiod/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.1/charts/istiod/files/profile-demo.yaml
rename to resources/v1.26.1/charts/istiod/files/profile-demo.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-gke.yaml b/resources/v1.26.1/charts/istiod/files/profile-platform-gke.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-gke.yaml
rename to resources/v1.26.1/charts/istiod/files/profile-platform-gke.yaml
diff --git a/resources/v1.24.0/charts/istiod/files/profile-platform-k3d.yaml b/resources/v1.26.1/charts/istiod/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/files/profile-platform-k3d.yaml
rename to resources/v1.26.1/charts/istiod/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.1/charts/istiod/files/profile-platform-k3s.yaml b/resources/v1.26.1/charts/istiod/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.1/charts/istiod/files/profile-platform-k3s.yaml
rename to resources/v1.26.1/charts/istiod/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.0/charts/istiod/files/profile-platform-microk8s.yaml b/resources/v1.26.1/charts/istiod/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/files/profile-platform-microk8s.yaml
rename to resources/v1.26.1/charts/istiod/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.0/charts/istiod/files/profile-platform-minikube.yaml b/resources/v1.26.1/charts/istiod/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/files/profile-platform-minikube.yaml
rename to resources/v1.26.1/charts/istiod/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.0/charts/istiod/files/profile-platform-openshift.yaml b/resources/v1.26.1/charts/istiod/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/files/profile-platform-openshift.yaml
rename to resources/v1.26.1/charts/istiod/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.0/charts/istiod/files/profile-preview.yaml b/resources/v1.26.1/charts/istiod/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/files/profile-preview.yaml
rename to resources/v1.26.1/charts/istiod/files/profile-preview.yaml
diff --git a/resources/v1.24.0/charts/istiod/files/profile-remote.yaml b/resources/v1.26.1/charts/istiod/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/files/profile-remote.yaml
rename to resources/v1.26.1/charts/istiod/files/profile-remote.yaml
diff --git a/resources/v1.24.0/charts/istiod/files/profile-stable.yaml b/resources/v1.26.1/charts/istiod/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/files/profile-stable.yaml
rename to resources/v1.26.1/charts/istiod/files/profile-stable.yaml
diff --git a/resources/v1.26.1/charts/istiod/files/waypoint.yaml b/resources/v1.26.1/charts/istiod/files/waypoint.yaml
new file mode 100644
index 000000000..421cabeae
--- /dev/null
+++ b/resources/v1.26.1/charts/istiod/files/waypoint.yaml
@@ -0,0 +1,396 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{.ServiceAccount | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  {{- if ge .KubeVersion 128 }}
+  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+  {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.istio.io/managed" "istio.io-mesh-controller"
+      ) | nindent 4 }}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      "{{.GatewayNameLabel}}": "{{.Name}}"
+  template:
+    metadata:
+      annotations:
+        {{- toJsonMap
+          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
+          (strdict "istio.io/rev" (.Revision | default "default"))
+          (strdict
+            "prometheus.io/path" "/stats/prometheus"
+            "prometheus.io/port" "15020"
+            "prometheus.io/scrape" "true"
+          ) | nindent 8 }}
+      labels:
+        {{- toJsonMap
+          (strdict
+            "sidecar.istio.io/inject" "false"
+            "istio.io/dataplane-mode" "none"
+            "service.istio.io/canonical-name" .DeploymentName
+            "service.istio.io/canonical-revision" "latest"
+           )
+          .InfrastructureLabels
+          (strdict
+            "gateway.networking.k8s.io/gateway-name" .Name
+            "gateway.istio.io/managed" "istio.io-mesh-controller"
+          ) | nindent 8}}
+    spec:
+      {{- if .Values.global.waypoint.affinity }}
+      affinity:
+      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.topologySpreadConstraints }}
+      topologySpreadConstraints:
+      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.nodeSelector }}
+      nodeSelector:
+      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.tolerations }}
+      tolerations:
+      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: 2
+      serviceAccountName: {{.ServiceAccount | quote}}
+      containers:
+      - name: istio-proxy
+        ports:
+        - containerPort: 15020
+          name: metrics
+          protocol: TCP
+        - containerPort: 15021
+          name: status-port
+          protocol: TCP
+        - containerPort: 15090
+          protocol: TCP
+          name: http-envoy-prom
+        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+        {{- else }}
+        image: "{{ .ProxyImage }}"
+        {{- end }}
+        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+        args:
+        - proxy
+        - waypoint
+        - --domain
+        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+        - --serviceCluster
+        - {{.ServiceAccount}}.$(POD_NAMESPACE)
+        - --proxyLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
+        - --proxyComponentLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
+        - --log_output_level
+        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
+        {{- if .Values.global.logAsJson }}
+        - --log_as_json
+        {{- end }}
+        {{- if .Values.global.proxy.outlierLogPath }}
+        - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
+        {{- end}}
+        env:
+        - name: ISTIO_META_SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: ISTIO_META_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: PILOT_CERT_PROVIDER
+          value: {{ .Values.global.pilotCertProvider }}
+        - name: CA_ADDR
+        {{- if .Values.global.caAddress }}
+          value: {{ .Values.global.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        - name: ISTIO_CPU_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: PROXY_CONFIG
+          value: |
+                 {{ protoToJSON .ProxyConfig }}
+        {{- if .ProxyConfig.ProxyMetadata }}
+        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- end }}
+        - name: GOMEMLIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.memory
+        - name: GOMAXPROCS
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: ISTIO_META_CLUSTER_ID
+          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
+        {{- if $network }}
+        - name: ISTIO_META_NETWORK
+          value: "{{ $network }}"
+        {{- end }}
+        - name: ISTIO_META_INTERCEPTION_MODE
+          value: REDIRECT
+        - name: ISTIO_META_WORKLOAD_NAME
+          value: {{.DeploymentName}}
+        - name: ISTIO_META_OWNER
+          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
+        {{- if .Values.global.meshID }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ .Values.global.meshID }}"
+        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+        {{- end }}
+        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: TRUST_DOMAIN
+          value: "{{ . }}"
+        {{- end }}
+        {{- if .Values.global.waypoint.resources }}
+        resources:
+        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
+        {{- end }}
+        startupProbe:
+          failureThreshold: 30
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 1
+          periodSeconds: 1
+          successThreshold: 1
+          timeoutSeconds: 1
+        readinessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 0
+          periodSeconds: 15
+          successThreshold: 1
+          timeoutSeconds: 1
+        securityContext:
+          privileged: false
+        {{- if not (eq .Values.global.platform "openshift") }}
+          runAsGroup: 1337
+          runAsUser: 1337
+        {{- end }}
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          capabilities:
+            drop:
+            - ALL
+{{- if .Values.gateways.seccompProfile }}
+          seccompProfile:
+{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
+{{- end }}
+        volumeMounts:
+        - mountPath: /var/run/secrets/workload-spiffe-uds
+          name: workload-socket
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        - mountPath: /var/lib/istio/data
+          name: istio-data
+        - mountPath: /etc/istio/proxy
+          name: istio-envoy
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - mountPath: /etc/istio/pod
+          name: istio-podinfo
+      volumes:
+      - emptyDir: {}
+        name: workload-socket
+      - emptyDir:
+          medium: Memory
+        name: istio-envoy
+      - emptyDir:
+          medium: Memory
+        name: go-proxy-envoy
+      - emptyDir: {}
+        name: istio-data
+      - emptyDir: {}
+        name: go-proxy-data
+      - downwardAPI:
+          items:
+          - fieldRef:
+              fieldPath: metadata.labels
+            path: labels
+          - fieldRef:
+              fieldPath: metadata.annotations
+            path: annotations
+        name: istio-podinfo
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              audience: istio-ca
+              expirationSeconds: 43200
+              path: istio-token
+      - name: istiod-ca-cert
+      {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:root-cert
+              path: root-cert.pem
+      {{- else }}
+        configMap:
+          name: istio-ca-root-cert
+      {{- end }}
+      {{- if .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    {{ toJsonMap
+      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
+      (omit .InfrastructureAnnotations
+        "kubectl.kubernetes.io/last-applied-configuration"
+        "gateway.istio.io/name-override"
+        "gateway.istio.io/service-account"
+        "gateway.istio.io/controller-version"
+      ) | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+spec:
+  ipFamilyPolicy: PreferDualStack
+  ports:
+  {{- range $key, $val := .Ports }}
+  - name: {{ $val.Name | quote }}
+    port: {{ $val.Port }}
+    protocol: TCP
+    appProtocol: {{ $val.AppProtocol }}
+  {{- end }}
+  selector:
+    "{{.GatewayNameLabel}}": "{{.Name}}"
+  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
+  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
+  {{- end }}
+  type: {{ .ServiceType | quote }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name:  {{.DeploymentName | quote}}
+  maxReplicas: 1
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
+
diff --git a/resources/v1.24.0/charts/istiod/templates/NOTES.txt b/resources/v1.26.1/charts/istiod/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/NOTES.txt
rename to resources/v1.26.1/charts/istiod/templates/NOTES.txt
diff --git a/resources/v1.24.0/charts/istiod/templates/_helpers.tpl b/resources/v1.26.1/charts/istiod/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/_helpers.tpl
rename to resources/v1.26.1/charts/istiod/templates/_helpers.tpl
diff --git a/resources/v1.24.0/charts/istiod/templates/autoscale.yaml b/resources/v1.26.1/charts/istiod/templates/autoscale.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/autoscale.yaml
rename to resources/v1.26.1/charts/istiod/templates/autoscale.yaml
diff --git a/resources/v1.26.1/charts/istiod/templates/clusterrole.yaml b/resources/v1.26.1/charts/istiod/templates/clusterrole.yaml
new file mode 100644
index 000000000..f5157600e
--- /dev/null
+++ b/resources/v1.26.1/charts/istiod/templates/clusterrole.yaml
@@ -0,0 +1,206 @@
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
+{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  # sidecar injection controller
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+
+  # configuration validation webhook controller
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update"]
+
+  # istio configuration
+  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
+  # please proceed with caution
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["get", "watch", "list"]
+    resources: ["*"]
+{{- if .Values.global.istiod.enableAnalysis }}
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["update", "patch"]
+    resources:
+    - authorizationpolicies/status
+    - destinationrules/status
+    - envoyfilters/status
+    - gateways/status
+    - peerauthentications/status
+    - proxyconfigs/status
+    - requestauthentications/status
+    - serviceentries/status
+    - sidecars/status
+    - telemetries/status
+    - virtualservices/status
+    - wasmplugins/status
+    - workloadentries/status
+    - workloadgroups/status
+{{- end }}
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "workloadentries" ]
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "workloadentries/status",  "serviceentries/status" ]
+  - apiGroups: ["security.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "authorizationpolicies/status" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "services/status" ]
+
+  # auto-detect installed CRD definitions
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+
+  # discovery and routing
+  - apiGroups: [""]
+    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+
+{{- if .Values.taint.enabled }}
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["patch"]
+{{- end }}
+
+  # ingress controller
+{{- if .Values.global.istiod.enableAnalysis }}
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["*"]
+{{- end}}
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses", "ingressclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["*"]
+
+  # required for CA's namespace controller
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create", "get", "list", "watch", "update"]
+
+  # Istiod and bootstrap.
+{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
+{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
+  - apiGroups: ["certificates.k8s.io"]
+    resources:
+      - "certificatesigningrequests"
+      - "certificatesigningrequests/approval"
+      - "certificatesigningrequests/status"
+    verbs: ["update", "create", "get", "delete", "watch"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources:
+      - "signers"
+    resourceNames:
+{{- range .Values.global.certSigners }}
+    - {{ . | quote }}
+{{- end }}
+    verbs: ["approve"]
+{{- end}}
+{{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["clustertrustbundles"]
+    verbs: ["update", "create", "delete"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["signers"]
+    resourceNames: ["istio.io/istiod-ca"]
+    verbs: ["attest"]
+{{- end }}
+
+  # Used by Istiod to verify the JWT tokens
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]
+
+  # Used by Istiod to verify gateway SDS
+  - apiGroups: ["authorization.k8s.io"]
+    resources: ["subjectaccessreviews"]
+    verbs: ["create"]
+
+  # Use for Kubernetes Service APIs
+  - apiGroups: ["gateway.networking.k8s.io", "gateway.networking.x-k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["gateway.networking.x-k8s.io"]
+    resources:
+    - xbackendtrafficpolicies/status
+    verbs: ["update", "patch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources:
+    - backendtlspolicies/status
+    - gatewayclasses/status
+    - gateways/status
+    - grpcroutes/status
+    - httproutes/status
+    - referencegrants/status
+    - tcproutes/status
+    - tlsroutes/status
+    - udproutes/status
+    verbs: ["update", "patch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources: ["gatewayclasses"]
+    verbs: ["create", "update", "patch", "delete"]
+
+  # Needed for multicluster secret reading, possibly ingress certs in the future
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "watch", "list"]
+
+  # Used for MCS serviceexport management
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceexports"]
+    verbs: [ "get", "watch", "list", "create", "delete"]
+
+  # Used for MCS serviceimport management
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceimports"]
+    verbs: ["get", "watch", "list"]
+---
+{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["apps"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "deployments" ]
+  - apiGroups: ["autoscaling"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "horizontalpodautoscalers" ]
+  - apiGroups: ["policy"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "poddisruptionbudgets" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "services" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "serviceaccounts"]
+{{- end }}
+{{- end }}
diff --git a/resources/v1.24.0/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.26.1/charts/istiod/templates/clusterrolebinding.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/clusterrolebinding.yaml
rename to resources/v1.26.1/charts/istiod/templates/clusterrolebinding.yaml
diff --git a/resources/v1.24.0/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.26.1/charts/istiod/templates/configmap-jwks.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/configmap-jwks.yaml
rename to resources/v1.26.1/charts/istiod/templates/configmap-jwks.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/configmap-values.yaml b/resources/v1.26.1/charts/istiod/templates/configmap-values.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/configmap-values.yaml
rename to resources/v1.26.1/charts/istiod/templates/configmap-values.yaml
diff --git a/resources/v1.25.1/charts/istiod/templates/configmap.yaml b/resources/v1.26.1/charts/istiod/templates/configmap.yaml
similarity index 100%
rename from resources/v1.25.1/charts/istiod/templates/configmap.yaml
rename to resources/v1.26.1/charts/istiod/templates/configmap.yaml
diff --git a/resources/v1.26.1/charts/istiod/templates/deployment.yaml b/resources/v1.26.1/charts/istiod/templates/deployment.yaml
new file mode 100644
index 000000000..73917d860
--- /dev/null
+++ b/resources/v1.26.1/charts/istiod/templates/deployment.yaml
@@ -0,0 +1,304 @@
+# Not created if istiod is running remotely
+{{- if not .Values.istiodRemote.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istiod
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    istio: pilot
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+{{- range $key, $val := .Values.deploymentLabels }}
+    {{ $key }}: "{{ $val }}"
+{{- end }}
+spec:
+{{- if not .Values.autoscaleEnabled }}
+{{- if .Values.replicaCount }}
+  replicas: {{ .Values.replicaCount }}
+{{- end }}
+{{- end }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingMaxSurge }}
+      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
+  selector:
+    matchLabels:
+      {{- if ne .Values.revision "" }}
+      app: istiod
+      istio.io/rev: {{ .Values.revision | default "default" | quote }}
+      {{- else }}
+      istio: pilot
+      {{- end }}
+  template:
+    metadata:
+      labels:
+        app: istiod
+        istio.io/rev: {{ .Values.revision | default "default" | quote }}
+        sidecar.istio.io/inject: "false"
+        operator.istio.io/component: "Pilot"
+        {{- if ne .Values.revision "" }}
+        istio: istiod
+        {{- else }}
+        istio: pilot
+        {{- end }}
+        {{- range $key, $val := .Values.podLabels }}
+        {{ $key }}: "{{ $val }}"
+        {{- end }}
+        istio.io/dataplane-mode: none
+        app.kubernetes.io/name: "istiod"
+        {{- include "istio.labels" . | nindent 8 }}
+      annotations:
+        prometheus.io/port: "15014"
+        prometheus.io/scrape: "true"
+        sidecar.istio.io/inject: "false"
+        {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+        {{- end }}
+    spec:
+{{- if .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 8 }}
+{{- end }}
+{{- with .Values.affinity }}
+      affinity:
+{{- toYaml . | nindent 8 }}
+{{- end }}
+      tolerations:
+        - key: cni.istio.io/not-ready
+          operator: "Exists"
+{{- with .Values.tolerations }}
+{{- toYaml . | nindent 8 }}
+{{- end }}
+{{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+{{- toYaml . | nindent 8 }}
+{{- end }}
+      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+{{- if .Values.global.priorityClassName }}
+      priorityClassName: "{{ .Values.global.priorityClassName }}"
+{{- end }}
+{{- with .Values.initContainers }}
+      initContainers:
+        {{- tpl (toYaml .) $ | nindent 8 }}
+{{- end }}
+      containers:
+        - name: discovery
+{{- if contains "/" .Values.image }}
+          image: "{{ .Values.image }}"
+{{- else }}
+          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
+{{- end }}
+{{- if .Values.global.imagePullPolicy }}
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+{{- end }}
+          args:
+          - "discovery"
+          - --monitoringAddr=:15014
+{{- if .Values.global.logging.level }}
+          - --log_output_level={{ .Values.global.logging.level }}
+{{- end}}
+{{- if .Values.global.logAsJson }}
+          - --log_as_json
+{{- end }}
+          - --domain
+          - {{ .Values.global.proxy.clusterDomain }}
+{{- if .Values.taint.namespace }}
+          - --cniNamespace={{ .Values.taint.namespace }}
+{{- end }}
+          - --keepaliveMaxServerConnectionAge
+          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
+{{- if .Values.extraContainerArgs }}
+          {{- with .Values.extraContainerArgs }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+{{- end }}
+          ports:
+          - containerPort: 8080
+            protocol: TCP
+            name: http-debug
+          - containerPort: 15010
+            protocol: TCP
+            name: grpc-xds
+          - containerPort: 15012
+            protocol: TCP
+            name: tls-xds
+          - containerPort: 15017
+            protocol: TCP
+            name: https-webhooks
+          - containerPort: 15014
+            protocol: TCP
+            name: http-monitoring
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8080
+            initialDelaySeconds: 1
+            periodSeconds: 3
+            timeoutSeconds: 5
+          env:
+          - name: REVISION
+            value: "{{ .Values.revision | default `default` }}"
+          - name: PILOT_CERT_PROVIDER
+            value: {{ .Values.global.pilotCertProvider }}
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.name
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+          - name: SERVICE_ACCOUNT
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: spec.serviceAccountName
+          - name: KUBECONFIG
+            value: /var/run/secrets/remote/config
+          # If you explicitly told us where ztunnel lives, use that.
+          # Otherwise, assume it lives in our namespace
+          # Also, check for an explicit ENV override (legacy approach) and prefer that
+          # if present
+          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
+          {{ $ztTrustedName := or .Values.trustedZtunnelName "ztunnel" }}
+          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
+          - name: CA_TRUSTED_NODE_ACCOUNTS
+            value: "{{ $ztTrustedNS }}/{{ $ztTrustedName }}"
+          {{- end }}
+          {{- if .Values.env }}
+          {{- range $key, $val := .Values.env }}
+          - name: {{ $key }}
+            value: "{{ $val }}"
+          {{- end }}
+          {{- end }}
+          {{- with .Values.envVarFrom }}
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+{{- if .Values.traceSampling }}
+          - name: PILOT_TRACE_SAMPLING
+            value: "{{ .Values.traceSampling }}"
+{{- end }}
+# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
+# don't set it here to avoid duplication.
+# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
+{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
+          - name: EXTERNAL_ISTIOD
+            value: "{{ .Values.global.externalIstiod }}"
+{{- end }}
+          - name: PILOT_ENABLE_ANALYSIS
+            value: "{{ .Values.global.istiod.enableAnalysis }}"
+          - name: CLUSTER_ID
+            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
+          - name: GOMEMLIMIT
+            valueFrom:
+              resourceFieldRef:
+                resource: limits.memory
+                divisor: "1"
+          - name: GOMAXPROCS
+            valueFrom:
+              resourceFieldRef:
+                resource: limits.cpu
+                divisor: "1"
+          - name: PLATFORM
+            value: "{{ coalesce .Values.global.platform .Values.platform }}"
+          resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 12 }}
+{{- else }}
+{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
+{{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+              - ALL
+{{- if .Values.seccompProfile }}
+            seccompProfile:
+{{ toYaml .Values.seccompProfile | trim | indent 14 }}
+{{- end }}
+          volumeMounts:
+          - name: istio-token
+            mountPath: /var/run/secrets/tokens
+            readOnly: true
+          - name: local-certs
+            mountPath: /var/run/secrets/istio-dns
+          - name: cacerts
+            mountPath: /etc/cacerts
+            readOnly: true
+          - name: istio-kubeconfig
+            mountPath: /var/run/secrets/remote
+            readOnly: true
+          {{- if .Values.jwksResolverExtraRootCA }}
+          - name: extracacerts
+            mountPath: /cacerts
+          {{- end }}
+          - name: istio-csr-dns-cert
+            mountPath: /var/run/secrets/istiod/tls
+            readOnly: true
+          - name: istio-csr-ca-configmap
+            mountPath: /var/run/secrets/istiod/ca
+            readOnly: true
+          {{- with .Values.volumeMounts }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+      volumes:
+      # Technically not needed on this pod - but it helps debugging/testing SDS
+      # Should be removed after everything works.
+      - emptyDir:
+          medium: Memory
+        name: local-certs
+      - name: istio-token
+        projected:
+          sources:
+            - serviceAccountToken:
+                audience: {{ .Values.global.sds.token.aud }}
+                expirationSeconds: 43200
+                path: istio-token
+      # Optional: user-generated root
+      - name: cacerts
+        secret:
+          secretName: cacerts
+          optional: true
+      - name: istio-kubeconfig
+        secret:
+          secretName: istio-kubeconfig
+          optional: true
+      # Optional: istio-csr dns pilot certs
+      - name: istio-csr-dns-cert
+        secret:
+          secretName: istiod-tls
+          optional: true
+      - name: istio-csr-ca-configmap
+  {{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:root-cert
+              path: root-cert.pem
+              optional: true
+  {{- else }}
+        configMap:
+          name: istio-ca-root-cert
+          defaultMode: 420
+          optional: true
+  {{- end }}
+  {{- if .Values.jwksResolverExtraRootCA }}
+      - name: extracacerts
+        configMap:
+          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  {{- end }}
+      {{- with .Values.volumes }}
+        {{- toYaml . | nindent 6}}
+      {{- end }}
+
+---
+{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/gateway-class-configmap.yaml b/resources/v1.26.1/charts/istiod/templates/gateway-class-configmap.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/gateway-class-configmap.yaml
rename to resources/v1.26.1/charts/istiod/templates/gateway-class-configmap.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.26.1/charts/istiod/templates/istiod-injector-configmap.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/istiod-injector-configmap.yaml
rename to resources/v1.26.1/charts/istiod/templates/istiod-injector-configmap.yaml
diff --git a/resources/v1.24.0/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.26.1/charts/istiod/templates/mutatingwebhook.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/mutatingwebhook.yaml
rename to resources/v1.26.1/charts/istiod/templates/mutatingwebhook.yaml
diff --git a/resources/v1.24.0/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.26.1/charts/istiod/templates/poddisruptionbudget.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/poddisruptionbudget.yaml
rename to resources/v1.26.1/charts/istiod/templates/poddisruptionbudget.yaml
diff --git a/resources/v1.26.1/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.26.1/charts/istiod/templates/reader-clusterrole.yaml
new file mode 100644
index 000000000..4707c7e9f
--- /dev/null
+++ b/resources/v1.26.1/charts/istiod/templates/reader-clusterrole.yaml
@@ -0,0 +1,64 @@
+{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istio-reader
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istio-reader"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - "config.istio.io"
+      - "security.istio.io"
+      - "networking.istio.io"
+      - "authentication.istio.io"
+      - "rbac.istio.io"
+      - "telemetry.istio.io"
+      - "extensions.istio.io"
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    # TODO(keithmattix): See if we can conditionally give permission to read secrets and configmaps iff externalIstiod
+    # is enabled. Best I can tell, these two resources are only needed for configuring proxy TLS (i.e. CA certs).
+    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets", "configmaps"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list" ]
+    resources: [ "workloadentries" ]
+  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
+    resources: ["gateways"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceexports"]
+    verbs: ["get", "list", "watch", "create", "delete"]
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceimports"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]
+  - apiGroups: ["authorization.k8s.io"]
+    resources: ["subjectaccessreviews"]
+    verbs: ["create"]
+{{- if .Values.istiodRemote.enabled }}
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create", "get", "list", "watch", "update"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update"]
+{{- end}}
diff --git a/resources/v1.24.0/charts/istiod/templates/reader-clusterrolebinding.yaml b/resources/v1.26.1/charts/istiod/templates/reader-clusterrolebinding.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/reader-clusterrolebinding.yaml
rename to resources/v1.26.1/charts/istiod/templates/reader-clusterrolebinding.yaml
diff --git a/resources/v1.24.0/charts/istiod/templates/remote-istiod-endpoints.yaml b/resources/v1.26.1/charts/istiod/templates/remote-istiod-endpoints.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/remote-istiod-endpoints.yaml
rename to resources/v1.26.1/charts/istiod/templates/remote-istiod-endpoints.yaml
diff --git a/resources/v1.25.1/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.26.1/charts/istiod/templates/remote-istiod-service.yaml
similarity index 100%
rename from resources/v1.25.1/charts/istiod/templates/remote-istiod-service.yaml
rename to resources/v1.26.1/charts/istiod/templates/remote-istiod-service.yaml
diff --git a/resources/v1.26.1/charts/istiod/templates/revision-tags.yaml b/resources/v1.26.1/charts/istiod/templates/revision-tags.yaml
new file mode 100644
index 000000000..e45b5e1d4
--- /dev/null
+++ b/resources/v1.26.1/charts/istiod/templates/revision-tags.yaml
@@ -0,0 +1,148 @@
+# Adapted from istio-discovery/templates/mutatingwebhook.yaml
+# Removed paths for legacy and default selectors since a revision tag
+# is inherently created from a specific revision
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- $whv := dict
+ "revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+{{- range $tagName := $.Values.revisionTags }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq $.Release.Namespace "istio-system"}}
+  name: istio-revision-tag-{{ $tagName }}
+{{- else }}
+  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/tag: {{ $tagName }}
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+
+{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
+{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
+{{- if (eq $tagName "default") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+---
+{{- end }}
diff --git a/resources/v1.24.0/charts/istiod/templates/role.yaml b/resources/v1.26.1/charts/istiod/templates/role.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/role.yaml
rename to resources/v1.26.1/charts/istiod/templates/role.yaml
diff --git a/resources/v1.24.0/charts/istiod/templates/rolebinding.yaml b/resources/v1.26.1/charts/istiod/templates/rolebinding.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/rolebinding.yaml
rename to resources/v1.26.1/charts/istiod/templates/rolebinding.yaml
diff --git a/resources/v1.24.0/charts/istiod/templates/service.yaml b/resources/v1.26.1/charts/istiod/templates/service.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/service.yaml
rename to resources/v1.26.1/charts/istiod/templates/service.yaml
diff --git a/resources/v1.24.2/charts/istiod/templates/serviceaccount.yaml b/resources/v1.26.1/charts/istiod/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/serviceaccount.yaml
rename to resources/v1.26.1/charts/istiod/templates/serviceaccount.yaml
diff --git a/resources/v1.24.0/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.26.1/charts/istiod/templates/validatingadmissionpolicy.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/validatingadmissionpolicy.yaml
rename to resources/v1.26.1/charts/istiod/templates/validatingadmissionpolicy.yaml
diff --git a/resources/v1.24.0/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.26.1/charts/istiod/templates/validatingwebhookconfiguration.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/validatingwebhookconfiguration.yaml
rename to resources/v1.26.1/charts/istiod/templates/validatingwebhookconfiguration.yaml
diff --git a/resources/v1.24.0/charts/istiod/templates/zzy_descope_legacy.yaml b/resources/v1.26.1/charts/istiod/templates/zzy_descope_legacy.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/zzy_descope_legacy.yaml
rename to resources/v1.26.1/charts/istiod/templates/zzy_descope_legacy.yaml
diff --git a/resources/v1.25.2/charts/istiod/templates/zzz_profile.yaml b/resources/v1.26.1/charts/istiod/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.25.2/charts/istiod/templates/zzz_profile.yaml
rename to resources/v1.26.1/charts/istiod/templates/zzz_profile.yaml
diff --git a/resources/v1.26.1/charts/istiod/values.yaml b/resources/v1.26.1/charts/istiod/values.yaml
new file mode 100644
index 000000000..26e9a6161
--- /dev/null
+++ b/resources/v1.26.1/charts/istiod/values.yaml
@@ -0,0 +1,553 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  autoscaleBehavior: {}
+  replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+
+  hub: ""
+  tag: ""
+  variant: ""
+
+  # Can be a full hub/image:tag
+  image: pilot
+  traceSampling: 1.0
+
+  # Resources for a small pilot install
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2048Mi
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # Whether to use an existing CNI installation
+  cni:
+    enabled: false
+    provider: default
+
+  # Additional container arguments
+  extraContainerArgs: []
+
+  env: {}
+
+  envVarFrom: []
+
+  # Settings related to the untaint controller
+  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
+  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
+  taint:
+    # Controls whether or not the untaint controller is active
+    enabled: false
+    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
+    namespace: ""
+
+  affinity: {}
+
+  tolerations: []
+
+  cpu:
+    targetAverageUtilization: 80
+  memory: {}
+    # targetAverageUtilization: 80
+
+  # Additional volumeMounts to the istiod container
+  volumeMounts: []
+
+  # Additional volumes to the istiod pod
+  volumes: []
+
+  # Inject initContainers into the istiod pod
+  initContainers: []
+
+  nodeSelector: {}
+  podAnnotations: {}
+  serviceAnnotations: {}
+  serviceAccountAnnotations: {}
+  sidecarInjectorWebhookAnnotations: {}
+
+  topologySpreadConstraints: []
+
+  # You can use jwksResolverExtraRootCA to provide a root certificate
+  # in PEM format. This will then be trusted by pilot when resolving
+  # JWKS URIs.
+  jwksResolverExtraRootCA: ""
+
+  # The following is used to limit how long a sidecar can be connected
+  # to a pilot. It balances out load across pilot instances at the cost of
+  # increasing system churn.
+  keepaliveMaxServerConnectionAge: 30m
+
+  # Additional labels to apply to the deployment.
+  deploymentLabels: {}
+
+  ## Mesh config settings
+
+  # Install the mesh config map, generated from values.yaml.
+  # If false, pilot wil use default values (by default) or user-supplied values.
+  configMap: true
+
+  # Additional labels to apply on the pod level for monitoring and logging configuration.
+  podLabels: {}
+
+  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
+  ipFamilyPolicy: ""
+  ipFamilies: []
+
+  # Ambient mode only.
+  # Set this if you install ztunnel to a different namespace from `istiod`.
+  # If set, `istiod` will allow connections from trusted node proxy ztunnels
+  # in the provided namespace.
+  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
+  # in the same namespace as itself.
+  trustedZtunnelNamespace: ""
+  # Set this if you install ztunnel with a name different from the default.
+  trustedZtunnelName: ""
+
+  sidecarInjectorWebhook:
+    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
+    # always skip the injection on pods that match that label selector, regardless of the global policy.
+    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
+    neverInjectSelector: []
+    alwaysInjectSelector: []
+
+    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
+    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
+    #
+    # annotations:
+    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+    #
+    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
+    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
+    # injectedAnnotations:
+    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
+    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
+    injectedAnnotations: {}
+
+    # This enables injection of sidecar in all namespaces,
+    # with the exception of namespaces with "istio-injection:disabled" annotation
+    # Only one environment should have this enabled.
+    enableNamespacesByDefault: false
+
+    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
+    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
+    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
+    reinvocationPolicy: Never
+
+    rewriteAppHTTPProbe: true
+
+    # Templates defines a set of custom injection templates that can be used. For example, defining:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
+    # being injected with the hello=world labels.
+    # This is intended for advanced configuration only; most users should use the built in template
+    templates: {}
+
+    # Default templates specifies a set of default templates that are used in sidecar injection.
+    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
+    # To inject other additional templates, define it using the `templates` option, and add it to
+    # the default templates list.
+    # For example:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # defaultTemplates: ["sidecar", "hello"]
+    defaultTemplates: []
+  istiodRemote:
+    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
+    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
+    # to utilize a remote instance.
+    enabled: false
+    # Sidecar injector mutating webhook configuration clientConfig.url value.
+    # For example: https://$remotePilotAddress:15017/inject
+    # The host should not refer to a service running in the cluster; use a service reference by specifying
+    # the clientConfig.service field instead.
+    injectionURL: ""
+
+    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
+    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
+    injectionPath: "/inject"
+
+    injectionCABundle: ""
+  telemetry:
+    enabled: true
+    v2:
+      # For Null VM case now.
+      # This also enables metadata exchange.
+      enabled: true
+      # Indicate if prometheus stats filter is enabled or not
+      prometheus:
+        enabled: true
+      # stackdriver filter settings.
+      stackdriver:
+        enabled: false
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # Revision tags are aliases to Istio control plane revisions
+  revisionTags: []
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
+  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
+  meshConfig:
+    enablePrometheusMerge: true
+
+  experimental:
+    stableValidationPolicy: false
+
+  global:
+    # Used to locate istiod.
+    istioNamespace: istio-system
+    # List of cert-signers to allow "approve" action in the istio cluster role
+    #
+    # certSigners:
+    #   - clusterissuers.cert-manager.io/istio-ca
+    certSigners: []
+    # enable pod disruption budget for the control plane, which is used to
+    # ensure Istio control plane components are gradually upgraded or recovered.
+    defaultPodDisruptionBudget:
+      enabled: true
+      # The values aren't mutable due to a current PodDisruptionBudget limitation
+      # minAvailable: 1
+
+    # A minimal set of requested resources to applied to all deployments so that
+    # Horizontal Pod Autoscaler will be able to function (if set).
+    # Each component can overwrite these default values by adding its own resources
+    # block in the relevant section below and setting the desired resources values.
+    defaultResources:
+      requests:
+        cpu: 10m
+      #   memory: 128Mi
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+    # Default tag for Istio images.
+    tag: 1.26.1
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Enabled by default in master for maximising testing.
+    istiod:
+      enableAnalysis: false
+
+    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
+    logAsJson: false
+
+    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+    # The control plane has different scopes depending on component, but can configure default log level across all components
+    # If empty, default scope and level will be used as configured in code
+    logging:
+      level: "default:info"
+
+    omitSidecarInjectorConfigMap: false
+
+    # Configure whether Operator manages webhook configurations. The current behavior
+    # of Istiod is to manage its own webhook configurations.
+    # When this option is set as true, Istio Operator, instead of webhooks, manages the
+    # webhook configurations. When this option is set as false, webhooks manage their
+    # own webhook configurations.
+    operatorManageWebhooks: false
+
+    # Custom DNS config for the pod to resolve names of services in other
+    # clusters. Use this to add additional search domains, and other settings.
+    # see
+    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
+    # This does not apply to gateway pods as they typically need a different
+    # set of DNS settings than the normal application pods (e.g., in
+    # multicluster scenarios).
+    # NOTE: If using templates, follow the pattern in the commented example below.
+    #podDNSSearchNamespaces:
+    #- global
+    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
+
+    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
+    # system-node-critical, it is better to configure this in order to make sure your Istio pods
+    # will not be killed because of low priority class.
+    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+    # for more detail.
+    priorityClassName: ""
+
+    proxy:
+      image: proxyv2
+
+      # This controls the 'policy' in the sidecar injector.
+      autoInject: enabled
+
+      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
+      # cluster domain. Default value is "cluster.local".
+      clusterDomain: "cluster.local"
+
+      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
+      # not set, then the global "logLevel" will be used.
+      componentLogLevel: "misc:error"
+
+      # istio ingress capture allowlist
+      # examples:
+      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
+      excludeInboundPorts: ""
+      includeInboundPorts: "*"
+
+      # istio egress capture allowlist
+      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
+      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
+      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
+      # be allowed by the sidecar
+      includeIPRanges: "*"
+      excludeIPRanges: ""
+      includeOutboundPorts: ""
+      excludeOutboundPorts: ""
+
+      # Log level for proxy, applies to gateways and sidecars.
+      # Expected values are: trace|debug|info|warning|error|critical|off
+      logLevel: warning
+
+      # Specify the path to the outlier event log.
+      # Example: /dev/stdout
+      outlierLogPath: ""
+
+      #If set to true, istio-proxy container will have privileged securityContext
+      privileged: false
+
+      # The number of successive failed probes before indicating readiness failure.
+      readinessFailureThreshold: 4
+
+      # The initial delay for readiness probes in seconds.
+      readinessInitialDelaySeconds: 0
+
+      # The period between readiness probes.
+      readinessPeriodSeconds: 15
+
+      # Enables or disables a startup probe.
+      # For optimal startup times, changing this should be tied to the readiness probe values.
+      #
+      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
+      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
+      # and doesn't spam the readiness endpoint too much
+      #
+      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
+      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
+      startupProbe:
+        enabled: true
+        failureThreshold: 600 # 10 minutes
+
+      # Resources for the sidecar.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: 2000m
+          memory: 1024Mi
+
+      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
+      statusPort: 15020
+
+      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
+      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
+      tracer: "none"
+
+    proxy_init:
+      # Base name for the proxy_init container, used to configure iptables.
+      image: proxyv2
+      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
+      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
+      forceApplyIptables: false
+
+    # configure remote pilot and istiod service and endpoint
+    remotePilotAddress: ""
+
+    ##############################################################################################
+    # The following values are found in other charts. To effectively modify these values, make   #
+    # make sure they are consistent across your Istio helm charts                                #
+    ##############################################################################################
+
+    # The customized CA address to retrieve certificates for the pods in the cluster.
+    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+    # If not set explicitly, default to the Istio discovery address.
+    caAddress: ""
+
+    # Enable control of remote clusters.
+    externalIstiod: false
+
+    # Configure a remote cluster as the config cluster for an external istiod.
+    configCluster: false
+
+    # configValidation enables the validation webhook for Istio configuration.
+    configValidation: true
+
+    # Mesh ID means Mesh Identifier. It should be unique within the scope where
+    # meshes will interact with each other, but it is not required to be
+    # globally/universally unique. For example, if any of the following are true,
+    # then two meshes must have different Mesh IDs:
+    # - Meshes will have their telemetry aggregated in one place
+    # - Meshes will be federated together
+    # - Policy will be written referencing one mesh from the other
+    #
+    # If an administrator expects that any of these conditions may become true in
+    # the future, they should ensure their meshes have different Mesh IDs
+    # assigned.
+    #
+    # Within a multicluster mesh, each cluster must be (manually or auto)
+    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
+    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
+    # of migration TBD, and it may be a disruptive operation to change the Mesh
+    # ID post-install.
+    #
+    # If the mesh admin does not specify a value, Istio will use the value of the
+    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
+    # value.
+    meshID: ""
+
+    # Configure the mesh networks to be used by the Split Horizon EDS.
+    #
+    # The following example defines two networks with different endpoints association methods.
+    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
+    # mapped to network1. The gateway for this network example is specified by its public IP
+    # address and port.
+    # The second network, `network2`, in this example is defined differently with all endpoints
+    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
+    # gateway is also defined differently with the name of the gateway service on the remote
+    # cluster. The public IP for the gateway will be determined from that remote service (only
+    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
+    # it still need to be configured manually).
+    #
+    # meshNetworks:
+    #   network1:
+    #     endpoints:
+    #     - fromCidr: "192.168.0.1/24"
+    #     gateways:
+    #     - address: 1.1.1.1
+    #       port: 80
+    #   network2:
+    #     endpoints:
+    #     - fromRegistry: reg1
+    #     gateways:
+    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
+    #       port: 443
+    #
+    meshNetworks: {}
+
+    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
+    mountMtlsCerts: false
+
+    multiCluster:
+      # Set to true to connect two kubernetes clusters via their respective
+      # ingressgateway services when pods in each cluster cannot directly
+      # talk to one another. All clusters should be using Istio mTLS and must
+      # have a shared root CA for this model to work.
+      enabled: false
+      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
+      # to properly label proxies
+      clusterName: ""
+
+    # Network defines the network this cluster belong to. This name
+    # corresponds to the networks in the map of mesh networks.
+    network: ""
+
+    # Configure the certificate provider for control plane communication.
+    # Currently, two providers are supported: "kubernetes" and "istiod".
+    # As some platforms may not have kubernetes signing APIs,
+    # Istiod is the default
+    pilotCertProvider: istiod
+
+    sds:
+      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
+      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
+      # JWT is intended for the CA.
+      token:
+        aud: istio-ca
+
+    sts:
+      # The service port used by Security Token Service (STS) server to handle token exchange requests.
+      # Setting this port to a non-zero value enables STS server.
+      servicePort: 0
+
+    # The name of the CA for workload certificates.
+    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
+    # will be used as the certificates for workloads.
+    # The default value is "" and when caName="", the CA will be configured by other
+    # mechanisms (e.g., environmental variable CA_PROVIDER).
+    caName: ""
+
+    waypoint:
+      # Resources for the waypoint proxy.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: "2"
+          memory: 1Gi
+
+      # If specified, affinity defines the scheduling constraints of waypoint pods.
+      affinity: {}
+
+      # Topology Spread Constraints for the waypoint proxy.
+      topologySpreadConstraints: []
+
+      # Node labels for the waypoint proxy.
+      nodeSelector: {}
+
+      # Tolerations for the waypoint proxy.
+      tolerations: []
+
+  base:
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  # Gateway Settings
+  gateways:
+    # Define the security context for the pod.
+    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+    securityContext: {}
+
+    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
+    seccompProfile: {}
+
+  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
+  # For example:
+  # gatewayClasses:
+  #   istio:
+  #     service:
+  #       spec:
+  #         type: ClusterIP
+  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
+  gatewayClasses: {}
diff --git a/resources/v1.26.1/charts/revisiontags/Chart.yaml b/resources/v1.26.1/charts/revisiontags/Chart.yaml
new file mode 100644
index 000000000..e1132f0c9
--- /dev/null
+++ b/resources/v1.26.1/charts/revisiontags/Chart.yaml
@@ -0,0 +1,8 @@
+apiVersion: v2
+appVersion: 1.26.1
+description: Helm chart for istio revision tags
+name: revisiontags
+sources:
+- https://github.com/istio-ecosystem/sail-operator
+version: 0.1.0
+
diff --git a/resources/v1.24.0/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.26.1/charts/revisiontags/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.0/charts/revisiontags/files/profile-ambient.yaml
rename to resources/v1.26.1/charts/revisiontags/files/profile-ambient.yaml
diff --git a/resources/v1.26.1/charts/revisiontags/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.1/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.1/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.1/charts/revisiontags/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.1/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.1/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.1/charts/revisiontags/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.1/charts/revisiontags/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.1/charts/revisiontags/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.1/charts/revisiontags/files/profile-demo.yaml b/resources/v1.26.1/charts/revisiontags/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.1/charts/revisiontags/files/profile-demo.yaml
rename to resources/v1.26.1/charts/revisiontags/files/profile-demo.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-gke.yaml b/resources/v1.26.1/charts/revisiontags/files/profile-platform-gke.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-gke.yaml
rename to resources/v1.26.1/charts/revisiontags/files/profile-platform-gke.yaml
diff --git a/resources/v1.24.0/charts/revisiontags/files/profile-platform-k3d.yaml b/resources/v1.26.1/charts/revisiontags/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.0/charts/revisiontags/files/profile-platform-k3d.yaml
rename to resources/v1.26.1/charts/revisiontags/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.1/charts/revisiontags/files/profile-platform-k3s.yaml b/resources/v1.26.1/charts/revisiontags/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.1/charts/revisiontags/files/profile-platform-k3s.yaml
rename to resources/v1.26.1/charts/revisiontags/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.0/charts/revisiontags/files/profile-platform-microk8s.yaml b/resources/v1.26.1/charts/revisiontags/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.0/charts/revisiontags/files/profile-platform-microk8s.yaml
rename to resources/v1.26.1/charts/revisiontags/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.0/charts/revisiontags/files/profile-platform-minikube.yaml b/resources/v1.26.1/charts/revisiontags/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.0/charts/revisiontags/files/profile-platform-minikube.yaml
rename to resources/v1.26.1/charts/revisiontags/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.0/charts/revisiontags/files/profile-platform-openshift.yaml b/resources/v1.26.1/charts/revisiontags/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.0/charts/revisiontags/files/profile-platform-openshift.yaml
rename to resources/v1.26.1/charts/revisiontags/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.0/charts/revisiontags/files/profile-preview.yaml b/resources/v1.26.1/charts/revisiontags/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.0/charts/revisiontags/files/profile-preview.yaml
rename to resources/v1.26.1/charts/revisiontags/files/profile-preview.yaml
diff --git a/resources/v1.24.0/charts/revisiontags/files/profile-remote.yaml b/resources/v1.26.1/charts/revisiontags/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.0/charts/revisiontags/files/profile-remote.yaml
rename to resources/v1.26.1/charts/revisiontags/files/profile-remote.yaml
diff --git a/resources/v1.24.0/charts/revisiontags/files/profile-stable.yaml b/resources/v1.26.1/charts/revisiontags/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.0/charts/revisiontags/files/profile-stable.yaml
rename to resources/v1.26.1/charts/revisiontags/files/profile-stable.yaml
diff --git a/resources/v1.26.1/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.26.1/charts/revisiontags/templates/revision-tags.yaml
new file mode 100644
index 000000000..e45b5e1d4
--- /dev/null
+++ b/resources/v1.26.1/charts/revisiontags/templates/revision-tags.yaml
@@ -0,0 +1,148 @@
+# Adapted from istio-discovery/templates/mutatingwebhook.yaml
+# Removed paths for legacy and default selectors since a revision tag
+# is inherently created from a specific revision
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- $whv := dict
+ "revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+{{- range $tagName := $.Values.revisionTags }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq $.Release.Namespace "istio-system"}}
+  name: istio-revision-tag-{{ $tagName }}
+{{- else }}
+  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/tag: {{ $tagName }}
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+
+{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
+{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
+{{- if (eq $tagName "default") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+---
+{{- end }}
diff --git a/resources/v1.25.2/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.26.1/charts/revisiontags/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.25.2/charts/revisiontags/templates/zzz_profile.yaml
rename to resources/v1.26.1/charts/revisiontags/templates/zzz_profile.yaml
diff --git a/resources/v1.26.1/charts/revisiontags/values.yaml b/resources/v1.26.1/charts/revisiontags/values.yaml
new file mode 100644
index 000000000..26e9a6161
--- /dev/null
+++ b/resources/v1.26.1/charts/revisiontags/values.yaml
@@ -0,0 +1,553 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  autoscaleBehavior: {}
+  replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+
+  hub: ""
+  tag: ""
+  variant: ""
+
+  # Can be a full hub/image:tag
+  image: pilot
+  traceSampling: 1.0
+
+  # Resources for a small pilot install
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2048Mi
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # Whether to use an existing CNI installation
+  cni:
+    enabled: false
+    provider: default
+
+  # Additional container arguments
+  extraContainerArgs: []
+
+  env: {}
+
+  envVarFrom: []
+
+  # Settings related to the untaint controller
+  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
+  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
+  taint:
+    # Controls whether or not the untaint controller is active
+    enabled: false
+    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
+    namespace: ""
+
+  affinity: {}
+
+  tolerations: []
+
+  cpu:
+    targetAverageUtilization: 80
+  memory: {}
+    # targetAverageUtilization: 80
+
+  # Additional volumeMounts to the istiod container
+  volumeMounts: []
+
+  # Additional volumes to the istiod pod
+  volumes: []
+
+  # Inject initContainers into the istiod pod
+  initContainers: []
+
+  nodeSelector: {}
+  podAnnotations: {}
+  serviceAnnotations: {}
+  serviceAccountAnnotations: {}
+  sidecarInjectorWebhookAnnotations: {}
+
+  topologySpreadConstraints: []
+
+  # You can use jwksResolverExtraRootCA to provide a root certificate
+  # in PEM format. This will then be trusted by pilot when resolving
+  # JWKS URIs.
+  jwksResolverExtraRootCA: ""
+
+  # The following is used to limit how long a sidecar can be connected
+  # to a pilot. It balances out load across pilot instances at the cost of
+  # increasing system churn.
+  keepaliveMaxServerConnectionAge: 30m
+
+  # Additional labels to apply to the deployment.
+  deploymentLabels: {}
+
+  ## Mesh config settings
+
+  # Install the mesh config map, generated from values.yaml.
+  # If false, pilot wil use default values (by default) or user-supplied values.
+  configMap: true
+
+  # Additional labels to apply on the pod level for monitoring and logging configuration.
+  podLabels: {}
+
+  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
+  ipFamilyPolicy: ""
+  ipFamilies: []
+
+  # Ambient mode only.
+  # Set this if you install ztunnel to a different namespace from `istiod`.
+  # If set, `istiod` will allow connections from trusted node proxy ztunnels
+  # in the provided namespace.
+  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
+  # in the same namespace as itself.
+  trustedZtunnelNamespace: ""
+  # Set this if you install ztunnel with a name different from the default.
+  trustedZtunnelName: ""
+
+  sidecarInjectorWebhook:
+    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
+    # always skip the injection on pods that match that label selector, regardless of the global policy.
+    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
+    neverInjectSelector: []
+    alwaysInjectSelector: []
+
+    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
+    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
+    #
+    # annotations:
+    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+    #
+    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
+    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
+    # injectedAnnotations:
+    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
+    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
+    injectedAnnotations: {}
+
+    # This enables injection of sidecar in all namespaces,
+    # with the exception of namespaces with "istio-injection:disabled" annotation
+    # Only one environment should have this enabled.
+    enableNamespacesByDefault: false
+
+    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
+    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
+    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
+    reinvocationPolicy: Never
+
+    rewriteAppHTTPProbe: true
+
+    # Templates defines a set of custom injection templates that can be used. For example, defining:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
+    # being injected with the hello=world labels.
+    # This is intended for advanced configuration only; most users should use the built in template
+    templates: {}
+
+    # Default templates specifies a set of default templates that are used in sidecar injection.
+    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
+    # To inject other additional templates, define it using the `templates` option, and add it to
+    # the default templates list.
+    # For example:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # defaultTemplates: ["sidecar", "hello"]
+    defaultTemplates: []
+  istiodRemote:
+    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
+    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
+    # to utilize a remote instance.
+    enabled: false
+    # Sidecar injector mutating webhook configuration clientConfig.url value.
+    # For example: https://$remotePilotAddress:15017/inject
+    # The host should not refer to a service running in the cluster; use a service reference by specifying
+    # the clientConfig.service field instead.
+    injectionURL: ""
+
+    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
+    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
+    injectionPath: "/inject"
+
+    injectionCABundle: ""
+  telemetry:
+    enabled: true
+    v2:
+      # For Null VM case now.
+      # This also enables metadata exchange.
+      enabled: true
+      # Indicate if prometheus stats filter is enabled or not
+      prometheus:
+        enabled: true
+      # stackdriver filter settings.
+      stackdriver:
+        enabled: false
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # Revision tags are aliases to Istio control plane revisions
+  revisionTags: []
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
+  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
+  meshConfig:
+    enablePrometheusMerge: true
+
+  experimental:
+    stableValidationPolicy: false
+
+  global:
+    # Used to locate istiod.
+    istioNamespace: istio-system
+    # List of cert-signers to allow "approve" action in the istio cluster role
+    #
+    # certSigners:
+    #   - clusterissuers.cert-manager.io/istio-ca
+    certSigners: []
+    # enable pod disruption budget for the control plane, which is used to
+    # ensure Istio control plane components are gradually upgraded or recovered.
+    defaultPodDisruptionBudget:
+      enabled: true
+      # The values aren't mutable due to a current PodDisruptionBudget limitation
+      # minAvailable: 1
+
+    # A minimal set of requested resources to applied to all deployments so that
+    # Horizontal Pod Autoscaler will be able to function (if set).
+    # Each component can overwrite these default values by adding its own resources
+    # block in the relevant section below and setting the desired resources values.
+    defaultResources:
+      requests:
+        cpu: 10m
+      #   memory: 128Mi
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+    # Default tag for Istio images.
+    tag: 1.26.1
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Enabled by default in master for maximising testing.
+    istiod:
+      enableAnalysis: false
+
+    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
+    logAsJson: false
+
+    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+    # The control plane has different scopes depending on component, but can configure default log level across all components
+    # If empty, default scope and level will be used as configured in code
+    logging:
+      level: "default:info"
+
+    omitSidecarInjectorConfigMap: false
+
+    # Configure whether Operator manages webhook configurations. The current behavior
+    # of Istiod is to manage its own webhook configurations.
+    # When this option is set as true, Istio Operator, instead of webhooks, manages the
+    # webhook configurations. When this option is set as false, webhooks manage their
+    # own webhook configurations.
+    operatorManageWebhooks: false
+
+    # Custom DNS config for the pod to resolve names of services in other
+    # clusters. Use this to add additional search domains, and other settings.
+    # see
+    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
+    # This does not apply to gateway pods as they typically need a different
+    # set of DNS settings than the normal application pods (e.g., in
+    # multicluster scenarios).
+    # NOTE: If using templates, follow the pattern in the commented example below.
+    #podDNSSearchNamespaces:
+    #- global
+    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
+
+    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
+    # system-node-critical, it is better to configure this in order to make sure your Istio pods
+    # will not be killed because of low priority class.
+    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+    # for more detail.
+    priorityClassName: ""
+
+    proxy:
+      image: proxyv2
+
+      # This controls the 'policy' in the sidecar injector.
+      autoInject: enabled
+
+      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
+      # cluster domain. Default value is "cluster.local".
+      clusterDomain: "cluster.local"
+
+      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
+      # not set, then the global "logLevel" will be used.
+      componentLogLevel: "misc:error"
+
+      # istio ingress capture allowlist
+      # examples:
+      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
+      excludeInboundPorts: ""
+      includeInboundPorts: "*"
+
+      # istio egress capture allowlist
+      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
+      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
+      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
+      # be allowed by the sidecar
+      includeIPRanges: "*"
+      excludeIPRanges: ""
+      includeOutboundPorts: ""
+      excludeOutboundPorts: ""
+
+      # Log level for proxy, applies to gateways and sidecars.
+      # Expected values are: trace|debug|info|warning|error|critical|off
+      logLevel: warning
+
+      # Specify the path to the outlier event log.
+      # Example: /dev/stdout
+      outlierLogPath: ""
+
+      #If set to true, istio-proxy container will have privileged securityContext
+      privileged: false
+
+      # The number of successive failed probes before indicating readiness failure.
+      readinessFailureThreshold: 4
+
+      # The initial delay for readiness probes in seconds.
+      readinessInitialDelaySeconds: 0
+
+      # The period between readiness probes.
+      readinessPeriodSeconds: 15
+
+      # Enables or disables a startup probe.
+      # For optimal startup times, changing this should be tied to the readiness probe values.
+      #
+      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
+      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
+      # and doesn't spam the readiness endpoint too much
+      #
+      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
+      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
+      startupProbe:
+        enabled: true
+        failureThreshold: 600 # 10 minutes
+
+      # Resources for the sidecar.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: 2000m
+          memory: 1024Mi
+
+      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
+      statusPort: 15020
+
+      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
+      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
+      tracer: "none"
+
+    proxy_init:
+      # Base name for the proxy_init container, used to configure iptables.
+      image: proxyv2
+      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
+      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
+      forceApplyIptables: false
+
+    # configure remote pilot and istiod service and endpoint
+    remotePilotAddress: ""
+
+    ##############################################################################################
+    # The following values are found in other charts. To effectively modify these values, make   #
+    # make sure they are consistent across your Istio helm charts                                #
+    ##############################################################################################
+
+    # The customized CA address to retrieve certificates for the pods in the cluster.
+    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+    # If not set explicitly, default to the Istio discovery address.
+    caAddress: ""
+
+    # Enable control of remote clusters.
+    externalIstiod: false
+
+    # Configure a remote cluster as the config cluster for an external istiod.
+    configCluster: false
+
+    # configValidation enables the validation webhook for Istio configuration.
+    configValidation: true
+
+    # Mesh ID means Mesh Identifier. It should be unique within the scope where
+    # meshes will interact with each other, but it is not required to be
+    # globally/universally unique. For example, if any of the following are true,
+    # then two meshes must have different Mesh IDs:
+    # - Meshes will have their telemetry aggregated in one place
+    # - Meshes will be federated together
+    # - Policy will be written referencing one mesh from the other
+    #
+    # If an administrator expects that any of these conditions may become true in
+    # the future, they should ensure their meshes have different Mesh IDs
+    # assigned.
+    #
+    # Within a multicluster mesh, each cluster must be (manually or auto)
+    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
+    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
+    # of migration TBD, and it may be a disruptive operation to change the Mesh
+    # ID post-install.
+    #
+    # If the mesh admin does not specify a value, Istio will use the value of the
+    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
+    # value.
+    meshID: ""
+
+    # Configure the mesh networks to be used by the Split Horizon EDS.
+    #
+    # The following example defines two networks with different endpoints association methods.
+    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
+    # mapped to network1. The gateway for this network example is specified by its public IP
+    # address and port.
+    # The second network, `network2`, in this example is defined differently with all endpoints
+    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
+    # gateway is also defined differently with the name of the gateway service on the remote
+    # cluster. The public IP for the gateway will be determined from that remote service (only
+    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
+    # it still need to be configured manually).
+    #
+    # meshNetworks:
+    #   network1:
+    #     endpoints:
+    #     - fromCidr: "192.168.0.1/24"
+    #     gateways:
+    #     - address: 1.1.1.1
+    #       port: 80
+    #   network2:
+    #     endpoints:
+    #     - fromRegistry: reg1
+    #     gateways:
+    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
+    #       port: 443
+    #
+    meshNetworks: {}
+
+    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
+    mountMtlsCerts: false
+
+    multiCluster:
+      # Set to true to connect two kubernetes clusters via their respective
+      # ingressgateway services when pods in each cluster cannot directly
+      # talk to one another. All clusters should be using Istio mTLS and must
+      # have a shared root CA for this model to work.
+      enabled: false
+      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
+      # to properly label proxies
+      clusterName: ""
+
+    # Network defines the network this cluster belong to. This name
+    # corresponds to the networks in the map of mesh networks.
+    network: ""
+
+    # Configure the certificate provider for control plane communication.
+    # Currently, two providers are supported: "kubernetes" and "istiod".
+    # As some platforms may not have kubernetes signing APIs,
+    # Istiod is the default
+    pilotCertProvider: istiod
+
+    sds:
+      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
+      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
+      # JWT is intended for the CA.
+      token:
+        aud: istio-ca
+
+    sts:
+      # The service port used by Security Token Service (STS) server to handle token exchange requests.
+      # Setting this port to a non-zero value enables STS server.
+      servicePort: 0
+
+    # The name of the CA for workload certificates.
+    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
+    # will be used as the certificates for workloads.
+    # The default value is "" and when caName="", the CA will be configured by other
+    # mechanisms (e.g., environmental variable CA_PROVIDER).
+    caName: ""
+
+    waypoint:
+      # Resources for the waypoint proxy.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: "2"
+          memory: 1Gi
+
+      # If specified, affinity defines the scheduling constraints of waypoint pods.
+      affinity: {}
+
+      # Topology Spread Constraints for the waypoint proxy.
+      topologySpreadConstraints: []
+
+      # Node labels for the waypoint proxy.
+      nodeSelector: {}
+
+      # Tolerations for the waypoint proxy.
+      tolerations: []
+
+  base:
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  # Gateway Settings
+  gateways:
+    # Define the security context for the pod.
+    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+    securityContext: {}
+
+    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
+    seccompProfile: {}
+
+  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
+  # For example:
+  # gatewayClasses:
+  #   istio:
+  #     service:
+  #       spec:
+  #         type: ClusterIP
+  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
+  gatewayClasses: {}
diff --git a/resources/v1.26.1/charts/ztunnel/Chart.yaml b/resources/v1.26.1/charts/ztunnel/Chart.yaml
new file mode 100644
index 000000000..8b477b07b
--- /dev/null
+++ b/resources/v1.26.1/charts/ztunnel/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+appVersion: 1.26.1
+description: Helm chart for istio ztunnel components
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio-ztunnel
+- istio
+name: ztunnel
+sources:
+- https://github.com/istio/istio
+version: 1.26.1
diff --git a/resources/v1.24.0/charts/ztunnel/README.md b/resources/v1.26.1/charts/ztunnel/README.md
similarity index 100%
rename from resources/v1.24.0/charts/ztunnel/README.md
rename to resources/v1.26.1/charts/ztunnel/README.md
diff --git a/resources/v1.24.0/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.26.1/charts/ztunnel/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.0/charts/ztunnel/files/profile-ambient.yaml
rename to resources/v1.26.1/charts/ztunnel/files/profile-ambient.yaml
diff --git a/resources/v1.26.1/charts/ztunnel/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.1/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.1/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.1/charts/ztunnel/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.1/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.1/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.1/charts/ztunnel/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.1/charts/ztunnel/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.1/charts/ztunnel/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.1/charts/ztunnel/files/profile-demo.yaml b/resources/v1.26.1/charts/ztunnel/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.1/charts/ztunnel/files/profile-demo.yaml
rename to resources/v1.26.1/charts/ztunnel/files/profile-demo.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-gke.yaml b/resources/v1.26.1/charts/ztunnel/files/profile-platform-gke.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-gke.yaml
rename to resources/v1.26.1/charts/ztunnel/files/profile-platform-gke.yaml
diff --git a/resources/v1.24.0/charts/ztunnel/files/profile-platform-k3d.yaml b/resources/v1.26.1/charts/ztunnel/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.0/charts/ztunnel/files/profile-platform-k3d.yaml
rename to resources/v1.26.1/charts/ztunnel/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.1/charts/ztunnel/files/profile-platform-k3s.yaml b/resources/v1.26.1/charts/ztunnel/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.1/charts/ztunnel/files/profile-platform-k3s.yaml
rename to resources/v1.26.1/charts/ztunnel/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.0/charts/ztunnel/files/profile-platform-microk8s.yaml b/resources/v1.26.1/charts/ztunnel/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.0/charts/ztunnel/files/profile-platform-microk8s.yaml
rename to resources/v1.26.1/charts/ztunnel/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.0/charts/ztunnel/files/profile-platform-minikube.yaml b/resources/v1.26.1/charts/ztunnel/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.0/charts/ztunnel/files/profile-platform-minikube.yaml
rename to resources/v1.26.1/charts/ztunnel/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.0/charts/ztunnel/files/profile-platform-openshift.yaml b/resources/v1.26.1/charts/ztunnel/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.0/charts/ztunnel/files/profile-platform-openshift.yaml
rename to resources/v1.26.1/charts/ztunnel/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.0/charts/ztunnel/files/profile-preview.yaml b/resources/v1.26.1/charts/ztunnel/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.0/charts/ztunnel/files/profile-preview.yaml
rename to resources/v1.26.1/charts/ztunnel/files/profile-preview.yaml
diff --git a/resources/v1.24.0/charts/ztunnel/files/profile-remote.yaml b/resources/v1.26.1/charts/ztunnel/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.0/charts/ztunnel/files/profile-remote.yaml
rename to resources/v1.26.1/charts/ztunnel/files/profile-remote.yaml
diff --git a/resources/v1.24.0/charts/ztunnel/files/profile-stable.yaml b/resources/v1.26.1/charts/ztunnel/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.0/charts/ztunnel/files/profile-stable.yaml
rename to resources/v1.26.1/charts/ztunnel/files/profile-stable.yaml
diff --git a/resources/v1.24.0/charts/ztunnel/templates/NOTES.txt b/resources/v1.26.1/charts/ztunnel/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.0/charts/ztunnel/templates/NOTES.txt
rename to resources/v1.26.1/charts/ztunnel/templates/NOTES.txt
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/templates/_helpers.tpl b/resources/v1.26.1/charts/ztunnel/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/ztunnel/templates/_helpers.tpl
rename to resources/v1.26.1/charts/ztunnel/templates/_helpers.tpl
diff --git a/resources/v1.26.1/charts/ztunnel/templates/daemonset.yaml b/resources/v1.26.1/charts/ztunnel/templates/daemonset.yaml
new file mode 100644
index 000000000..720970c97
--- /dev/null
+++ b/resources/v1.26.1/charts/ztunnel/templates/daemonset.yaml
@@ -0,0 +1,205 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
+  annotations:
+{{- if .Values.revision }}
+    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
+    {{- toYaml $annos | nindent 4}}
+{{- else }}
+    {{- .Values.annotations | toYaml | nindent 4 }}
+{{- end }}
+spec:
+  {{- with .Values.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app: ztunnel
+  template:
+    metadata:
+      labels:
+        sidecar.istio.io/inject: "false"
+        istio.io/dataplane-mode: none
+        app: ztunnel
+        app.kubernetes.io/name: ztunnel
+        {{- include "istio.labels" . | nindent 8}}
+{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+{{- if .Values.revision }}
+        istio.io/rev: {{ .Values.revision }}
+{{- end }}
+{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
+    spec:
+      nodeSelector:
+        kubernetes.io/os: linux
+{{- if .Values.nodeSelector }}
+{{ toYaml .Values.nodeSelector | indent 8 }}
+{{- end }}
+{{- if .Values.affinity }}
+      affinity:
+{{ toYaml .Values.affinity | trim | indent 8 }}
+{{- end }}
+      serviceAccountName: {{ include "ztunnel.release-name" . }}
+      tolerations:
+        - effect: NoSchedule
+          operator: Exists
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - effect: NoExecute
+          operator: Exists
+      containers:
+      - name: istio-proxy
+{{- if contains "/" .Values.image }}
+        image: "{{ .Values.image }}"
+{{- else }}
+        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
+{{- end }}
+        ports:
+        - containerPort: 15020
+          name: ztunnel-stats
+          protocol: TCP
+        resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 10 }}
+{{- end }}
+{{- with .Values.imagePullPolicy }}
+        imagePullPolicy: {{ . }}
+{{- end }}
+        securityContext:
+          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
+          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
+          allowPrivilegeEscalation: true
+          privileged: false
+          capabilities:
+            drop:
+            - ALL
+            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
+            - NET_ADMIN # Required for TPROXY and setsockopt
+            - SYS_ADMIN # Required for `setns` - doing things in other netns
+            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
+          readOnlyRootFilesystem: true
+          runAsGroup: 1337
+          runAsNonRoot: false
+          runAsUser: 0
+{{- if .Values.seLinuxOptions }}
+          seLinuxOptions:
+{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
+{{- end }}
+        readinessProbe:
+          httpGet:
+            port: 15021
+            path: /healthz/ready
+        args:
+        - proxy
+        - ztunnel
+        env:
+        - name: CA_ADDRESS
+        {{- if .Values.caAddress }}
+          value: {{ .Values.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: XDS_ADDRESS
+        {{- if .Values.xdsAddress }}
+          value: {{ .Values.xdsAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
+        {{- end }}
+        {{- if .Values.logAsJson }}
+        - name: LOG_FORMAT
+          value: json
+        {{- end}}
+        - name: RUST_LOG
+          value: {{ .Values.logLevel | quote }}
+        - name: RUST_BACKTRACE
+          value: "1"
+        - name: ISTIO_META_CLUSTER_ID
+          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
+        - name: INPOD_ENABLED
+          value: "true"
+        - name: TERMINATION_GRACE_PERIOD_SECONDS
+          value: "{{ .Values.terminationGracePeriodSeconds }}"
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
+        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- end }}
+        {{- with .Values.env }}
+        {{- range $key, $val := . }}
+        - name: {{ $key }}
+          value: "{{ $val }}"
+        {{- end }}
+        {{- end }}
+        volumeMounts:
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - mountPath: /var/run/ztunnel
+          name: cni-ztunnel-sock-dir
+        - mountPath: /tmp
+          name: tmp
+        {{- with .Values.volumeMounts }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+      priorityClassName: system-node-critical
+      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
+      volumes:
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: istio-token
+              expirationSeconds: 43200
+              audience: istio-ca
+      - name: istiod-ca-cert
+        {{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:root-cert
+              path: root-cert.pem
+        {{- else }}
+        configMap:
+          name: istio-ca-root-cert
+        {{- end }}
+      - name: cni-ztunnel-sock-dir
+        hostPath:
+          path: /var/run/ztunnel
+          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
+      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
+      - name: tmp
+        emptyDir: {}
+      {{- with .Values.volumes }}
+        {{- toYaml . | nindent 6}}
+      {{- end }}
diff --git a/resources/v1.25.1/charts/ztunnel/templates/rbac.yaml b/resources/v1.26.1/charts/ztunnel/templates/rbac.yaml
similarity index 100%
rename from resources/v1.25.1/charts/ztunnel/templates/rbac.yaml
rename to resources/v1.26.1/charts/ztunnel/templates/rbac.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/templates/resourcequota.yaml b/resources/v1.26.1/charts/ztunnel/templates/resourcequota.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/ztunnel/templates/resourcequota.yaml
rename to resources/v1.26.1/charts/ztunnel/templates/resourcequota.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.26.1/charts/ztunnel/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/ztunnel/templates/zzz_profile.yaml
rename to resources/v1.26.1/charts/ztunnel/templates/zzz_profile.yaml
diff --git a/resources/v1.26.1/charts/ztunnel/values.yaml b/resources/v1.26.1/charts/ztunnel/values.yaml
new file mode 100644
index 000000000..1b4bc2649
--- /dev/null
+++ b/resources/v1.26.1/charts/ztunnel/values.yaml
@@ -0,0 +1,114 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
+  hub: gcr.io/istio-release
+  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
+  tag: 1.26.1
+  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
+  variant: ""
+
+  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
+  # If Image contains a "/", it will replace the entire `image` in the pod.
+  image: ztunnel
+
+  # resourceName, if set, will override the naming of resources. If not set, will default to 'ztunnel'.
+  # If you set this, you MUST also set `trustedZtunnelName` in the `istiod` chart.
+  resourceName: ""
+
+  # Labels to apply to all top level resources
+  labels: {}
+  # Annotations to apply to all top level resources
+  annotations: {}
+
+  # Additional volumeMounts to the ztunnel container
+  volumeMounts: []
+
+  # Additional volumes to the ztunnel pod
+  volumes: []
+
+  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
+  podAnnotations:
+    prometheus.io/port: "15020"
+    prometheus.io/scrape: "true"
+
+  # Additional labels to apply on the pod level
+  podLabels: {}
+
+  # Pod resource configuration
+  resources:
+    requests:
+      cpu: 200m
+      # Ztunnel memory scales with the size of the cluster and traffic load
+      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
+      memory: 512Mi
+
+  resourceQuotas:
+    enabled: false
+    pods: 5000
+
+  # List of secret names to add to the service account as image pull secrets
+  imagePullSecrets: []
+
+  # A `key: value` mapping of environment variables to add to the pod
+  env: {}
+
+  # Override for the pod imagePullPolicy
+  imagePullPolicy: ""
+
+  # Settings for multicluster
+  multiCluster:
+    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
+    # with Istiod configuration.
+    clusterName: ""
+
+  # meshConfig defines runtime configuration of components.
+  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
+  # components.
+  # TODO: https://github.com/istio/istio/issues/43248
+  meshConfig:
+    defaultConfig:
+      proxyMetadata: {}
+
+  # This value defines:
+  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
+  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
+  # Default K8S value is 30 seconds
+  terminationGracePeriodSeconds: 30
+
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
+  revision: ""
+
+  # The customized CA address to retrieve certificates for the pods in the cluster.
+  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+  caAddress: ""
+
+  # The customized XDS address to retrieve configuration.
+  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
+  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
+  xdsAddress: ""
+
+  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
+  istioNamespace: istio-system
+
+  # Configuration log level of ztunnel binary, default is info.
+  # Valid values are: trace, debug, info, warn, error
+  logLevel: info
+
+  # To output all logs in json format
+  logAsJson: false
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seLinuxOptions: {}
+  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
+  #seLinuxOptions:
+  #  type: spc_t
+
+  # K8s DaemonSet update strategy.
+  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
diff --git a/resources/v1.26.1/cni-1.26.1.tgz.etag b/resources/v1.26.1/cni-1.26.1.tgz.etag
new file mode 100644
index 000000000..58fb81d69
--- /dev/null
+++ b/resources/v1.26.1/cni-1.26.1.tgz.etag
@@ -0,0 +1 @@
+b368282dc9937bbb53abfe4fd6773d31
diff --git a/resources/v1.26.1/commit b/resources/v1.26.1/commit
new file mode 100644
index 000000000..dd43a143f
--- /dev/null
+++ b/resources/v1.26.1/commit
@@ -0,0 +1 @@
+1.26.1
diff --git a/resources/v1.26.1/gateway-1.26.1.tgz.etag b/resources/v1.26.1/gateway-1.26.1.tgz.etag
new file mode 100644
index 000000000..a5d01e4be
--- /dev/null
+++ b/resources/v1.26.1/gateway-1.26.1.tgz.etag
@@ -0,0 +1 @@
+ca64d856f14a167134131f4b77c9e721
diff --git a/resources/v1.26.1/istiod-1.26.1.tgz.etag b/resources/v1.26.1/istiod-1.26.1.tgz.etag
new file mode 100644
index 000000000..6e1e63ef2
--- /dev/null
+++ b/resources/v1.26.1/istiod-1.26.1.tgz.etag
@@ -0,0 +1 @@
+009e19296fd4240900197ced8120a8d9
diff --git a/resources/v1.24.0/profiles/ambient.yaml b/resources/v1.26.1/profiles/ambient.yaml
similarity index 100%
rename from resources/v1.24.0/profiles/ambient.yaml
rename to resources/v1.26.1/profiles/ambient.yaml
diff --git a/resources/v1.25.1/profiles/default.yaml b/resources/v1.26.1/profiles/default.yaml
similarity index 100%
rename from resources/v1.25.1/profiles/default.yaml
rename to resources/v1.26.1/profiles/default.yaml
diff --git a/resources/v1.24.0/profiles/demo.yaml b/resources/v1.26.1/profiles/demo.yaml
similarity index 100%
rename from resources/v1.24.0/profiles/demo.yaml
rename to resources/v1.26.1/profiles/demo.yaml
diff --git a/resources/v1.24.0/profiles/empty.yaml b/resources/v1.26.1/profiles/empty.yaml
similarity index 100%
rename from resources/v1.24.0/profiles/empty.yaml
rename to resources/v1.26.1/profiles/empty.yaml
diff --git a/resources/v1.24.0/profiles/openshift-ambient.yaml b/resources/v1.26.1/profiles/openshift-ambient.yaml
similarity index 100%
rename from resources/v1.24.0/profiles/openshift-ambient.yaml
rename to resources/v1.26.1/profiles/openshift-ambient.yaml
diff --git a/resources/v1.24.0/profiles/openshift.yaml b/resources/v1.26.1/profiles/openshift.yaml
similarity index 100%
rename from resources/v1.24.0/profiles/openshift.yaml
rename to resources/v1.26.1/profiles/openshift.yaml
diff --git a/resources/v1.24.0/profiles/preview.yaml b/resources/v1.26.1/profiles/preview.yaml
similarity index 100%
rename from resources/v1.24.0/profiles/preview.yaml
rename to resources/v1.26.1/profiles/preview.yaml
diff --git a/resources/v1.24.0/profiles/remote.yaml b/resources/v1.26.1/profiles/remote.yaml
similarity index 100%
rename from resources/v1.24.0/profiles/remote.yaml
rename to resources/v1.26.1/profiles/remote.yaml
diff --git a/resources/v1.24.0/profiles/stable.yaml b/resources/v1.26.1/profiles/stable.yaml
similarity index 100%
rename from resources/v1.24.0/profiles/stable.yaml
rename to resources/v1.26.1/profiles/stable.yaml
diff --git a/resources/v1.26.1/ztunnel-1.26.1.tgz.etag b/resources/v1.26.1/ztunnel-1.26.1.tgz.etag
new file mode 100644
index 000000000..350ee60c0
--- /dev/null
+++ b/resources/v1.26.1/ztunnel-1.26.1.tgz.etag
@@ -0,0 +1 @@
+aa522bf4a1e9c534278742aaeedcf471
diff --git a/resources/v1.26.5/base-1.26.5.tgz.etag b/resources/v1.26.5/base-1.26.5.tgz.etag
new file mode 100644
index 000000000..6bc870cf4
--- /dev/null
+++ b/resources/v1.26.5/base-1.26.5.tgz.etag
@@ -0,0 +1 @@
+e77f6c5082814d6a622ac83c01dc0b4f
diff --git a/resources/v1.26.5/charts/base/Chart.yaml b/resources/v1.26.5/charts/base/Chart.yaml
new file mode 100644
index 000000000..b642690bd
--- /dev/null
+++ b/resources/v1.26.5/charts/base/Chart.yaml
@@ -0,0 +1,10 @@
+apiVersion: v2
+appVersion: 1.26.5
+description: Helm chart for deploying Istio cluster resources and CRDs
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+name: base
+sources:
+- https://github.com/istio/istio
+version: 1.26.5
diff --git a/resources/v1.24.1/charts/base/README.md b/resources/v1.26.5/charts/base/README.md
similarity index 100%
rename from resources/v1.24.1/charts/base/README.md
rename to resources/v1.26.5/charts/base/README.md
diff --git a/resources/v1.24.1/charts/base/files/profile-ambient.yaml b/resources/v1.26.5/charts/base/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.1/charts/base/files/profile-ambient.yaml
rename to resources/v1.26.5/charts/base/files/profile-ambient.yaml
diff --git a/resources/v1.26.5/charts/base/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.5/charts/base/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.5/charts/base/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.5/charts/base/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.5/charts/base/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.5/charts/base/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.5/charts/base/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.5/charts/base/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.5/charts/base/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.2/charts/base/files/profile-demo.yaml b/resources/v1.26.5/charts/base/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.2/charts/base/files/profile-demo.yaml
rename to resources/v1.26.5/charts/base/files/profile-demo.yaml
diff --git a/resources/v1.26.5/charts/base/files/profile-platform-gke.yaml b/resources/v1.26.5/charts/base/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.26.5/charts/base/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.1/charts/base/files/profile-platform-k3d.yaml b/resources/v1.26.5/charts/base/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.1/charts/base/files/profile-platform-k3d.yaml
rename to resources/v1.26.5/charts/base/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.2/charts/base/files/profile-platform-k3s.yaml b/resources/v1.26.5/charts/base/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.2/charts/base/files/profile-platform-k3s.yaml
rename to resources/v1.26.5/charts/base/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.1/charts/base/files/profile-platform-microk8s.yaml b/resources/v1.26.5/charts/base/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.1/charts/base/files/profile-platform-microk8s.yaml
rename to resources/v1.26.5/charts/base/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.1/charts/base/files/profile-platform-minikube.yaml b/resources/v1.26.5/charts/base/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.1/charts/base/files/profile-platform-minikube.yaml
rename to resources/v1.26.5/charts/base/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.1/charts/base/files/profile-platform-openshift.yaml b/resources/v1.26.5/charts/base/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.1/charts/base/files/profile-platform-openshift.yaml
rename to resources/v1.26.5/charts/base/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.1/charts/base/files/profile-preview.yaml b/resources/v1.26.5/charts/base/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.1/charts/base/files/profile-preview.yaml
rename to resources/v1.26.5/charts/base/files/profile-preview.yaml
diff --git a/resources/v1.24.1/charts/base/files/profile-remote.yaml b/resources/v1.26.5/charts/base/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.1/charts/base/files/profile-remote.yaml
rename to resources/v1.26.5/charts/base/files/profile-remote.yaml
diff --git a/resources/v1.24.1/charts/base/files/profile-stable.yaml b/resources/v1.26.5/charts/base/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.1/charts/base/files/profile-stable.yaml
rename to resources/v1.26.5/charts/base/files/profile-stable.yaml
diff --git a/resources/v1.24.1/charts/base/templates/NOTES.txt b/resources/v1.26.5/charts/base/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.1/charts/base/templates/NOTES.txt
rename to resources/v1.26.5/charts/base/templates/NOTES.txt
diff --git a/resources/v1.24.1/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml b/resources/v1.26.5/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
similarity index 100%
rename from resources/v1.24.1/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
rename to resources/v1.26.5/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
diff --git a/resources/v1.24.1/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml b/resources/v1.26.5/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
similarity index 100%
rename from resources/v1.24.1/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
rename to resources/v1.26.5/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
diff --git a/resources/v1.24.1/charts/base/templates/reader-serviceaccount.yaml b/resources/v1.26.5/charts/base/templates/reader-serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.1/charts/base/templates/reader-serviceaccount.yaml
rename to resources/v1.26.5/charts/base/templates/reader-serviceaccount.yaml
diff --git a/resources/v1.25.3/charts/istiod/templates/zzz_profile.yaml b/resources/v1.26.5/charts/base/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.25.3/charts/istiod/templates/zzz_profile.yaml
rename to resources/v1.26.5/charts/base/templates/zzz_profile.yaml
diff --git a/resources/v1.25.2/charts/base/values.yaml b/resources/v1.26.5/charts/base/values.yaml
similarity index 100%
rename from resources/v1.25.2/charts/base/values.yaml
rename to resources/v1.26.5/charts/base/values.yaml
diff --git a/resources/v1.26.5/charts/cni/Chart.yaml b/resources/v1.26.5/charts/cni/Chart.yaml
new file mode 100644
index 000000000..f610e99a8
--- /dev/null
+++ b/resources/v1.26.5/charts/cni/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+appVersion: 1.26.5
+description: Helm chart for istio-cni components
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio-cni
+- istio
+name: cni
+sources:
+- https://github.com/istio/istio
+version: 1.26.5
diff --git a/resources/v1.24.1/charts/cni/README.md b/resources/v1.26.5/charts/cni/README.md
similarity index 100%
rename from resources/v1.24.1/charts/cni/README.md
rename to resources/v1.26.5/charts/cni/README.md
diff --git a/resources/v1.24.1/charts/cni/files/profile-ambient.yaml b/resources/v1.26.5/charts/cni/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.1/charts/cni/files/profile-ambient.yaml
rename to resources/v1.26.5/charts/cni/files/profile-ambient.yaml
diff --git a/resources/v1.26.5/charts/cni/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.5/charts/cni/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.5/charts/cni/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.5/charts/cni/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.5/charts/cni/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.5/charts/cni/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.5/charts/cni/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.5/charts/cni/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.5/charts/cni/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.2/charts/cni/files/profile-demo.yaml b/resources/v1.26.5/charts/cni/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.2/charts/cni/files/profile-demo.yaml
rename to resources/v1.26.5/charts/cni/files/profile-demo.yaml
diff --git a/resources/v1.26.5/charts/cni/files/profile-platform-gke.yaml b/resources/v1.26.5/charts/cni/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.26.5/charts/cni/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.1/charts/cni/files/profile-platform-k3d.yaml b/resources/v1.26.5/charts/cni/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.1/charts/cni/files/profile-platform-k3d.yaml
rename to resources/v1.26.5/charts/cni/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.2/charts/cni/files/profile-platform-k3s.yaml b/resources/v1.26.5/charts/cni/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.2/charts/cni/files/profile-platform-k3s.yaml
rename to resources/v1.26.5/charts/cni/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.1/charts/cni/files/profile-platform-microk8s.yaml b/resources/v1.26.5/charts/cni/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.1/charts/cni/files/profile-platform-microk8s.yaml
rename to resources/v1.26.5/charts/cni/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.1/charts/cni/files/profile-platform-minikube.yaml b/resources/v1.26.5/charts/cni/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.1/charts/cni/files/profile-platform-minikube.yaml
rename to resources/v1.26.5/charts/cni/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.1/charts/cni/files/profile-platform-openshift.yaml b/resources/v1.26.5/charts/cni/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.1/charts/cni/files/profile-platform-openshift.yaml
rename to resources/v1.26.5/charts/cni/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.1/charts/cni/files/profile-preview.yaml b/resources/v1.26.5/charts/cni/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.1/charts/cni/files/profile-preview.yaml
rename to resources/v1.26.5/charts/cni/files/profile-preview.yaml
diff --git a/resources/v1.24.1/charts/cni/files/profile-remote.yaml b/resources/v1.26.5/charts/cni/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.1/charts/cni/files/profile-remote.yaml
rename to resources/v1.26.5/charts/cni/files/profile-remote.yaml
diff --git a/resources/v1.24.1/charts/cni/files/profile-stable.yaml b/resources/v1.26.5/charts/cni/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.1/charts/cni/files/profile-stable.yaml
rename to resources/v1.26.5/charts/cni/files/profile-stable.yaml
diff --git a/resources/v1.24.1/charts/cni/templates/NOTES.txt b/resources/v1.26.5/charts/cni/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.1/charts/cni/templates/NOTES.txt
rename to resources/v1.26.5/charts/cni/templates/NOTES.txt
diff --git a/resources/v1.24.1/charts/cni/templates/_helpers.tpl b/resources/v1.26.5/charts/cni/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.1/charts/cni/templates/_helpers.tpl
rename to resources/v1.26.5/charts/cni/templates/_helpers.tpl
diff --git a/resources/v1.25.2/charts/cni/templates/clusterrole.yaml b/resources/v1.26.5/charts/cni/templates/clusterrole.yaml
similarity index 100%
rename from resources/v1.25.2/charts/cni/templates/clusterrole.yaml
rename to resources/v1.26.5/charts/cni/templates/clusterrole.yaml
diff --git a/resources/v1.24.1/charts/cni/templates/clusterrolebinding.yaml b/resources/v1.26.5/charts/cni/templates/clusterrolebinding.yaml
similarity index 100%
rename from resources/v1.24.1/charts/cni/templates/clusterrolebinding.yaml
rename to resources/v1.26.5/charts/cni/templates/clusterrolebinding.yaml
diff --git a/resources/v1.25.3/charts/cni/templates/configmap-cni.yaml b/resources/v1.26.5/charts/cni/templates/configmap-cni.yaml
similarity index 100%
rename from resources/v1.25.3/charts/cni/templates/configmap-cni.yaml
rename to resources/v1.26.5/charts/cni/templates/configmap-cni.yaml
diff --git a/resources/v1.26.5/charts/cni/templates/daemonset.yaml b/resources/v1.26.5/charts/cni/templates/daemonset.yaml
new file mode 100644
index 000000000..cdccd3654
--- /dev/null
+++ b/resources/v1.26.5/charts/cni/templates/daemonset.yaml
@@ -0,0 +1,245 @@
+# This manifest installs the Istio install-cni container, as well
+# as the Istio CNI plugin and config on
+# each master and worker node in a Kubernetes cluster.
+#
+# $detectedBinDir exists to support a GKE-specific platform override,
+# and is deprecated in favor of using the explicit `gke` platform profile.
+{{- $detectedBinDir := (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
+    "/home/kubernetes/bin"
+    "/opt/cni/bin"
+}}
+{{- if .Values.cniBinDir }}
+{{ $detectedBinDir = .Values.cniBinDir }}
+{{- end }}
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  # Note that this is templated but evaluates to a fixed name
+  # which the CNI plugin may fall back onto in some failsafe scenarios.
+  # if this name is changed, CNI plugin logic that checks for this name
+  # format should also be updated.
+  name: {{ template "name" . }}-node
+  namespace: {{ .Release.Namespace }}
+  labels:
+    k8s-app: {{ template "name" . }}-node
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      k8s-app: {{ template "name" . }}-node
+  {{- with .Values.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  template:
+    metadata:
+      labels:
+        k8s-app: {{ template "name" . }}-node
+        sidecar.istio.io/inject: "false"
+        istio.io/dataplane-mode: none
+        app.kubernetes.io/name: {{ template "name" . }}
+        {{- include "istio.labels" . | nindent 8 }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+        # Add Prometheus Scrape annotations
+        prometheus.io/scrape: 'true'
+        prometheus.io/port: "15014"
+        prometheus.io/path: '/metrics'
+        # Add AppArmor annotation
+        # This is required to avoid conflicts with AppArmor profiles which block certain
+        # privileged pod capabilities.
+        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
+        # securityContext which is otherwise preferred.
+        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
+        # Custom annotations
+        {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+        {{- end }}
+    spec:
+{{- if and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace }}
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+{{- end }}
+      nodeSelector:
+        kubernetes.io/os: linux
+      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      tolerations:
+        # Make sure istio-cni-node gets scheduled on all nodes.
+        - effect: NoSchedule
+          operator: Exists
+        # Mark the pod as a critical add-on for rescheduling.
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - effect: NoExecute
+          operator: Exists
+      priorityClassName: system-node-critical
+      serviceAccountName: {{ template "name" . }}
+      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
+      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
+      terminationGracePeriodSeconds: 5
+      containers:
+        # This container installs the Istio CNI binaries
+        # and CNI network config file on each node.
+        - name: install-cni
+{{- if contains "/" .Values.image }}
+          image: "{{ .Values.image }}"
+{{- else }}
+          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
+{{- end }}
+{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
+          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
+{{- end }}
+          ports:
+          - containerPort: 15014
+            name: metrics
+            protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8000
+          securityContext:
+            privileged: false
+            runAsGroup: 0
+            runAsUser: 0
+            runAsNonRoot: false
+            # Both ambient and sidecar repair mode require elevated node privileges to function.
+            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
+            # add capabilities based on feature.
+            capabilities:
+              drop:
+              - ALL
+              add:
+              # CAP_NET_ADMIN is required to allow ipset and route table access
+              - NET_ADMIN
+              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
+              - NET_RAW
+              # CAP_SYS_PTRACE is required for repair and ambient mode to describe
+              # the pod's network namespace.
+              - SYS_PTRACE
+              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
+              # network namespaces in `/proc` to obtain descriptors for entering pod network
+              # namespaces. There does not appear to be a more granular capability for this.
+              - SYS_ADMIN
+              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
+              # the typical ability to read/write to folders owned by others.
+              # This can cause problems if the hostPath mounts we use, which we require write access into,
+              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
+              - DAC_OVERRIDE
+{{- if .Values.seLinuxOptions }}
+{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
+            seLinuxOptions:
+{{ toYaml . | trim | indent 14 }}
+{{- end }}
+{{- end }}
+{{- if .Values.seccompProfile }}
+            seccompProfile:
+{{ toYaml .Values.seccompProfile | trim | indent 14 }}
+{{- end }}
+          command: ["install-cni"]
+          args:
+            {{- if or .Values.logging.level .Values.global.logging.level }}
+            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
+            {{- end}}
+            {{- if .Values.global.logAsJson }}
+            - --log_as_json
+            {{- end}}
+          envFrom:
+            - configMapRef:
+                name: {{ template "name" . }}-config
+          env:
+            - name: REPAIR_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: REPAIR_RUN_AS_DAEMON
+              value: "true"
+            - name: REPAIR_SIDECAR_ANNOTATION
+              value: "sidecar.istio.io/status"
+            {{- if not (and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace) }}
+            - name: ALLOW_SWITCH_TO_HOST_NS
+              value: "true"
+            {{- end }}
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+            - name: GOMEMLIMIT
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.memory
+            - name: GOMAXPROCS
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.cpu
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+          volumeMounts:
+            - mountPath: /host/opt/cni/bin
+              name: cni-bin-dir
+            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
+            - mountPath: /host/proc
+              name: cni-host-procfs
+              readOnly: true
+            {{- end }}
+            - mountPath: /host/etc/cni/net.d
+              name: cni-net-dir
+            - mountPath: /var/run/istio-cni
+              name: cni-socket-dir
+            {{- if .Values.ambient.enabled }}
+            - mountPath: /host/var/run/netns
+              mountPropagation: HostToContainer
+              name: cni-netns-dir
+            - mountPath: /var/run/ztunnel
+              name: cni-ztunnel-sock-dir
+            {{ end }}
+          resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 12 }}
+{{- else }}
+{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
+{{- end }}
+      volumes:
+        # Used to install CNI.
+        - name: cni-bin-dir
+          hostPath:
+            path: {{ $detectedBinDir }}
+        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
+        - name: cni-host-procfs
+          hostPath:
+            path: /proc
+            type: Directory
+        {{- end }}
+        {{- if .Values.ambient.enabled }}
+        - name: cni-ztunnel-sock-dir
+          hostPath:
+            path: /var/run/ztunnel
+            type: DirectoryOrCreate
+        {{- end }}
+        - name: cni-net-dir
+          hostPath:
+            path: {{ .Values.cniConfDir }}
+        # Used for UDS sockets for logging, ambient eventing
+        - name: cni-socket-dir
+          hostPath:
+            path: /var/run/istio-cni
+        - name: cni-netns-dir
+          hostPath:
+            path: {{ .Values.cniNetnsDir }}
+            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
+            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
+            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.24.1/charts/cni/templates/network-attachment-definition.yaml b/resources/v1.26.5/charts/cni/templates/network-attachment-definition.yaml
similarity index 100%
rename from resources/v1.24.1/charts/cni/templates/network-attachment-definition.yaml
rename to resources/v1.26.5/charts/cni/templates/network-attachment-definition.yaml
diff --git a/resources/v1.24.1/charts/cni/templates/resourcequota.yaml b/resources/v1.26.5/charts/cni/templates/resourcequota.yaml
similarity index 100%
rename from resources/v1.24.1/charts/cni/templates/resourcequota.yaml
rename to resources/v1.26.5/charts/cni/templates/resourcequota.yaml
diff --git a/resources/v1.24.1/charts/cni/templates/serviceaccount.yaml b/resources/v1.26.5/charts/cni/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.1/charts/cni/templates/serviceaccount.yaml
rename to resources/v1.26.5/charts/cni/templates/serviceaccount.yaml
diff --git a/resources/v1.24.1/charts/cni/templates/zzy_descope_legacy.yaml b/resources/v1.26.5/charts/cni/templates/zzy_descope_legacy.yaml
similarity index 100%
rename from resources/v1.24.1/charts/cni/templates/zzy_descope_legacy.yaml
rename to resources/v1.26.5/charts/cni/templates/zzy_descope_legacy.yaml
diff --git a/resources/v1.25.3/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.26.5/charts/cni/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.25.3/charts/revisiontags/templates/zzz_profile.yaml
rename to resources/v1.26.5/charts/cni/templates/zzz_profile.yaml
diff --git a/resources/v1.26.5/charts/cni/values.yaml b/resources/v1.26.5/charts/cni/values.yaml
new file mode 100644
index 000000000..b81de1ece
--- /dev/null
+++ b/resources/v1.26.5/charts/cni/values.yaml
@@ -0,0 +1,152 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  hub: ""
+  tag: ""
+  variant: ""
+  image: install-cni
+  pullPolicy: ""
+
+  # Same as `global.logging.level`, but will override it if set
+  logging:
+    level: ""
+
+  # Configuration file to insert istio-cni plugin configuration
+  # by default this will be the first file found in the cni-conf-dir
+  # Example
+  # cniConfFileName: 10-calico.conflist
+
+  # CNI-and-platform specific path defaults.
+  # These may need to be set to platform-specific values, consult
+  # overrides for your platform in `manifests/helm-profiles/platform-*.yaml`
+  cniBinDir: /opt/cni/bin
+  cniConfDir: /etc/cni/net.d
+  cniConfFileName: ""
+  cniNetnsDir: "/var/run/netns"
+
+  excludeNamespaces:
+    - kube-system
+
+  # Allows user to set custom affinity for the DaemonSet
+  affinity: {}
+
+  # Custom annotations on pod level, if you need them
+  podAnnotations: {}
+
+  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
+  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
+  chained: true
+
+  # Custom configuration happens based on the CNI provider.
+  # Possible values: "default", "multus"
+  provider: "default"
+
+  # Configure ambient settings
+  ambient:
+    # If enabled, ambient redirection will be enabled
+    enabled: false
+    # Set ambient config dir path: defaults to /etc/ambient-config
+    configDir: ""
+    # If enabled, and ambient is enabled, DNS redirection will be enabled
+    dnsCapture: true
+    # If enabled, and ambient is enabled, enables ipv6 support
+    ipv6: true
+    # If enabled, and ambient is enabled, the CNI agent will reconcile incompatible iptables rules and chains at startup.
+    # This will eventually be enabled by default
+    reconcileIptablesOnStartup: false
+    # If enabled, and ambient is enabled, the CNI agent will always share the network namespace of the host node it is running on
+    shareHostNetworkNamespace: false
+
+
+  repair:
+    enabled: true
+    hub: ""
+    tag: ""
+
+    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
+    # This defines the action the controller will take when a pod is detected as broken.
+
+    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
+    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
+    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
+    labelPods: false
+    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
+    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
+    deletePods: false
+    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
+    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
+    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
+    repairPods: true
+
+    initContainerName: "istio-validation"
+
+    brokenPodLabelKey: "cni.istio.io/uninitialized"
+    brokenPodLabelValue: "true"
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
+  seLinuxOptions: {}
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 100Mi
+
+  resourceQuotas:
+    enabled: false
+    pods: 5000
+
+  # K8s DaemonSet update strategy.
+  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  global:
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+
+    # Default tag for Istio images.
+    tag: 1.26.5
+
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # change cni scope level to control logging out of istio-cni-node DaemonSet
+    logging:
+      level: info
+
+    logAsJson: false
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Default resources allocated
+    defaultResources:
+      requests:
+        cpu: 100m
+        memory: 100Mi
+
+  # A `key: value` mapping of environment variables to add to the pod
+  env: {}
diff --git a/resources/v1.26.5/charts/gateway/Chart.yaml b/resources/v1.26.5/charts/gateway/Chart.yaml
new file mode 100644
index 000000000..e7b199452
--- /dev/null
+++ b/resources/v1.26.5/charts/gateway/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+appVersion: 1.26.5
+description: Helm chart for deploying Istio gateways
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+- gateways
+name: gateway
+sources:
+- https://github.com/istio/istio
+type: application
+version: 1.26.5
diff --git a/resources/v1.24.1/charts/gateway/README.md b/resources/v1.26.5/charts/gateway/README.md
similarity index 100%
rename from resources/v1.24.1/charts/gateway/README.md
rename to resources/v1.26.5/charts/gateway/README.md
diff --git a/resources/v1.24.1/charts/gateway/files/profile-ambient.yaml b/resources/v1.26.5/charts/gateway/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.1/charts/gateway/files/profile-ambient.yaml
rename to resources/v1.26.5/charts/gateway/files/profile-ambient.yaml
diff --git a/resources/v1.26.5/charts/gateway/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.5/charts/gateway/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.5/charts/gateway/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.5/charts/gateway/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.5/charts/gateway/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.5/charts/gateway/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.5/charts/gateway/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.5/charts/gateway/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.5/charts/gateway/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.2/charts/gateway/files/profile-demo.yaml b/resources/v1.26.5/charts/gateway/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.2/charts/gateway/files/profile-demo.yaml
rename to resources/v1.26.5/charts/gateway/files/profile-demo.yaml
diff --git a/resources/v1.26.5/charts/gateway/files/profile-platform-gke.yaml b/resources/v1.26.5/charts/gateway/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.26.5/charts/gateway/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.1/charts/gateway/files/profile-platform-k3d.yaml b/resources/v1.26.5/charts/gateway/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.1/charts/gateway/files/profile-platform-k3d.yaml
rename to resources/v1.26.5/charts/gateway/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.2/charts/gateway/files/profile-platform-k3s.yaml b/resources/v1.26.5/charts/gateway/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.2/charts/gateway/files/profile-platform-k3s.yaml
rename to resources/v1.26.5/charts/gateway/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.1/charts/gateway/files/profile-platform-microk8s.yaml b/resources/v1.26.5/charts/gateway/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.1/charts/gateway/files/profile-platform-microk8s.yaml
rename to resources/v1.26.5/charts/gateway/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.1/charts/gateway/files/profile-platform-minikube.yaml b/resources/v1.26.5/charts/gateway/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.1/charts/gateway/files/profile-platform-minikube.yaml
rename to resources/v1.26.5/charts/gateway/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.1/charts/gateway/files/profile-platform-openshift.yaml b/resources/v1.26.5/charts/gateway/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.1/charts/gateway/files/profile-platform-openshift.yaml
rename to resources/v1.26.5/charts/gateway/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.1/charts/gateway/files/profile-preview.yaml b/resources/v1.26.5/charts/gateway/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.1/charts/gateway/files/profile-preview.yaml
rename to resources/v1.26.5/charts/gateway/files/profile-preview.yaml
diff --git a/resources/v1.24.1/charts/gateway/files/profile-remote.yaml b/resources/v1.26.5/charts/gateway/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.1/charts/gateway/files/profile-remote.yaml
rename to resources/v1.26.5/charts/gateway/files/profile-remote.yaml
diff --git a/resources/v1.24.1/charts/gateway/files/profile-stable.yaml b/resources/v1.26.5/charts/gateway/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.1/charts/gateway/files/profile-stable.yaml
rename to resources/v1.26.5/charts/gateway/files/profile-stable.yaml
diff --git a/resources/v1.24.1/charts/gateway/templates/NOTES.txt b/resources/v1.26.5/charts/gateway/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.1/charts/gateway/templates/NOTES.txt
rename to resources/v1.26.5/charts/gateway/templates/NOTES.txt
diff --git a/resources/v1.24.1/charts/gateway/templates/_helpers.tpl b/resources/v1.26.5/charts/gateway/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.1/charts/gateway/templates/_helpers.tpl
rename to resources/v1.26.5/charts/gateway/templates/_helpers.tpl
diff --git a/resources/v1.26.5/charts/gateway/templates/deployment.yaml b/resources/v1.26.5/charts/gateway/templates/deployment.yaml
new file mode 100644
index 000000000..d83ff3b49
--- /dev/null
+++ b/resources/v1.26.5/charts/gateway/templates/deployment.yaml
@@ -0,0 +1,131 @@
+apiVersion: apps/v1
+kind: {{ .Values.kind | default "Deployment" }}
+metadata:
+  name: {{ include "gateway.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "gateway.name" . }}
+    {{- include "istio.labels" . | nindent 4}}
+    {{- include "gateway.labels" . | nindent 4}}
+  annotations:
+    {{- .Values.annotations | toYaml | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  {{- if and (hasKey .Values "replicaCount") (ne .Values.replicaCount nil) }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  {{- end }}
+  {{- with .Values.strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.minReadySeconds }}
+  minReadySeconds: {{ . }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "gateway.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
+        {{- include "gateway.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/name: {{ include "gateway.name" . }}
+        {{- include "istio.labels" .  | nindent 8}}
+        {{- range $key, $val := .Values.labels }}
+        {{- if and (ne $key "app") (ne $key "istio") }}
+        {{ $key | quote }}: {{ $val | quote }}
+        {{- end }}
+        {{- end }}
+        {{- with .Values.networkGateway }}
+        topology.istio.io/network: "{{.}}"
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
+      securityContext:
+      {{- if .Values.securityContext }}
+        {{- toYaml .Values.securityContext | nindent 8 }}
+      {{- else }}
+        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
+        sysctls:
+        - name: net.ipv4.ip_unprivileged_port_start
+          value: "0"
+      {{- end }}
+      {{- with .Values.volumes }}
+      volumes:
+        {{ toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: istio-proxy
+          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
+          image: auto
+          {{- with .Values.imagePullPolicy }}
+          imagePullPolicy: {{ . }}
+          {{- end }}
+          securityContext:
+          {{- if .Values.containerSecurityContext }}
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          {{- else }}
+            capabilities:
+              drop:
+              - ALL
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: true
+            {{- if not (eq (.Values.platform | default "") "openshift") }}
+            runAsUser: 1337
+            runAsGroup: 1337
+            {{- end }}
+            runAsNonRoot: true
+          {{- end }}
+          env:
+          {{- with .Values.networkGateway }}
+          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
+            value: "{{.}}"
+          {{- end }}
+          {{- range $key, $val := .Values.env }}
+          - name: {{ $key }}
+            value: {{ $val | quote }}
+          {{- end }}
+          ports:
+          - containerPort: 15090
+            protocol: TCP
+            name: http-envoy-prom
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          {{- with .Values.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
+      {{- with .Values.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
diff --git a/resources/v1.24.1/charts/gateway/templates/hpa.yaml b/resources/v1.26.5/charts/gateway/templates/hpa.yaml
similarity index 100%
rename from resources/v1.24.1/charts/gateway/templates/hpa.yaml
rename to resources/v1.26.5/charts/gateway/templates/hpa.yaml
diff --git a/resources/v1.24.1/charts/gateway/templates/poddisruptionbudget.yaml b/resources/v1.26.5/charts/gateway/templates/poddisruptionbudget.yaml
similarity index 100%
rename from resources/v1.24.1/charts/gateway/templates/poddisruptionbudget.yaml
rename to resources/v1.26.5/charts/gateway/templates/poddisruptionbudget.yaml
diff --git a/resources/v1.24.1/charts/gateway/templates/role.yaml b/resources/v1.26.5/charts/gateway/templates/role.yaml
similarity index 100%
rename from resources/v1.24.1/charts/gateway/templates/role.yaml
rename to resources/v1.26.5/charts/gateway/templates/role.yaml
diff --git a/resources/v1.26.5/charts/gateway/templates/service.yaml b/resources/v1.26.5/charts/gateway/templates/service.yaml
new file mode 100644
index 000000000..3e28418f7
--- /dev/null
+++ b/resources/v1.26.5/charts/gateway/templates/service.yaml
@@ -0,0 +1,69 @@
+{{- if not (eq .Values.service.type "None") }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "gateway.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "gateway.name" . }}
+    {{- include "istio.labels" . | nindent 4}}
+    {{- include "gateway.labels" . | nindent 4 }}
+    {{- with .Values.networkGateway }}
+    topology.istio.io/network: "{{.}}"
+    {{- end }}
+  annotations:
+    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
+spec:
+{{- with .Values.service.loadBalancerIP }}
+  loadBalancerIP: "{{ . }}"
+{{- end }}
+{{- if eq .Values.service.type "LoadBalancer" }}
+  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
+  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
+  {{- end }}
+  {{- if hasKey .Values.service "loadBalancerClass" }}
+  loadBalancerClass: {{ .Values.service.loadBalancerClass }}
+  {{- end }}
+{{- end }}
+{{- if .Values.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
+{{- end }}
+{{- if .Values.service.ipFamilies }}
+  ipFamilies:
+{{- range .Values.service.ipFamilies }}
+  - {{ . }}
+{{- end }}
+{{- end }}
+{{- with .Values.service.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+{{ toYaml . | indent 4 }}
+{{- end }}
+{{- with .Values.service.externalTrafficPolicy }}
+  externalTrafficPolicy: "{{ . }}"
+{{- end }}
+  type: {{ .Values.service.type }}
+  ports:
+{{- if .Values.networkGateway }}
+  - name: status-port
+    port: 15021
+    targetPort: 15021
+  - name: tls
+    port: 15443
+    targetPort: 15443
+  - name: tls-istiod
+    port: 15012
+    targetPort: 15012
+  - name: tls-webhook
+    port: 15017
+    targetPort: 15017
+{{- else }}
+{{ .Values.service.ports | toYaml | indent 4 }}
+{{- end }}
+{{- if .Values.service.externalIPs }}
+  externalIPs: {{- range .Values.service.externalIPs }}
+    - {{.}}
+  {{- end }}
+{{- end }}
+  selector:
+    {{- include "gateway.selectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/resources/v1.24.1/charts/gateway/templates/serviceaccount.yaml b/resources/v1.26.5/charts/gateway/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.1/charts/gateway/templates/serviceaccount.yaml
rename to resources/v1.26.5/charts/gateway/templates/serviceaccount.yaml
diff --git a/resources/v1.26.5/charts/gateway/templates/zzz_profile.yaml b/resources/v1.26.5/charts/gateway/templates/zzz_profile.yaml
new file mode 100644
index 000000000..606c55669
--- /dev/null
+++ b/resources/v1.26.5/charts/gateway/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if true }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.25.5/charts/gateway/values.schema.json b/resources/v1.26.5/charts/gateway/values.schema.json
similarity index 100%
rename from resources/v1.25.5/charts/gateway/values.schema.json
rename to resources/v1.26.5/charts/gateway/values.schema.json
diff --git a/resources/v1.26.5/charts/gateway/values.yaml b/resources/v1.26.5/charts/gateway/values.yaml
new file mode 100644
index 000000000..4e65676ba
--- /dev/null
+++ b/resources/v1.26.5/charts/gateway/values.yaml
@@ -0,0 +1,170 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  # Name allows overriding the release name. Generally this should not be set
+  name: ""
+  # revision declares which revision this gateway is a part of
+  revision: ""
+
+  # Controls the spec.replicas setting for the Gateway deployment if set.
+  # Otherwise defaults to Kubernetes Deployment default (1).
+  replicaCount:
+
+  kind: Deployment
+
+  rbac:
+    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
+    # when using http://gateway-api.org/.
+    enabled: true
+
+  serviceAccount:
+    # If set, a service account will be created. Otherwise, the default is used
+    create: true
+    # Annotations to add to the service account
+    annotations: {}
+    # The name of the service account to use.
+    # If not set, the release name is used
+    name: ""
+
+  podAnnotations:
+    prometheus.io/port: "15020"
+    prometheus.io/scrape: "true"
+    prometheus.io/path: "/stats/prometheus"
+    inject.istio.io/templates: "gateway"
+    sidecar.istio.io/inject: "true"
+
+  # Define the security context for the pod.
+  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+  securityContext: {}
+  containerSecurityContext: {}
+
+  service:
+    # Type of service. Set to "None" to disable the service entirely
+    type: LoadBalancer
+    ports:
+    - name: status-port
+      port: 15021
+      protocol: TCP
+      targetPort: 15021
+    - name: http2
+      port: 80
+      protocol: TCP
+      targetPort: 80
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 443
+    annotations: {}
+    loadBalancerIP: ""
+    loadBalancerSourceRanges: []
+    externalTrafficPolicy: ""
+    externalIPs: []
+    ipFamilyPolicy: ""
+    ipFamilies: []
+    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
+    # allocateLoadBalancerNodePorts: false
+    ## Set LoadBalancer class (only for LoadBalancers).
+    # loadBalancerClass: ""
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 2000m
+      memory: 1024Mi
+
+  autoscaling:
+    enabled: true
+    minReplicas: 1
+    maxReplicas: 5
+    targetCPUUtilizationPercentage: 80
+    targetMemoryUtilizationPercentage: {}
+    autoscaleBehavior: {}
+
+  # Pod environment variables
+  env: {}
+
+  # Deployment Update strategy
+  strategy: {}
+  
+  # Sets the Deployment minReadySeconds value
+  minReadySeconds:
+  
+  # Optionally configure a custom readinessProbe. By default the control plane
+  # automatically injects the readinessProbe. If you wish to override that
+  # behavior, you may define your own readinessProbe here.
+  readinessProbe: {}
+
+  # Labels to apply to all resources
+  labels:
+    # By default, don't enroll gateways into the ambient dataplane
+    "istio.io/dataplane-mode": none
+
+  # Annotations to apply to all resources
+  annotations: {}
+
+  nodeSelector: {}
+
+  tolerations: []
+
+  topologySpreadConstraints: []
+
+  affinity: {}
+
+  # If specified, the gateway will act as a network gateway for the given network.
+  networkGateway: ""
+
+  # Specify image pull policy if default behavior isn't desired.
+  # Default behavior: latest images will be Always else IfNotPresent
+  imagePullPolicy: ""
+
+  imagePullSecrets: []
+
+  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
+  #
+  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
+  # which means that no PodDisruptionBudget resource will be created.
+  #
+  # To enable the PodDisruptionBudget, configure it by specifying the
+  # `minAvailable` or `maxUnavailable`. For example, to set the
+  # minimum number of available replicas to 1, you can update this value as follows:
+  #
+  # podDisruptionBudget:
+  #   minAvailable: 1
+  #
+  # Or, to allow a maximum of 1 unavailable replica, you can set:
+  #
+  # podDisruptionBudget:
+  #   maxUnavailable: 1
+  #
+  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
+  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
+  #
+  # podDisruptionBudget:
+  #   minAvailable: 1
+  #   unhealthyPodEvictionPolicy: AlwaysAllow
+  #
+  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
+  #
+  # podDisruptionBudget: {}
+  #
+  podDisruptionBudget: {}
+
+  # Sets the per-pod terminationGracePeriodSeconds setting.
+  terminationGracePeriodSeconds: 30
+
+  # A list of `Volumes` added into the Gateway Pods. See
+  # https://kubernetes.io/docs/concepts/storage/volumes/.
+  volumes: []
+
+  # A list of `VolumeMounts` added into the Gateway Pods. See
+  # https://kubernetes.io/docs/concepts/storage/volumes/.
+  volumeMounts: []
+
+  # Configure this to a higher priority class in order to make sure your Istio gateway pods
+  # will not be killed because of low priority class.
+  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+  # for more detail.
+  priorityClassName: ""
diff --git a/resources/v1.26.5/charts/istiod/Chart.yaml b/resources/v1.26.5/charts/istiod/Chart.yaml
new file mode 100644
index 000000000..ac74a46d4
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+appVersion: 1.26.5
+description: Helm chart for istio control plane
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+- istiod
+- istio-discovery
+name: istiod
+sources:
+- https://github.com/istio/istio
+version: 1.26.5
diff --git a/resources/v1.24.1/charts/istiod/README.md b/resources/v1.26.5/charts/istiod/README.md
similarity index 100%
rename from resources/v1.24.1/charts/istiod/README.md
rename to resources/v1.26.5/charts/istiod/README.md
diff --git a/resources/v1.26.5/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.26.5/charts/istiod/files/gateway-injection-template.yaml
new file mode 100644
index 000000000..7d23f15f9
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/files/gateway-injection-template.yaml
@@ -0,0 +1,261 @@
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations:
+    istio.io/rev: {{ .Revision | default "default" | quote }}
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}"
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}"
+    {{- end }}
+    {{- end }}
+spec:
+  securityContext:
+  {{- if .Values.gateways.securityContext }}
+    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
+  {{- else }}
+    sysctls:
+    - name: net.ipv4.ip_unprivileged_port_start
+      value: "0"
+  {{- end }}
+  containers:
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    ports:
+    - containerPort: 15090
+      protocol: TCP
+      name: http-envoy-prom
+    args:
+    - proxy
+    - router
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+  {{- if .Values.global.proxy.lifecycle }}
+    lifecycle:
+      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
+  {{- end }}
+    securityContext:
+      runAsUser: {{ .ProxyUID | default "1337" }}
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+    env:
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: ISTIO_CPU_LIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: GOMEMLIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.memory
+    - name: GOMAXPROCS
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    {{- if .CompliancePolicy }}
+    - name: COMPLIANCE_POLICY
+      value: "{{ .CompliancePolicy }}"
+    {{- end }}
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    - name: ISTIO_META_INTERCEPTION_MODE
+      value: "{{ .ProxyConfig.InterceptionMode.String }}"
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- if .DeploymentMeta.Name }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ .DeploymentMeta.Name }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    - name: credential-socket
+      mountPath: /var/run/secrets/credential-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    # SDS channel between istioagent and Envoy
+    - mountPath: /etc/istio/proxy
+      name: istio-envoy
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+  volumes:
+  - emptyDir: {}
+    name: workload-socket
+  - emptyDir: {}
+    name: credential-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else}}
+  - emptyDir: {}
+    name: workload-certs
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-envoy
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+          name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+          path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: istio-ca-root-cert
+  {{- end }}
+  {{- end }}
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.26.5/charts/istiod/files/grpc-agent.yaml b/resources/v1.26.5/charts/istiod/files/grpc-agent.yaml
new file mode 100644
index 000000000..dda3aeaa9
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/files/grpc-agent.yaml
@@ -0,0 +1,318 @@
+{{- define "resources"  }}
+  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
+      requests:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
+        {{ end }}
+    {{- end }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+      limits:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
+        {{ end }}
+    {{- end }}
+  {{- else }}
+    {{- if .Values.global.proxy.resources }}
+      {{ toYaml .Values.global.proxy.resources | indent 6 }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations: {
+    istio.io/rev: {{ .Revision | default "default" | quote }},
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- end }}
+    sidecar.istio.io/rewriteAppHTTPProbers: "false",
+  }
+spec:
+  containers:
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    ports:
+    - containerPort: 15020
+      protocol: TCP
+      name: mesh-metrics
+    args:
+    - proxy
+    - sidecar
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+    lifecycle:
+      postStart:
+        exec:
+          command:
+          - pilot-agent
+          - wait
+          - --url=http://localhost:15020/healthz/ready
+    env:
+    - name: ISTIO_META_GENERATOR
+      value: grpc
+    - name: OUTPUT_CERTS
+      value: /var/lib/istio/data
+    {{- if eq .InboundTrafficPolicyMode "localhost" }}
+    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
+      value: "true"
+    {{- end }}
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- if .DeploymentMeta.Name }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ .DeploymentMeta.Name }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    # grpc uses xds:/// to resolve – no need to resolve VIP
+    - name: ISTIO_META_DNS_CAPTURE
+      value: "false"
+    - name: DISABLE_ENVOY
+      value: "true"
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15020
+      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
+    resources:
+  {{ template "resources" . }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    # UDS channel between istioagent and gRPC client for XDS/SDS
+    - mountPath: /etc/istio/proxy
+      name: istio-xds
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+    {{- end }}
+      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
+      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
+    - name: "{{  $index }}"
+      {{ toYaml $value | indent 6 }}
+      {{ end }}
+      {{- end }}
+{{- range $index, $container := .Spec.Containers  }}
+{{ if not (eq $container.Name "istio-proxy") }}
+  - name: {{ $container.Name }}
+    env:
+      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
+        value: "true"
+      - name: "GRPC_XDS_BOOTSTRAP"
+        value: "/etc/istio/proxy/grpc-bootstrap.json"
+    volumeMounts:
+      - mountPath: /var/lib/istio/data
+        name: istio-data
+      # UDS channel between istioagent and gRPC client for XDS/SDS
+      - mountPath: /etc/istio/proxy
+        name: istio-xds
+      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
+      - name: gke-workload-certificate
+        mountPath: /var/run/secrets/workload-spiffe-credentials
+        readOnly: true
+      {{- else }}
+      - name: workload-certs
+        mountPath: /var/run/secrets/workload-spiffe-credentials
+      {{- end }}
+{{- end }}
+{{- end }}
+  volumes:
+  - emptyDir:
+    name: workload-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else }}
+  - emptyDir:
+    name: workload-certs
+  {{- end }}
+  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+  - name: custom-bootstrap-volume
+    configMap:
+      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-xds
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+          name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+          path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: istio-ca-root-cert
+  {{- end }}
+  {{- end }}
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
+    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
+  - name: "{{ $index }}"
+    {{ toYaml $value | indent 4 }}
+    {{ end }}
+    {{ end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.24.1/charts/istiod/files/grpc-simple.yaml b/resources/v1.26.5/charts/istiod/files/grpc-simple.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/files/grpc-simple.yaml
rename to resources/v1.26.5/charts/istiod/files/grpc-simple.yaml
diff --git a/resources/v1.26.5/charts/istiod/files/injection-template.yaml b/resources/v1.26.5/charts/istiod/files/injection-template.yaml
new file mode 100644
index 000000000..bfd922b04
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/files/injection-template.yaml
@@ -0,0 +1,531 @@
+{{- define "resources"  }}
+  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
+      requests:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
+        {{ end }}
+    {{- end }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+      limits:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
+        {{ end }}
+    {{- end }}
+  {{- else }}
+    {{- if .Values.global.proxy.resources }}
+      {{ toYaml .Values.global.proxy.resources | indent 6 }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
+{{ $tproxy := (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) }}
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
+    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
+    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
+    {{- end }}
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations: {
+    istio.io/rev: {{ .Revision | default "default" | quote }},
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- end }}
+{{- if .Values.pilot.cni.enabled }}
+    {{- if eq .Values.pilot.cni.provider "multus" }}
+    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
+    {{- end }}
+    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
+    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
+    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
+    traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}",
+    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
+    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
+    {{- end }}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
+    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
+    {{- end }}
+    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
+    {{ with index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}istio.io/reroute-virtual-interfaces: "{{.}}",{{ end }}
+    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
+{{- end }}
+  }
+spec:
+  {{- $holdProxy := and
+      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
+      (not $nativeSidecar) }}
+  {{- $noInitContainer := and
+      (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE`)
+      (not $nativeSidecar) }}
+  {{ if $noInitContainer }}
+  initContainers: []
+  {{ else -}}
+  initContainers:
+  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
+  {{ if .Values.pilot.cni.enabled -}}
+  - name: istio-validation
+  {{ else -}}
+  - name: istio-init
+  {{ end -}}
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    args:
+    - istio-iptables
+    - "-p"
+    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
+    - "-z"
+    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
+    - "-u"
+    - {{ if $tproxy }} "1337" {{ else }} {{ .ProxyUID | default "1337" | quote }} {{ end }}
+    - "-m"
+    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
+    - "-i"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
+    - "-x"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
+    - "-b"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
+    - "-d"
+  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
+    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
+  {{- else }}
+    - "15090,15021"
+  {{- end }}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
+    - "-q"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
+    {{ end -}}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
+    - "-o"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
+    {{ end -}}
+    {{ if (isset .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces`) -}}
+    - "-k"
+    - "{{ index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}"
+    {{ else if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
+    - "-k"
+    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
+    {{ end -}}
+     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
+    - "-c"
+    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
+    {{ end -}}
+    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
+    {{ if .Values.global.logAsJson -}}
+    - "--log_as_json"
+    {{ end -}}
+    {{ if .Values.pilot.cni.enabled -}}
+    - "--run-validation"
+    - "--skip-rule-apply"
+    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
+    - "--force-apply"
+    {{ end -}}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+  {{- if .ProxyConfig.ProxyMetadata }}
+    env:
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+  {{- end }}
+    resources:
+  {{ template "resources" . }}
+    securityContext:
+      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
+      privileged: {{ .Values.global.proxy.privileged }}
+      capabilities:
+    {{- if not .Values.pilot.cni.enabled }}
+        add:
+        - NET_ADMIN
+        - NET_RAW
+    {{- end }}
+        drop:
+        - ALL
+    {{- if not .Values.pilot.cni.enabled }}
+      readOnlyRootFilesystem: false
+      runAsGroup: 0
+      runAsNonRoot: false
+      runAsUser: 0
+    {{- else }}
+      readOnlyRootFilesystem: true
+      runAsGroup: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyGID | default "1337" }} {{ end }}
+      runAsUser: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyUID | default "1337" }} {{ end }}
+      runAsNonRoot: true
+    {{- end }}
+  {{ end -}}
+  {{ end -}}
+  {{ if not $nativeSidecar }}
+  containers:
+  {{ end }}
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
+    ports:
+    - containerPort: 15090
+      protocol: TCP
+      name: http-envoy-prom
+    args:
+    - proxy
+    - sidecar
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+  {{- if .Values.global.proxy.outlierLogPath }}
+    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
+  {{- end}}
+  {{- if .Values.global.proxy.lifecycle }}
+    lifecycle:
+      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
+  {{- else if $holdProxy }}
+    lifecycle:
+      postStart:
+        exec:
+          command:
+          - pilot-agent
+          - wait
+  {{- else if $nativeSidecar }}
+    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
+    lifecycle:
+      preStop:
+        exec:
+          command:
+          - pilot-agent
+          - request
+          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
+          - POST
+          - drain
+  {{- end }}
+    env:
+    {{- if eq .InboundTrafficPolicyMode "localhost" }}
+    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
+      value: "true"
+    {{- end }}
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: ISTIO_CPU_LIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: GOMEMLIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.memory
+    - name: GOMAXPROCS
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    {{- if .CompliancePolicy }}
+    - name: COMPLIANCE_POLICY
+      value: "{{ .CompliancePolicy }}"
+    {{- end }}
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    - name: ISTIO_META_INTERCEPTION_MODE
+      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- with (index .ObjectMeta.Labels `service.istio.io/workload-name` | default .DeploymentMeta.Name) }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ . }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - name: ISTIO_BOOTSTRAP_OVERRIDE
+      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
+    {{- end }}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
+    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
+  {{ if .Values.global.proxy.startupProbe.enabled }}
+    startupProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: 0
+      periodSeconds: 1
+      timeoutSeconds: 3
+      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
+  {{ end }}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
+    {{ end -}}
+    securityContext:
+      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
+      allowPrivilegeEscalation: true
+      capabilities:
+        add:
+        - NET_ADMIN
+        drop:
+        - ALL
+      privileged: true
+      readOnlyRootFilesystem: true
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+      runAsNonRoot: false
+      runAsUser: 0
+      {{- else }}
+      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
+      capabilities:
+        {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
+        add:
+        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
+        - NET_ADMIN
+        {{- end }}
+        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
+        - NET_BIND_SERVICE
+        {{- end }}
+        {{- end }}
+        drop:
+        - ALL
+      privileged: {{ .Values.global.proxy.privileged }}
+      readOnlyRootFilesystem: true
+      {{ if or ($tproxy) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
+      runAsNonRoot: false
+      runAsUser: 0
+      runAsGroup: 1337
+      {{- else -}}
+      runAsNonRoot: true
+      runAsUser: {{ .ProxyUID | default "1337" }}
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+      {{- end }}
+      {{- end }}
+    resources:
+  {{ template "resources" . }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    - name: credential-socket
+      mountPath: /var/run/secrets/credential-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - mountPath: /etc/istio/custom-bootstrap
+      name: custom-bootstrap-volume
+    {{- end }}
+    # SDS channel between istioagent and Envoy
+    - mountPath: /etc/istio/proxy
+      name: istio-envoy
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
+    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
+      name: lightstep-certs
+      readOnly: true
+    {{- end }}
+      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
+      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
+    - name: "{{  $index }}"
+      {{ toYaml $value | indent 6 }}
+      {{ end }}
+      {{- end }}
+  volumes:
+  - emptyDir:
+    name: workload-socket
+  - emptyDir:
+    name: credential-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else }}
+  - emptyDir:
+    name: workload-certs
+  {{- end }}
+  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+  - name: custom-bootstrap-volume
+    configMap:
+      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-envoy
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+          name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+          path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: istio-ca-root-cert
+  {{- end }}
+  {{- end }}
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
+    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
+  - name: "{{ $index }}"
+    {{ toYaml $value | indent 4 }}
+    {{ end }}
+    {{ end }}
+  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
+  - name: lightstep-certs
+    secret:
+      optional: true
+      secretName: lightstep.cacert
+  {{- end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.26.5/charts/istiod/files/kube-gateway.yaml b/resources/v1.26.5/charts/istiod/files/kube-gateway.yaml
new file mode 100644
index 000000000..447ecae83
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/files/kube-gateway.yaml
@@ -0,0 +1,401 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{.ServiceAccount | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  {{- if ge .KubeVersion 128 }}
+  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+  {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.istio.io/managed" "istio.io-gateway-controller"
+      ) | nindent 4 }}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: {{.Name}}
+    uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      "{{.GatewayNameLabel}}": {{.Name}}
+  template:
+    metadata:
+      annotations:
+        {{- toJsonMap
+          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
+          (strdict "istio.io/rev" (.Revision | default "default"))
+          (strdict
+            "prometheus.io/path" "/stats/prometheus"
+            "prometheus.io/port" "15020"
+            "prometheus.io/scrape" "true"
+          ) | nindent 8 }}
+      labels:
+        {{- toJsonMap
+          (strdict
+            "sidecar.istio.io/inject" "false"
+            "service.istio.io/canonical-name" .DeploymentName
+            "service.istio.io/canonical-revision" "latest"
+           )
+          .InfrastructureLabels
+          (strdict
+            "gateway.networking.k8s.io/gateway-name" .Name
+            "gateway.istio.io/managed" "istio.io-gateway-controller"
+          ) | nindent 8 }}
+    spec:
+      securityContext:
+      {{- if .Values.gateways.securityContext }}
+        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
+      {{- else }}
+        sysctls:
+        - name: net.ipv4.ip_unprivileged_port_start
+          value: "0"
+      {{- if .Values.gateways.seccompProfile }}
+        seccompProfile:
+      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
+      {{- end }}
+      {{- end }}
+      serviceAccountName: {{.ServiceAccount | quote}}
+      containers:
+      - name: istio-proxy
+      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+      {{- else }}
+        image: "{{ .ProxyImage }}"
+      {{- end }}
+        {{- if .Values.global.proxy.resources }}
+        resources:
+          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
+        {{- end }}
+        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
+          allowPrivilegeEscalation: false
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsUser: {{ .ProxyUID | default "1337" }}
+          runAsGroup: {{ .ProxyGID | default "1337" }}
+          runAsNonRoot: true
+        ports:
+        - containerPort: 15020
+          name: metrics
+          protocol: TCP
+        - containerPort: 15021
+          name: status-port
+          protocol: TCP
+        - containerPort: 15090
+          protocol: TCP
+          name: http-envoy-prom
+        args:
+        - proxy
+        - router
+        - --domain
+        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+        - --proxyLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
+        - --proxyComponentLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
+        - --log_output_level
+        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
+      {{- if .Values.global.sts.servicePort }}
+        - --stsPort={{ .Values.global.sts.servicePort }}
+      {{- end }}
+      {{- if .Values.global.logAsJson }}
+        - --log_as_json
+      {{- end }}
+      {{- if .Values.global.proxy.lifecycle }}
+        lifecycle:
+          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
+      {{- end }}
+        env:
+        - name: PILOT_CERT_PROVIDER
+          value: {{ .Values.global.pilotCertProvider }}
+        - name: CA_ADDR
+        {{- if .Values.global.caAddress }}
+          value: {{ .Values.global.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        - name: ISTIO_CPU_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: PROXY_CONFIG
+          value: |
+                 {{ protoToJSON .ProxyConfig }}
+        - name: ISTIO_META_POD_PORTS
+          value: "[]"
+        - name: ISTIO_META_APP_CONTAINERS
+          value: ""
+        - name: GOMEMLIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.memory
+        - name: GOMAXPROCS
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: ISTIO_META_CLUSTER_ID
+          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
+        - name: ISTIO_META_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: ISTIO_META_INTERCEPTION_MODE
+          value: "{{ .ProxyConfig.InterceptionMode.String }}"
+        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
+        - name: ISTIO_META_NETWORK
+          value: {{.|quote}}
+        {{- end }}
+        - name: ISTIO_META_WORKLOAD_NAME
+          value: {{.DeploymentName|quote}}
+        - name: ISTIO_META_OWNER
+          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
+        {{- if .Values.global.meshID }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ .Values.global.meshID }}"
+        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+        {{- end }}
+        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+        - name: TRUST_DOMAIN
+          value: "{{ . }}"
+        {{- end }}
+        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
+        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
+          value: {{.|quote}}
+        {{- end }}
+        startupProbe:
+          failureThreshold: 30
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 1
+          periodSeconds: 1
+          successThreshold: 1
+          timeoutSeconds: 1
+        readinessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 0
+          periodSeconds: 15
+          successThreshold: 1
+          timeoutSeconds: 1
+        volumeMounts:
+        - name: workload-socket
+          mountPath: /var/run/secrets/workload-spiffe-uds
+        - name: credential-socket
+          mountPath: /var/run/secrets/credential-uds
+        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+        - name: gke-workload-certificate
+          mountPath: /var/run/secrets/workload-spiffe-credentials
+          readOnly: true
+        {{- else }}
+        - name: workload-certs
+          mountPath: /var/run/secrets/workload-spiffe-credentials
+        {{- end }}
+        {{- if eq .Values.global.pilotCertProvider "istiod" }}
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        {{- end }}
+        - mountPath: /var/lib/istio/data
+          name: istio-data
+        # SDS channel between istioagent and Envoy
+        - mountPath: /etc/istio/proxy
+          name: istio-envoy
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - name: istio-podinfo
+          mountPath: /etc/istio/pod
+      volumes:
+      - emptyDir: {}
+        name: workload-socket
+      - emptyDir: {}
+        name: credential-socket
+      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+      - name: gke-workload-certificate
+        csi:
+          driver: workloadcertificates.security.cloud.google.com
+      {{- else}}
+      - emptyDir: {}
+        name: workload-certs
+      {{- end }}
+      # SDS channel between istioagent and Envoy
+      - emptyDir:
+          medium: Memory
+        name: istio-envoy
+      - name: istio-data
+        emptyDir: {}
+      - name: istio-podinfo
+        downwardAPI:
+          items:
+            - path: "labels"
+              fieldRef:
+                fieldPath: metadata.labels
+            - path: "annotations"
+              fieldRef:
+                fieldPath: metadata.annotations
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: istio-token
+              expirationSeconds: 43200
+              audience: {{ .Values.global.sds.token.aud }}
+      {{- if eq .Values.global.pilotCertProvider "istiod" }}
+      - name: istiod-ca-cert
+      {{- if eq ((.Values.pilot).env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:root-cert
+              path: root-cert.pem
+      {{- else }}
+        configMap:
+          name: istio-ca-root-cert
+      {{- end }}
+      {{- end }}
+      {{- if .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: {{.Name}}
+    uid: {{.UID}}
+spec:
+  ipFamilyPolicy: PreferDualStack
+  ports:
+  {{- range $key, $val := .Ports }}
+  - name: {{ $val.Name | quote }}
+    port: {{ $val.Port }}
+    protocol: TCP
+    appProtocol: {{ $val.AppProtocol }}
+  {{- end }}
+  selector:
+    "{{.GatewayNameLabel}}": {{.Name}}
+  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
+  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
+  {{- end }}
+  type: {{ .ServiceType | quote }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name:  {{.DeploymentName | quote}}
+  maxReplicas: 1
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
+
diff --git a/resources/v1.24.1/charts/istiod/files/profile-ambient.yaml b/resources/v1.26.5/charts/istiod/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/files/profile-ambient.yaml
rename to resources/v1.26.5/charts/istiod/files/profile-ambient.yaml
diff --git a/resources/v1.26.5/charts/istiod/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.5/charts/istiod/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.5/charts/istiod/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.5/charts/istiod/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.5/charts/istiod/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.5/charts/istiod/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.2/charts/istiod/files/profile-demo.yaml b/resources/v1.26.5/charts/istiod/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.2/charts/istiod/files/profile-demo.yaml
rename to resources/v1.26.5/charts/istiod/files/profile-demo.yaml
diff --git a/resources/v1.26.5/charts/istiod/files/profile-platform-gke.yaml b/resources/v1.26.5/charts/istiod/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.1/charts/istiod/files/profile-platform-k3d.yaml b/resources/v1.26.5/charts/istiod/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/files/profile-platform-k3d.yaml
rename to resources/v1.26.5/charts/istiod/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.2/charts/istiod/files/profile-platform-k3s.yaml b/resources/v1.26.5/charts/istiod/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.2/charts/istiod/files/profile-platform-k3s.yaml
rename to resources/v1.26.5/charts/istiod/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.1/charts/istiod/files/profile-platform-microk8s.yaml b/resources/v1.26.5/charts/istiod/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/files/profile-platform-microk8s.yaml
rename to resources/v1.26.5/charts/istiod/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.1/charts/istiod/files/profile-platform-minikube.yaml b/resources/v1.26.5/charts/istiod/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/files/profile-platform-minikube.yaml
rename to resources/v1.26.5/charts/istiod/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.1/charts/istiod/files/profile-platform-openshift.yaml b/resources/v1.26.5/charts/istiod/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/files/profile-platform-openshift.yaml
rename to resources/v1.26.5/charts/istiod/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.1/charts/istiod/files/profile-preview.yaml b/resources/v1.26.5/charts/istiod/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/files/profile-preview.yaml
rename to resources/v1.26.5/charts/istiod/files/profile-preview.yaml
diff --git a/resources/v1.24.1/charts/istiod/files/profile-remote.yaml b/resources/v1.26.5/charts/istiod/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/files/profile-remote.yaml
rename to resources/v1.26.5/charts/istiod/files/profile-remote.yaml
diff --git a/resources/v1.24.1/charts/istiod/files/profile-stable.yaml b/resources/v1.26.5/charts/istiod/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/files/profile-stable.yaml
rename to resources/v1.26.5/charts/istiod/files/profile-stable.yaml
diff --git a/resources/v1.26.5/charts/istiod/files/waypoint.yaml b/resources/v1.26.5/charts/istiod/files/waypoint.yaml
new file mode 100644
index 000000000..421cabeae
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/files/waypoint.yaml
@@ -0,0 +1,396 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{.ServiceAccount | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  {{- if ge .KubeVersion 128 }}
+  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+  {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.istio.io/managed" "istio.io-mesh-controller"
+      ) | nindent 4 }}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      "{{.GatewayNameLabel}}": "{{.Name}}"
+  template:
+    metadata:
+      annotations:
+        {{- toJsonMap
+          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
+          (strdict "istio.io/rev" (.Revision | default "default"))
+          (strdict
+            "prometheus.io/path" "/stats/prometheus"
+            "prometheus.io/port" "15020"
+            "prometheus.io/scrape" "true"
+          ) | nindent 8 }}
+      labels:
+        {{- toJsonMap
+          (strdict
+            "sidecar.istio.io/inject" "false"
+            "istio.io/dataplane-mode" "none"
+            "service.istio.io/canonical-name" .DeploymentName
+            "service.istio.io/canonical-revision" "latest"
+           )
+          .InfrastructureLabels
+          (strdict
+            "gateway.networking.k8s.io/gateway-name" .Name
+            "gateway.istio.io/managed" "istio.io-mesh-controller"
+          ) | nindent 8}}
+    spec:
+      {{- if .Values.global.waypoint.affinity }}
+      affinity:
+      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.topologySpreadConstraints }}
+      topologySpreadConstraints:
+      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.nodeSelector }}
+      nodeSelector:
+      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.tolerations }}
+      tolerations:
+      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: 2
+      serviceAccountName: {{.ServiceAccount | quote}}
+      containers:
+      - name: istio-proxy
+        ports:
+        - containerPort: 15020
+          name: metrics
+          protocol: TCP
+        - containerPort: 15021
+          name: status-port
+          protocol: TCP
+        - containerPort: 15090
+          protocol: TCP
+          name: http-envoy-prom
+        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+        {{- else }}
+        image: "{{ .ProxyImage }}"
+        {{- end }}
+        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+        args:
+        - proxy
+        - waypoint
+        - --domain
+        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+        - --serviceCluster
+        - {{.ServiceAccount}}.$(POD_NAMESPACE)
+        - --proxyLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
+        - --proxyComponentLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
+        - --log_output_level
+        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
+        {{- if .Values.global.logAsJson }}
+        - --log_as_json
+        {{- end }}
+        {{- if .Values.global.proxy.outlierLogPath }}
+        - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
+        {{- end}}
+        env:
+        - name: ISTIO_META_SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: ISTIO_META_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: PILOT_CERT_PROVIDER
+          value: {{ .Values.global.pilotCertProvider }}
+        - name: CA_ADDR
+        {{- if .Values.global.caAddress }}
+          value: {{ .Values.global.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        - name: ISTIO_CPU_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: PROXY_CONFIG
+          value: |
+                 {{ protoToJSON .ProxyConfig }}
+        {{- if .ProxyConfig.ProxyMetadata }}
+        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- end }}
+        - name: GOMEMLIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.memory
+        - name: GOMAXPROCS
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: ISTIO_META_CLUSTER_ID
+          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
+        {{- if $network }}
+        - name: ISTIO_META_NETWORK
+          value: "{{ $network }}"
+        {{- end }}
+        - name: ISTIO_META_INTERCEPTION_MODE
+          value: REDIRECT
+        - name: ISTIO_META_WORKLOAD_NAME
+          value: {{.DeploymentName}}
+        - name: ISTIO_META_OWNER
+          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
+        {{- if .Values.global.meshID }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ .Values.global.meshID }}"
+        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+        {{- end }}
+        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: TRUST_DOMAIN
+          value: "{{ . }}"
+        {{- end }}
+        {{- if .Values.global.waypoint.resources }}
+        resources:
+        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
+        {{- end }}
+        startupProbe:
+          failureThreshold: 30
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 1
+          periodSeconds: 1
+          successThreshold: 1
+          timeoutSeconds: 1
+        readinessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 0
+          periodSeconds: 15
+          successThreshold: 1
+          timeoutSeconds: 1
+        securityContext:
+          privileged: false
+        {{- if not (eq .Values.global.platform "openshift") }}
+          runAsGroup: 1337
+          runAsUser: 1337
+        {{- end }}
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          capabilities:
+            drop:
+            - ALL
+{{- if .Values.gateways.seccompProfile }}
+          seccompProfile:
+{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
+{{- end }}
+        volumeMounts:
+        - mountPath: /var/run/secrets/workload-spiffe-uds
+          name: workload-socket
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        - mountPath: /var/lib/istio/data
+          name: istio-data
+        - mountPath: /etc/istio/proxy
+          name: istio-envoy
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - mountPath: /etc/istio/pod
+          name: istio-podinfo
+      volumes:
+      - emptyDir: {}
+        name: workload-socket
+      - emptyDir:
+          medium: Memory
+        name: istio-envoy
+      - emptyDir:
+          medium: Memory
+        name: go-proxy-envoy
+      - emptyDir: {}
+        name: istio-data
+      - emptyDir: {}
+        name: go-proxy-data
+      - downwardAPI:
+          items:
+          - fieldRef:
+              fieldPath: metadata.labels
+            path: labels
+          - fieldRef:
+              fieldPath: metadata.annotations
+            path: annotations
+        name: istio-podinfo
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              audience: istio-ca
+              expirationSeconds: 43200
+              path: istio-token
+      - name: istiod-ca-cert
+      {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:root-cert
+              path: root-cert.pem
+      {{- else }}
+        configMap:
+          name: istio-ca-root-cert
+      {{- end }}
+      {{- if .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    {{ toJsonMap
+      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
+      (omit .InfrastructureAnnotations
+        "kubectl.kubernetes.io/last-applied-configuration"
+        "gateway.istio.io/name-override"
+        "gateway.istio.io/service-account"
+        "gateway.istio.io/controller-version"
+      ) | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+spec:
+  ipFamilyPolicy: PreferDualStack
+  ports:
+  {{- range $key, $val := .Ports }}
+  - name: {{ $val.Name | quote }}
+    port: {{ $val.Port }}
+    protocol: TCP
+    appProtocol: {{ $val.AppProtocol }}
+  {{- end }}
+  selector:
+    "{{.GatewayNameLabel}}": "{{.Name}}"
+  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
+  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
+  {{- end }}
+  type: {{ .ServiceType | quote }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name:  {{.DeploymentName | quote}}
+  maxReplicas: 1
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
+
diff --git a/resources/v1.24.1/charts/istiod/templates/NOTES.txt b/resources/v1.26.5/charts/istiod/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/NOTES.txt
rename to resources/v1.26.5/charts/istiod/templates/NOTES.txt
diff --git a/resources/v1.24.1/charts/istiod/templates/_helpers.tpl b/resources/v1.26.5/charts/istiod/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/_helpers.tpl
rename to resources/v1.26.5/charts/istiod/templates/_helpers.tpl
diff --git a/resources/v1.24.1/charts/istiod/templates/autoscale.yaml b/resources/v1.26.5/charts/istiod/templates/autoscale.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/autoscale.yaml
rename to resources/v1.26.5/charts/istiod/templates/autoscale.yaml
diff --git a/resources/v1.26.5/charts/istiod/templates/clusterrole.yaml b/resources/v1.26.5/charts/istiod/templates/clusterrole.yaml
new file mode 100644
index 000000000..d4d79d00f
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/templates/clusterrole.yaml
@@ -0,0 +1,206 @@
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
+{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  # sidecar injection controller
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+
+  # configuration validation webhook controller
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update"]
+
+  # istio configuration
+  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
+  # please proceed with caution
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["get", "watch", "list"]
+    resources: ["*"]
+{{- if .Values.global.istiod.enableAnalysis }}
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["update", "patch"]
+    resources:
+    - authorizationpolicies/status
+    - destinationrules/status
+    - envoyfilters/status
+    - gateways/status
+    - peerauthentications/status
+    - proxyconfigs/status
+    - requestauthentications/status
+    - serviceentries/status
+    - sidecars/status
+    - telemetries/status
+    - virtualservices/status
+    - wasmplugins/status
+    - workloadentries/status
+    - workloadgroups/status
+{{- end }}
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "workloadentries" ]
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "workloadentries/status",  "serviceentries/status" ]
+  - apiGroups: ["security.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "authorizationpolicies/status" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "services/status" ]
+
+  # auto-detect installed CRD definitions
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+
+  # discovery and routing
+  - apiGroups: [""]
+    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+
+{{- if .Values.taint.enabled }}
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["patch"]
+{{- end }}
+
+  # ingress controller
+{{- if .Values.global.istiod.enableAnalysis }}
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["*"]
+{{- end}}
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses", "ingressclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["*"]
+
+  # required for CA's namespace controller
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create", "get", "list", "watch", "update"]
+
+  # Istiod and bootstrap.
+{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
+{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
+  - apiGroups: ["certificates.k8s.io"]
+    resources:
+      - "certificatesigningrequests"
+      - "certificatesigningrequests/approval"
+      - "certificatesigningrequests/status"
+    verbs: ["update", "create", "get", "delete", "watch"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources:
+      - "signers"
+    resourceNames:
+{{- range .Values.global.certSigners }}
+    - {{ . | quote }}
+{{- end }}
+    verbs: ["approve"]
+{{- end}}
+{{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["clustertrustbundles"]
+    verbs: ["update", "create", "delete", "list", "watch", "get"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["signers"]
+    resourceNames: ["istio.io/istiod-ca"]
+    verbs: ["attest"]
+{{- end }}
+
+  # Used by Istiod to verify the JWT tokens
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]
+
+  # Used by Istiod to verify gateway SDS
+  - apiGroups: ["authorization.k8s.io"]
+    resources: ["subjectaccessreviews"]
+    verbs: ["create"]
+
+  # Use for Kubernetes Service APIs
+  - apiGroups: ["gateway.networking.k8s.io", "gateway.networking.x-k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["gateway.networking.x-k8s.io"]
+    resources:
+    - xbackendtrafficpolicies/status
+    verbs: ["update", "patch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources:
+    - backendtlspolicies/status
+    - gatewayclasses/status
+    - gateways/status
+    - grpcroutes/status
+    - httproutes/status
+    - referencegrants/status
+    - tcproutes/status
+    - tlsroutes/status
+    - udproutes/status
+    verbs: ["update", "patch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources: ["gatewayclasses"]
+    verbs: ["create", "update", "patch", "delete"]
+
+  # Needed for multicluster secret reading, possibly ingress certs in the future
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "watch", "list"]
+
+  # Used for MCS serviceexport management
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceexports"]
+    verbs: [ "get", "watch", "list", "create", "delete"]
+
+  # Used for MCS serviceimport management
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceimports"]
+    verbs: ["get", "watch", "list"]
+---
+{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["apps"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "deployments" ]
+  - apiGroups: ["autoscaling"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "horizontalpodautoscalers" ]
+  - apiGroups: ["policy"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "poddisruptionbudgets" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "services" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "serviceaccounts"]
+{{- end }}
+{{- end }}
diff --git a/resources/v1.24.1/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.26.5/charts/istiod/templates/clusterrolebinding.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/clusterrolebinding.yaml
rename to resources/v1.26.5/charts/istiod/templates/clusterrolebinding.yaml
diff --git a/resources/v1.24.1/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.26.5/charts/istiod/templates/configmap-jwks.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/configmap-jwks.yaml
rename to resources/v1.26.5/charts/istiod/templates/configmap-jwks.yaml
diff --git a/resources/v1.26.5/charts/istiod/templates/configmap-values.yaml b/resources/v1.26.5/charts/istiod/templates/configmap-values.yaml
new file mode 100644
index 000000000..75e6e0bcc
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/templates/configmap-values.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+  original-values: |-
+{{ .Values._original | toPrettyJson | indent 4 }}
+{{- $_ := unset $.Values "_original" }}
+  merged-values: |-
+{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.25.2/charts/istiod/templates/configmap.yaml b/resources/v1.26.5/charts/istiod/templates/configmap.yaml
similarity index 100%
rename from resources/v1.25.2/charts/istiod/templates/configmap.yaml
rename to resources/v1.26.5/charts/istiod/templates/configmap.yaml
diff --git a/resources/v1.26.5/charts/istiod/templates/deployment.yaml b/resources/v1.26.5/charts/istiod/templates/deployment.yaml
new file mode 100644
index 000000000..73917d860
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/templates/deployment.yaml
@@ -0,0 +1,304 @@
+# Not created if istiod is running remotely
+{{- if not .Values.istiodRemote.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istiod
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    istio: pilot
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+{{- range $key, $val := .Values.deploymentLabels }}
+    {{ $key }}: "{{ $val }}"
+{{- end }}
+spec:
+{{- if not .Values.autoscaleEnabled }}
+{{- if .Values.replicaCount }}
+  replicas: {{ .Values.replicaCount }}
+{{- end }}
+{{- end }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingMaxSurge }}
+      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
+  selector:
+    matchLabels:
+      {{- if ne .Values.revision "" }}
+      app: istiod
+      istio.io/rev: {{ .Values.revision | default "default" | quote }}
+      {{- else }}
+      istio: pilot
+      {{- end }}
+  template:
+    metadata:
+      labels:
+        app: istiod
+        istio.io/rev: {{ .Values.revision | default "default" | quote }}
+        sidecar.istio.io/inject: "false"
+        operator.istio.io/component: "Pilot"
+        {{- if ne .Values.revision "" }}
+        istio: istiod
+        {{- else }}
+        istio: pilot
+        {{- end }}
+        {{- range $key, $val := .Values.podLabels }}
+        {{ $key }}: "{{ $val }}"
+        {{- end }}
+        istio.io/dataplane-mode: none
+        app.kubernetes.io/name: "istiod"
+        {{- include "istio.labels" . | nindent 8 }}
+      annotations:
+        prometheus.io/port: "15014"
+        prometheus.io/scrape: "true"
+        sidecar.istio.io/inject: "false"
+        {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+        {{- end }}
+    spec:
+{{- if .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 8 }}
+{{- end }}
+{{- with .Values.affinity }}
+      affinity:
+{{- toYaml . | nindent 8 }}
+{{- end }}
+      tolerations:
+        - key: cni.istio.io/not-ready
+          operator: "Exists"
+{{- with .Values.tolerations }}
+{{- toYaml . | nindent 8 }}
+{{- end }}
+{{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+{{- toYaml . | nindent 8 }}
+{{- end }}
+      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+{{- if .Values.global.priorityClassName }}
+      priorityClassName: "{{ .Values.global.priorityClassName }}"
+{{- end }}
+{{- with .Values.initContainers }}
+      initContainers:
+        {{- tpl (toYaml .) $ | nindent 8 }}
+{{- end }}
+      containers:
+        - name: discovery
+{{- if contains "/" .Values.image }}
+          image: "{{ .Values.image }}"
+{{- else }}
+          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
+{{- end }}
+{{- if .Values.global.imagePullPolicy }}
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+{{- end }}
+          args:
+          - "discovery"
+          - --monitoringAddr=:15014
+{{- if .Values.global.logging.level }}
+          - --log_output_level={{ .Values.global.logging.level }}
+{{- end}}
+{{- if .Values.global.logAsJson }}
+          - --log_as_json
+{{- end }}
+          - --domain
+          - {{ .Values.global.proxy.clusterDomain }}
+{{- if .Values.taint.namespace }}
+          - --cniNamespace={{ .Values.taint.namespace }}
+{{- end }}
+          - --keepaliveMaxServerConnectionAge
+          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
+{{- if .Values.extraContainerArgs }}
+          {{- with .Values.extraContainerArgs }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+{{- end }}
+          ports:
+          - containerPort: 8080
+            protocol: TCP
+            name: http-debug
+          - containerPort: 15010
+            protocol: TCP
+            name: grpc-xds
+          - containerPort: 15012
+            protocol: TCP
+            name: tls-xds
+          - containerPort: 15017
+            protocol: TCP
+            name: https-webhooks
+          - containerPort: 15014
+            protocol: TCP
+            name: http-monitoring
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8080
+            initialDelaySeconds: 1
+            periodSeconds: 3
+            timeoutSeconds: 5
+          env:
+          - name: REVISION
+            value: "{{ .Values.revision | default `default` }}"
+          - name: PILOT_CERT_PROVIDER
+            value: {{ .Values.global.pilotCertProvider }}
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.name
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+          - name: SERVICE_ACCOUNT
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: spec.serviceAccountName
+          - name: KUBECONFIG
+            value: /var/run/secrets/remote/config
+          # If you explicitly told us where ztunnel lives, use that.
+          # Otherwise, assume it lives in our namespace
+          # Also, check for an explicit ENV override (legacy approach) and prefer that
+          # if present
+          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
+          {{ $ztTrustedName := or .Values.trustedZtunnelName "ztunnel" }}
+          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
+          - name: CA_TRUSTED_NODE_ACCOUNTS
+            value: "{{ $ztTrustedNS }}/{{ $ztTrustedName }}"
+          {{- end }}
+          {{- if .Values.env }}
+          {{- range $key, $val := .Values.env }}
+          - name: {{ $key }}
+            value: "{{ $val }}"
+          {{- end }}
+          {{- end }}
+          {{- with .Values.envVarFrom }}
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+{{- if .Values.traceSampling }}
+          - name: PILOT_TRACE_SAMPLING
+            value: "{{ .Values.traceSampling }}"
+{{- end }}
+# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
+# don't set it here to avoid duplication.
+# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
+{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
+          - name: EXTERNAL_ISTIOD
+            value: "{{ .Values.global.externalIstiod }}"
+{{- end }}
+          - name: PILOT_ENABLE_ANALYSIS
+            value: "{{ .Values.global.istiod.enableAnalysis }}"
+          - name: CLUSTER_ID
+            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
+          - name: GOMEMLIMIT
+            valueFrom:
+              resourceFieldRef:
+                resource: limits.memory
+                divisor: "1"
+          - name: GOMAXPROCS
+            valueFrom:
+              resourceFieldRef:
+                resource: limits.cpu
+                divisor: "1"
+          - name: PLATFORM
+            value: "{{ coalesce .Values.global.platform .Values.platform }}"
+          resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 12 }}
+{{- else }}
+{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
+{{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+              - ALL
+{{- if .Values.seccompProfile }}
+            seccompProfile:
+{{ toYaml .Values.seccompProfile | trim | indent 14 }}
+{{- end }}
+          volumeMounts:
+          - name: istio-token
+            mountPath: /var/run/secrets/tokens
+            readOnly: true
+          - name: local-certs
+            mountPath: /var/run/secrets/istio-dns
+          - name: cacerts
+            mountPath: /etc/cacerts
+            readOnly: true
+          - name: istio-kubeconfig
+            mountPath: /var/run/secrets/remote
+            readOnly: true
+          {{- if .Values.jwksResolverExtraRootCA }}
+          - name: extracacerts
+            mountPath: /cacerts
+          {{- end }}
+          - name: istio-csr-dns-cert
+            mountPath: /var/run/secrets/istiod/tls
+            readOnly: true
+          - name: istio-csr-ca-configmap
+            mountPath: /var/run/secrets/istiod/ca
+            readOnly: true
+          {{- with .Values.volumeMounts }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+      volumes:
+      # Technically not needed on this pod - but it helps debugging/testing SDS
+      # Should be removed after everything works.
+      - emptyDir:
+          medium: Memory
+        name: local-certs
+      - name: istio-token
+        projected:
+          sources:
+            - serviceAccountToken:
+                audience: {{ .Values.global.sds.token.aud }}
+                expirationSeconds: 43200
+                path: istio-token
+      # Optional: user-generated root
+      - name: cacerts
+        secret:
+          secretName: cacerts
+          optional: true
+      - name: istio-kubeconfig
+        secret:
+          secretName: istio-kubeconfig
+          optional: true
+      # Optional: istio-csr dns pilot certs
+      - name: istio-csr-dns-cert
+        secret:
+          secretName: istiod-tls
+          optional: true
+      - name: istio-csr-ca-configmap
+  {{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:root-cert
+              path: root-cert.pem
+              optional: true
+  {{- else }}
+        configMap:
+          name: istio-ca-root-cert
+          defaultMode: 420
+          optional: true
+  {{- end }}
+  {{- if .Values.jwksResolverExtraRootCA }}
+      - name: extracacerts
+        configMap:
+          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  {{- end }}
+      {{- with .Values.volumes }}
+        {{- toYaml . | nindent 6}}
+      {{- end }}
+
+---
+{{- end }}
diff --git a/resources/v1.26.5/charts/istiod/templates/gateway-class-configmap.yaml b/resources/v1.26.5/charts/istiod/templates/gateway-class-configmap.yaml
new file mode 100644
index 000000000..6b23d716a
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/templates/gateway-class-configmap.yaml
@@ -0,0 +1,20 @@
+{{ range $key, $value := .Values.gatewayClasses }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-{{ $.Values.revision | default "default"  }}-gatewayclass-{{$key}}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    gateway.istio.io/defaults-for-class: {{$key|quote}}
+    {{- include "istio.labels" $ | nindent 4 }}
+data:
+{{ range $kind, $overlay := $value }}
+  {{$kind}}: |
+{{$overlay|toYaml|trim|indent 4}}
+{{ end }}
+---
+{{ end }}
diff --git a/resources/v1.26.5/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.26.5/charts/istiod/templates/istiod-injector-configmap.yaml
new file mode 100644
index 000000000..171aff886
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/templates/istiod-injector-configmap.yaml
@@ -0,0 +1,81 @@
+{{- if not .Values.global.omitSidecarInjectorConfigMap }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
+  values: |-
+{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
+{{ $pilotVals := pick .Values "cni" "env" -}}
+{{ $vals = set $vals "pilot" $pilotVals -}}
+{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
+{{ $vals = set $vals "gateways" $gatewayVals -}}
+{{ $vals | toPrettyJson | indent 4 }}
+
+  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
+  # and istiod webhook functionality.
+  #
+  # New fields should not use Values - it is a 'primary' config object, users should be able
+  # to fine tune it or use it with kube-inject.
+  config: |-
+    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
+    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
+    defaultTemplates:
+{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
+    - {{ . }}
+{{- end }}
+    {{- else }}
+    defaultTemplates: [sidecar]
+    {{- end }}
+    policy: {{ .Values.global.proxy.autoInject }}
+    alwaysInjectSelector:
+{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
+    neverInjectSelector:
+{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
+    injectedAnnotations:
+      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
+      "{{ $key }}": {{ $val | quote }}
+      {{- end }}
+    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
+         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
+         This should make it obvious that their installation is broken.
+     */}}
+    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
+    templates:
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
+      sidecar: |
+{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
+      gateway: |
+{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
+      grpc-simple: |
+{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
+      grpc-agent: |
+{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
+      waypoint: |
+{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
+      kube-gateway: |
+{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
+{{- end }}
+{{- with .Values.sidecarInjectorWebhook.templates }}
+{{ toYaml . | trim | indent 6 }}
+{{- end }}
+
+{{- end }}
diff --git a/resources/v1.24.1/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.26.5/charts/istiod/templates/mutatingwebhook.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/mutatingwebhook.yaml
rename to resources/v1.26.5/charts/istiod/templates/mutatingwebhook.yaml
diff --git a/resources/v1.24.1/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.26.5/charts/istiod/templates/poddisruptionbudget.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/poddisruptionbudget.yaml
rename to resources/v1.26.5/charts/istiod/templates/poddisruptionbudget.yaml
diff --git a/resources/v1.26.5/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.26.5/charts/istiod/templates/reader-clusterrole.yaml
new file mode 100644
index 000000000..4707c7e9f
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/templates/reader-clusterrole.yaml
@@ -0,0 +1,64 @@
+{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istio-reader
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istio-reader"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - "config.istio.io"
+      - "security.istio.io"
+      - "networking.istio.io"
+      - "authentication.istio.io"
+      - "rbac.istio.io"
+      - "telemetry.istio.io"
+      - "extensions.istio.io"
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    # TODO(keithmattix): See if we can conditionally give permission to read secrets and configmaps iff externalIstiod
+    # is enabled. Best I can tell, these two resources are only needed for configuring proxy TLS (i.e. CA certs).
+    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets", "configmaps"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list" ]
+    resources: [ "workloadentries" ]
+  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
+    resources: ["gateways"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceexports"]
+    verbs: ["get", "list", "watch", "create", "delete"]
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceimports"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]
+  - apiGroups: ["authorization.k8s.io"]
+    resources: ["subjectaccessreviews"]
+    verbs: ["create"]
+{{- if .Values.istiodRemote.enabled }}
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create", "get", "list", "watch", "update"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update"]
+{{- end}}
diff --git a/resources/v1.24.1/charts/istiod/templates/reader-clusterrolebinding.yaml b/resources/v1.26.5/charts/istiod/templates/reader-clusterrolebinding.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/reader-clusterrolebinding.yaml
rename to resources/v1.26.5/charts/istiod/templates/reader-clusterrolebinding.yaml
diff --git a/resources/v1.24.1/charts/istiod/templates/remote-istiod-endpoints.yaml b/resources/v1.26.5/charts/istiod/templates/remote-istiod-endpoints.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/remote-istiod-endpoints.yaml
rename to resources/v1.26.5/charts/istiod/templates/remote-istiod-endpoints.yaml
diff --git a/resources/v1.25.2/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.26.5/charts/istiod/templates/remote-istiod-service.yaml
similarity index 100%
rename from resources/v1.25.2/charts/istiod/templates/remote-istiod-service.yaml
rename to resources/v1.26.5/charts/istiod/templates/remote-istiod-service.yaml
diff --git a/resources/v1.26.5/charts/istiod/templates/revision-tags.yaml b/resources/v1.26.5/charts/istiod/templates/revision-tags.yaml
new file mode 100644
index 000000000..e45b5e1d4
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/templates/revision-tags.yaml
@@ -0,0 +1,148 @@
+# Adapted from istio-discovery/templates/mutatingwebhook.yaml
+# Removed paths for legacy and default selectors since a revision tag
+# is inherently created from a specific revision
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- $whv := dict
+ "revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+{{- range $tagName := $.Values.revisionTags }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq $.Release.Namespace "istio-system"}}
+  name: istio-revision-tag-{{ $tagName }}
+{{- else }}
+  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/tag: {{ $tagName }}
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+
+{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
+{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
+{{- if (eq $tagName "default") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+---
+{{- end }}
diff --git a/resources/v1.24.1/charts/istiod/templates/role.yaml b/resources/v1.26.5/charts/istiod/templates/role.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/role.yaml
rename to resources/v1.26.5/charts/istiod/templates/role.yaml
diff --git a/resources/v1.24.1/charts/istiod/templates/rolebinding.yaml b/resources/v1.26.5/charts/istiod/templates/rolebinding.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/rolebinding.yaml
rename to resources/v1.26.5/charts/istiod/templates/rolebinding.yaml
diff --git a/resources/v1.24.1/charts/istiod/templates/service.yaml b/resources/v1.26.5/charts/istiod/templates/service.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/service.yaml
rename to resources/v1.26.5/charts/istiod/templates/service.yaml
diff --git a/resources/v1.24.3/charts/istiod/templates/serviceaccount.yaml b/resources/v1.26.5/charts/istiod/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.3/charts/istiod/templates/serviceaccount.yaml
rename to resources/v1.26.5/charts/istiod/templates/serviceaccount.yaml
diff --git a/resources/v1.24.1/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.26.5/charts/istiod/templates/validatingadmissionpolicy.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/validatingadmissionpolicy.yaml
rename to resources/v1.26.5/charts/istiod/templates/validatingadmissionpolicy.yaml
diff --git a/resources/v1.24.1/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.26.5/charts/istiod/templates/validatingwebhookconfiguration.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/validatingwebhookconfiguration.yaml
rename to resources/v1.26.5/charts/istiod/templates/validatingwebhookconfiguration.yaml
diff --git a/resources/v1.24.1/charts/istiod/templates/zzy_descope_legacy.yaml b/resources/v1.26.5/charts/istiod/templates/zzy_descope_legacy.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/zzy_descope_legacy.yaml
rename to resources/v1.26.5/charts/istiod/templates/zzy_descope_legacy.yaml
diff --git a/resources/v1.25.4/charts/istiod/templates/zzz_profile.yaml b/resources/v1.26.5/charts/istiod/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.25.4/charts/istiod/templates/zzz_profile.yaml
rename to resources/v1.26.5/charts/istiod/templates/zzz_profile.yaml
diff --git a/resources/v1.26.5/charts/istiod/values.yaml b/resources/v1.26.5/charts/istiod/values.yaml
new file mode 100644
index 000000000..d920010ec
--- /dev/null
+++ b/resources/v1.26.5/charts/istiod/values.yaml
@@ -0,0 +1,553 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  autoscaleBehavior: {}
+  replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+
+  hub: ""
+  tag: ""
+  variant: ""
+
+  # Can be a full hub/image:tag
+  image: pilot
+  traceSampling: 1.0
+
+  # Resources for a small pilot install
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2048Mi
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # Whether to use an existing CNI installation
+  cni:
+    enabled: false
+    provider: default
+
+  # Additional container arguments
+  extraContainerArgs: []
+
+  env: {}
+
+  envVarFrom: []
+
+  # Settings related to the untaint controller
+  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
+  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
+  taint:
+    # Controls whether or not the untaint controller is active
+    enabled: false
+    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
+    namespace: ""
+
+  affinity: {}
+
+  tolerations: []
+
+  cpu:
+    targetAverageUtilization: 80
+  memory: {}
+    # targetAverageUtilization: 80
+
+  # Additional volumeMounts to the istiod container
+  volumeMounts: []
+
+  # Additional volumes to the istiod pod
+  volumes: []
+
+  # Inject initContainers into the istiod pod
+  initContainers: []
+
+  nodeSelector: {}
+  podAnnotations: {}
+  serviceAnnotations: {}
+  serviceAccountAnnotations: {}
+  sidecarInjectorWebhookAnnotations: {}
+
+  topologySpreadConstraints: []
+
+  # You can use jwksResolverExtraRootCA to provide a root certificate
+  # in PEM format. This will then be trusted by pilot when resolving
+  # JWKS URIs.
+  jwksResolverExtraRootCA: ""
+
+  # The following is used to limit how long a sidecar can be connected
+  # to a pilot. It balances out load across pilot instances at the cost of
+  # increasing system churn.
+  keepaliveMaxServerConnectionAge: 30m
+
+  # Additional labels to apply to the deployment.
+  deploymentLabels: {}
+
+  ## Mesh config settings
+
+  # Install the mesh config map, generated from values.yaml.
+  # If false, pilot wil use default values (by default) or user-supplied values.
+  configMap: true
+
+  # Additional labels to apply on the pod level for monitoring and logging configuration.
+  podLabels: {}
+
+  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
+  ipFamilyPolicy: ""
+  ipFamilies: []
+
+  # Ambient mode only.
+  # Set this if you install ztunnel to a different namespace from `istiod`.
+  # If set, `istiod` will allow connections from trusted node proxy ztunnels
+  # in the provided namespace.
+  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
+  # in the same namespace as itself.
+  trustedZtunnelNamespace: ""
+  # Set this if you install ztunnel with a name different from the default.
+  trustedZtunnelName: ""
+
+  sidecarInjectorWebhook:
+    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
+    # always skip the injection on pods that match that label selector, regardless of the global policy.
+    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
+    neverInjectSelector: []
+    alwaysInjectSelector: []
+
+    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
+    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
+    #
+    # annotations:
+    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+    #
+    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
+    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
+    # injectedAnnotations:
+    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
+    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
+    injectedAnnotations: {}
+
+    # This enables injection of sidecar in all namespaces,
+    # with the exception of namespaces with "istio-injection:disabled" annotation
+    # Only one environment should have this enabled.
+    enableNamespacesByDefault: false
+
+    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
+    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
+    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
+    reinvocationPolicy: Never
+
+    rewriteAppHTTPProbe: true
+
+    # Templates defines a set of custom injection templates that can be used. For example, defining:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
+    # being injected with the hello=world labels.
+    # This is intended for advanced configuration only; most users should use the built in template
+    templates: {}
+
+    # Default templates specifies a set of default templates that are used in sidecar injection.
+    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
+    # To inject other additional templates, define it using the `templates` option, and add it to
+    # the default templates list.
+    # For example:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # defaultTemplates: ["sidecar", "hello"]
+    defaultTemplates: []
+  istiodRemote:
+    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
+    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
+    # to utilize a remote instance.
+    enabled: false
+    # Sidecar injector mutating webhook configuration clientConfig.url value.
+    # For example: https://$remotePilotAddress:15017/inject
+    # The host should not refer to a service running in the cluster; use a service reference by specifying
+    # the clientConfig.service field instead.
+    injectionURL: ""
+
+    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
+    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
+    injectionPath: "/inject"
+
+    injectionCABundle: ""
+  telemetry:
+    enabled: true
+    v2:
+      # For Null VM case now.
+      # This also enables metadata exchange.
+      enabled: true
+      # Indicate if prometheus stats filter is enabled or not
+      prometheus:
+        enabled: true
+      # stackdriver filter settings.
+      stackdriver:
+        enabled: false
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # Revision tags are aliases to Istio control plane revisions
+  revisionTags: []
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
+  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
+  meshConfig:
+    enablePrometheusMerge: true
+
+  experimental:
+    stableValidationPolicy: false
+
+  global:
+    # Used to locate istiod.
+    istioNamespace: istio-system
+    # List of cert-signers to allow "approve" action in the istio cluster role
+    #
+    # certSigners:
+    #   - clusterissuers.cert-manager.io/istio-ca
+    certSigners: []
+    # enable pod disruption budget for the control plane, which is used to
+    # ensure Istio control plane components are gradually upgraded or recovered.
+    defaultPodDisruptionBudget:
+      enabled: true
+      # The values aren't mutable due to a current PodDisruptionBudget limitation
+      # minAvailable: 1
+
+    # A minimal set of requested resources to applied to all deployments so that
+    # Horizontal Pod Autoscaler will be able to function (if set).
+    # Each component can overwrite these default values by adding its own resources
+    # block in the relevant section below and setting the desired resources values.
+    defaultResources:
+      requests:
+        cpu: 10m
+      #   memory: 128Mi
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+    # Default tag for Istio images.
+    tag: 1.26.5
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Enabled by default in master for maximising testing.
+    istiod:
+      enableAnalysis: false
+
+    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
+    logAsJson: false
+
+    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+    # The control plane has different scopes depending on component, but can configure default log level across all components
+    # If empty, default scope and level will be used as configured in code
+    logging:
+      level: "default:info"
+
+    omitSidecarInjectorConfigMap: false
+
+    # Configure whether Operator manages webhook configurations. The current behavior
+    # of Istiod is to manage its own webhook configurations.
+    # When this option is set as true, Istio Operator, instead of webhooks, manages the
+    # webhook configurations. When this option is set as false, webhooks manage their
+    # own webhook configurations.
+    operatorManageWebhooks: false
+
+    # Custom DNS config for the pod to resolve names of services in other
+    # clusters. Use this to add additional search domains, and other settings.
+    # see
+    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
+    # This does not apply to gateway pods as they typically need a different
+    # set of DNS settings than the normal application pods (e.g., in
+    # multicluster scenarios).
+    # NOTE: If using templates, follow the pattern in the commented example below.
+    #podDNSSearchNamespaces:
+    #- global
+    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
+
+    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
+    # system-node-critical, it is better to configure this in order to make sure your Istio pods
+    # will not be killed because of low priority class.
+    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+    # for more detail.
+    priorityClassName: ""
+
+    proxy:
+      image: proxyv2
+
+      # This controls the 'policy' in the sidecar injector.
+      autoInject: enabled
+
+      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
+      # cluster domain. Default value is "cluster.local".
+      clusterDomain: "cluster.local"
+
+      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
+      # not set, then the global "logLevel" will be used.
+      componentLogLevel: "misc:error"
+
+      # istio ingress capture allowlist
+      # examples:
+      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
+      excludeInboundPorts: ""
+      includeInboundPorts: "*"
+
+      # istio egress capture allowlist
+      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
+      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
+      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
+      # be allowed by the sidecar
+      includeIPRanges: "*"
+      excludeIPRanges: ""
+      includeOutboundPorts: ""
+      excludeOutboundPorts: ""
+
+      # Log level for proxy, applies to gateways and sidecars.
+      # Expected values are: trace|debug|info|warning|error|critical|off
+      logLevel: warning
+
+      # Specify the path to the outlier event log.
+      # Example: /dev/stdout
+      outlierLogPath: ""
+
+      #If set to true, istio-proxy container will have privileged securityContext
+      privileged: false
+
+      # The number of successive failed probes before indicating readiness failure.
+      readinessFailureThreshold: 4
+
+      # The initial delay for readiness probes in seconds.
+      readinessInitialDelaySeconds: 0
+
+      # The period between readiness probes.
+      readinessPeriodSeconds: 15
+
+      # Enables or disables a startup probe.
+      # For optimal startup times, changing this should be tied to the readiness probe values.
+      #
+      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
+      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
+      # and doesn't spam the readiness endpoint too much
+      #
+      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
+      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
+      startupProbe:
+        enabled: true
+        failureThreshold: 600 # 10 minutes
+
+      # Resources for the sidecar.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: 2000m
+          memory: 1024Mi
+
+      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
+      statusPort: 15020
+
+      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
+      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
+      tracer: "none"
+
+    proxy_init:
+      # Base name for the proxy_init container, used to configure iptables.
+      image: proxyv2
+      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
+      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
+      forceApplyIptables: false
+
+    # configure remote pilot and istiod service and endpoint
+    remotePilotAddress: ""
+
+    ##############################################################################################
+    # The following values are found in other charts. To effectively modify these values, make   #
+    # make sure they are consistent across your Istio helm charts                                #
+    ##############################################################################################
+
+    # The customized CA address to retrieve certificates for the pods in the cluster.
+    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+    # If not set explicitly, default to the Istio discovery address.
+    caAddress: ""
+
+    # Enable control of remote clusters.
+    externalIstiod: false
+
+    # Configure a remote cluster as the config cluster for an external istiod.
+    configCluster: false
+
+    # configValidation enables the validation webhook for Istio configuration.
+    configValidation: true
+
+    # Mesh ID means Mesh Identifier. It should be unique within the scope where
+    # meshes will interact with each other, but it is not required to be
+    # globally/universally unique. For example, if any of the following are true,
+    # then two meshes must have different Mesh IDs:
+    # - Meshes will have their telemetry aggregated in one place
+    # - Meshes will be federated together
+    # - Policy will be written referencing one mesh from the other
+    #
+    # If an administrator expects that any of these conditions may become true in
+    # the future, they should ensure their meshes have different Mesh IDs
+    # assigned.
+    #
+    # Within a multicluster mesh, each cluster must be (manually or auto)
+    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
+    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
+    # of migration TBD, and it may be a disruptive operation to change the Mesh
+    # ID post-install.
+    #
+    # If the mesh admin does not specify a value, Istio will use the value of the
+    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
+    # value.
+    meshID: ""
+
+    # Configure the mesh networks to be used by the Split Horizon EDS.
+    #
+    # The following example defines two networks with different endpoints association methods.
+    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
+    # mapped to network1. The gateway for this network example is specified by its public IP
+    # address and port.
+    # The second network, `network2`, in this example is defined differently with all endpoints
+    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
+    # gateway is also defined differently with the name of the gateway service on the remote
+    # cluster. The public IP for the gateway will be determined from that remote service (only
+    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
+    # it still need to be configured manually).
+    #
+    # meshNetworks:
+    #   network1:
+    #     endpoints:
+    #     - fromCidr: "192.168.0.1/24"
+    #     gateways:
+    #     - address: 1.1.1.1
+    #       port: 80
+    #   network2:
+    #     endpoints:
+    #     - fromRegistry: reg1
+    #     gateways:
+    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
+    #       port: 443
+    #
+    meshNetworks: {}
+
+    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
+    mountMtlsCerts: false
+
+    multiCluster:
+      # Set to true to connect two kubernetes clusters via their respective
+      # ingressgateway services when pods in each cluster cannot directly
+      # talk to one another. All clusters should be using Istio mTLS and must
+      # have a shared root CA for this model to work.
+      enabled: false
+      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
+      # to properly label proxies
+      clusterName: ""
+
+    # Network defines the network this cluster belong to. This name
+    # corresponds to the networks in the map of mesh networks.
+    network: ""
+
+    # Configure the certificate provider for control plane communication.
+    # Currently, two providers are supported: "kubernetes" and "istiod".
+    # As some platforms may not have kubernetes signing APIs,
+    # Istiod is the default
+    pilotCertProvider: istiod
+
+    sds:
+      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
+      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
+      # JWT is intended for the CA.
+      token:
+        aud: istio-ca
+
+    sts:
+      # The service port used by Security Token Service (STS) server to handle token exchange requests.
+      # Setting this port to a non-zero value enables STS server.
+      servicePort: 0
+
+    # The name of the CA for workload certificates.
+    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
+    # will be used as the certificates for workloads.
+    # The default value is "" and when caName="", the CA will be configured by other
+    # mechanisms (e.g., environmental variable CA_PROVIDER).
+    caName: ""
+
+    waypoint:
+      # Resources for the waypoint proxy.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: "2"
+          memory: 1Gi
+
+      # If specified, affinity defines the scheduling constraints of waypoint pods.
+      affinity: {}
+
+      # Topology Spread Constraints for the waypoint proxy.
+      topologySpreadConstraints: []
+
+      # Node labels for the waypoint proxy.
+      nodeSelector: {}
+
+      # Tolerations for the waypoint proxy.
+      tolerations: []
+
+  base:
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  # Gateway Settings
+  gateways:
+    # Define the security context for the pod.
+    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+    securityContext: {}
+
+    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
+    seccompProfile: {}
+
+  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
+  # For example:
+  # gatewayClasses:
+  #   istio:
+  #     service:
+  #       spec:
+  #         type: ClusterIP
+  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
+  gatewayClasses: {}
diff --git a/resources/v1.26.5/charts/revisiontags/Chart.yaml b/resources/v1.26.5/charts/revisiontags/Chart.yaml
new file mode 100644
index 000000000..79521f5b3
--- /dev/null
+++ b/resources/v1.26.5/charts/revisiontags/Chart.yaml
@@ -0,0 +1,8 @@
+apiVersion: v2
+appVersion: 1.26.5
+description: Helm chart for istio revision tags
+name: revisiontags
+sources:
+- https://github.com/istio-ecosystem/sail-operator
+version: 0.1.0
+
diff --git a/resources/v1.24.1/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.26.5/charts/revisiontags/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.1/charts/revisiontags/files/profile-ambient.yaml
rename to resources/v1.26.5/charts/revisiontags/files/profile-ambient.yaml
diff --git a/resources/v1.26.5/charts/revisiontags/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.5/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.5/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.5/charts/revisiontags/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.5/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.5/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.5/charts/revisiontags/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.5/charts/revisiontags/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.5/charts/revisiontags/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.2/charts/revisiontags/files/profile-demo.yaml b/resources/v1.26.5/charts/revisiontags/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.2/charts/revisiontags/files/profile-demo.yaml
rename to resources/v1.26.5/charts/revisiontags/files/profile-demo.yaml
diff --git a/resources/v1.26.5/charts/revisiontags/files/profile-platform-gke.yaml b/resources/v1.26.5/charts/revisiontags/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.26.5/charts/revisiontags/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.1/charts/revisiontags/files/profile-platform-k3d.yaml b/resources/v1.26.5/charts/revisiontags/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.1/charts/revisiontags/files/profile-platform-k3d.yaml
rename to resources/v1.26.5/charts/revisiontags/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.2/charts/revisiontags/files/profile-platform-k3s.yaml b/resources/v1.26.5/charts/revisiontags/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.2/charts/revisiontags/files/profile-platform-k3s.yaml
rename to resources/v1.26.5/charts/revisiontags/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.1/charts/revisiontags/files/profile-platform-microk8s.yaml b/resources/v1.26.5/charts/revisiontags/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.1/charts/revisiontags/files/profile-platform-microk8s.yaml
rename to resources/v1.26.5/charts/revisiontags/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.1/charts/revisiontags/files/profile-platform-minikube.yaml b/resources/v1.26.5/charts/revisiontags/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.1/charts/revisiontags/files/profile-platform-minikube.yaml
rename to resources/v1.26.5/charts/revisiontags/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.1/charts/revisiontags/files/profile-platform-openshift.yaml b/resources/v1.26.5/charts/revisiontags/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.1/charts/revisiontags/files/profile-platform-openshift.yaml
rename to resources/v1.26.5/charts/revisiontags/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.1/charts/revisiontags/files/profile-preview.yaml b/resources/v1.26.5/charts/revisiontags/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.1/charts/revisiontags/files/profile-preview.yaml
rename to resources/v1.26.5/charts/revisiontags/files/profile-preview.yaml
diff --git a/resources/v1.24.1/charts/revisiontags/files/profile-remote.yaml b/resources/v1.26.5/charts/revisiontags/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.1/charts/revisiontags/files/profile-remote.yaml
rename to resources/v1.26.5/charts/revisiontags/files/profile-remote.yaml
diff --git a/resources/v1.24.1/charts/revisiontags/files/profile-stable.yaml b/resources/v1.26.5/charts/revisiontags/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.1/charts/revisiontags/files/profile-stable.yaml
rename to resources/v1.26.5/charts/revisiontags/files/profile-stable.yaml
diff --git a/resources/v1.26.5/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.26.5/charts/revisiontags/templates/revision-tags.yaml
new file mode 100644
index 000000000..e45b5e1d4
--- /dev/null
+++ b/resources/v1.26.5/charts/revisiontags/templates/revision-tags.yaml
@@ -0,0 +1,148 @@
+# Adapted from istio-discovery/templates/mutatingwebhook.yaml
+# Removed paths for legacy and default selectors since a revision tag
+# is inherently created from a specific revision
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- $whv := dict
+ "revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+{{- range $tagName := $.Values.revisionTags }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq $.Release.Namespace "istio-system"}}
+  name: istio-revision-tag-{{ $tagName }}
+{{- else }}
+  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/tag: {{ $tagName }}
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+
+{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
+{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
+{{- if (eq $tagName "default") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+---
+{{- end }}
diff --git a/resources/v1.25.4/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.26.5/charts/revisiontags/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.25.4/charts/revisiontags/templates/zzz_profile.yaml
rename to resources/v1.26.5/charts/revisiontags/templates/zzz_profile.yaml
diff --git a/resources/v1.26.5/charts/revisiontags/values.yaml b/resources/v1.26.5/charts/revisiontags/values.yaml
new file mode 100644
index 000000000..d920010ec
--- /dev/null
+++ b/resources/v1.26.5/charts/revisiontags/values.yaml
@@ -0,0 +1,553 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  autoscaleBehavior: {}
+  replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+
+  hub: ""
+  tag: ""
+  variant: ""
+
+  # Can be a full hub/image:tag
+  image: pilot
+  traceSampling: 1.0
+
+  # Resources for a small pilot install
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2048Mi
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # Whether to use an existing CNI installation
+  cni:
+    enabled: false
+    provider: default
+
+  # Additional container arguments
+  extraContainerArgs: []
+
+  env: {}
+
+  envVarFrom: []
+
+  # Settings related to the untaint controller
+  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
+  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
+  taint:
+    # Controls whether or not the untaint controller is active
+    enabled: false
+    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
+    namespace: ""
+
+  affinity: {}
+
+  tolerations: []
+
+  cpu:
+    targetAverageUtilization: 80
+  memory: {}
+    # targetAverageUtilization: 80
+
+  # Additional volumeMounts to the istiod container
+  volumeMounts: []
+
+  # Additional volumes to the istiod pod
+  volumes: []
+
+  # Inject initContainers into the istiod pod
+  initContainers: []
+
+  nodeSelector: {}
+  podAnnotations: {}
+  serviceAnnotations: {}
+  serviceAccountAnnotations: {}
+  sidecarInjectorWebhookAnnotations: {}
+
+  topologySpreadConstraints: []
+
+  # You can use jwksResolverExtraRootCA to provide a root certificate
+  # in PEM format. This will then be trusted by pilot when resolving
+  # JWKS URIs.
+  jwksResolverExtraRootCA: ""
+
+  # The following is used to limit how long a sidecar can be connected
+  # to a pilot. It balances out load across pilot instances at the cost of
+  # increasing system churn.
+  keepaliveMaxServerConnectionAge: 30m
+
+  # Additional labels to apply to the deployment.
+  deploymentLabels: {}
+
+  ## Mesh config settings
+
+  # Install the mesh config map, generated from values.yaml.
+  # If false, pilot wil use default values (by default) or user-supplied values.
+  configMap: true
+
+  # Additional labels to apply on the pod level for monitoring and logging configuration.
+  podLabels: {}
+
+  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
+  ipFamilyPolicy: ""
+  ipFamilies: []
+
+  # Ambient mode only.
+  # Set this if you install ztunnel to a different namespace from `istiod`.
+  # If set, `istiod` will allow connections from trusted node proxy ztunnels
+  # in the provided namespace.
+  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
+  # in the same namespace as itself.
+  trustedZtunnelNamespace: ""
+  # Set this if you install ztunnel with a name different from the default.
+  trustedZtunnelName: ""
+
+  sidecarInjectorWebhook:
+    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
+    # always skip the injection on pods that match that label selector, regardless of the global policy.
+    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
+    neverInjectSelector: []
+    alwaysInjectSelector: []
+
+    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
+    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
+    #
+    # annotations:
+    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+    #
+    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
+    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
+    # injectedAnnotations:
+    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
+    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
+    injectedAnnotations: {}
+
+    # This enables injection of sidecar in all namespaces,
+    # with the exception of namespaces with "istio-injection:disabled" annotation
+    # Only one environment should have this enabled.
+    enableNamespacesByDefault: false
+
+    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
+    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
+    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
+    reinvocationPolicy: Never
+
+    rewriteAppHTTPProbe: true
+
+    # Templates defines a set of custom injection templates that can be used. For example, defining:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
+    # being injected with the hello=world labels.
+    # This is intended for advanced configuration only; most users should use the built in template
+    templates: {}
+
+    # Default templates specifies a set of default templates that are used in sidecar injection.
+    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
+    # To inject other additional templates, define it using the `templates` option, and add it to
+    # the default templates list.
+    # For example:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # defaultTemplates: ["sidecar", "hello"]
+    defaultTemplates: []
+  istiodRemote:
+    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
+    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
+    # to utilize a remote instance.
+    enabled: false
+    # Sidecar injector mutating webhook configuration clientConfig.url value.
+    # For example: https://$remotePilotAddress:15017/inject
+    # The host should not refer to a service running in the cluster; use a service reference by specifying
+    # the clientConfig.service field instead.
+    injectionURL: ""
+
+    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
+    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
+    injectionPath: "/inject"
+
+    injectionCABundle: ""
+  telemetry:
+    enabled: true
+    v2:
+      # For Null VM case now.
+      # This also enables metadata exchange.
+      enabled: true
+      # Indicate if prometheus stats filter is enabled or not
+      prometheus:
+        enabled: true
+      # stackdriver filter settings.
+      stackdriver:
+        enabled: false
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # Revision tags are aliases to Istio control plane revisions
+  revisionTags: []
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
+  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
+  meshConfig:
+    enablePrometheusMerge: true
+
+  experimental:
+    stableValidationPolicy: false
+
+  global:
+    # Used to locate istiod.
+    istioNamespace: istio-system
+    # List of cert-signers to allow "approve" action in the istio cluster role
+    #
+    # certSigners:
+    #   - clusterissuers.cert-manager.io/istio-ca
+    certSigners: []
+    # enable pod disruption budget for the control plane, which is used to
+    # ensure Istio control plane components are gradually upgraded or recovered.
+    defaultPodDisruptionBudget:
+      enabled: true
+      # The values aren't mutable due to a current PodDisruptionBudget limitation
+      # minAvailable: 1
+
+    # A minimal set of requested resources to applied to all deployments so that
+    # Horizontal Pod Autoscaler will be able to function (if set).
+    # Each component can overwrite these default values by adding its own resources
+    # block in the relevant section below and setting the desired resources values.
+    defaultResources:
+      requests:
+        cpu: 10m
+      #   memory: 128Mi
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+    # Default tag for Istio images.
+    tag: 1.26.5
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Enabled by default in master for maximising testing.
+    istiod:
+      enableAnalysis: false
+
+    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
+    logAsJson: false
+
+    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+    # The control plane has different scopes depending on component, but can configure default log level across all components
+    # If empty, default scope and level will be used as configured in code
+    logging:
+      level: "default:info"
+
+    omitSidecarInjectorConfigMap: false
+
+    # Configure whether Operator manages webhook configurations. The current behavior
+    # of Istiod is to manage its own webhook configurations.
+    # When this option is set as true, Istio Operator, instead of webhooks, manages the
+    # webhook configurations. When this option is set as false, webhooks manage their
+    # own webhook configurations.
+    operatorManageWebhooks: false
+
+    # Custom DNS config for the pod to resolve names of services in other
+    # clusters. Use this to add additional search domains, and other settings.
+    # see
+    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
+    # This does not apply to gateway pods as they typically need a different
+    # set of DNS settings than the normal application pods (e.g., in
+    # multicluster scenarios).
+    # NOTE: If using templates, follow the pattern in the commented example below.
+    #podDNSSearchNamespaces:
+    #- global
+    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
+
+    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
+    # system-node-critical, it is better to configure this in order to make sure your Istio pods
+    # will not be killed because of low priority class.
+    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+    # for more detail.
+    priorityClassName: ""
+
+    proxy:
+      image: proxyv2
+
+      # This controls the 'policy' in the sidecar injector.
+      autoInject: enabled
+
+      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
+      # cluster domain. Default value is "cluster.local".
+      clusterDomain: "cluster.local"
+
+      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
+      # not set, then the global "logLevel" will be used.
+      componentLogLevel: "misc:error"
+
+      # istio ingress capture allowlist
+      # examples:
+      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
+      excludeInboundPorts: ""
+      includeInboundPorts: "*"
+
+      # istio egress capture allowlist
+      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
+      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
+      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
+      # be allowed by the sidecar
+      includeIPRanges: "*"
+      excludeIPRanges: ""
+      includeOutboundPorts: ""
+      excludeOutboundPorts: ""
+
+      # Log level for proxy, applies to gateways and sidecars.
+      # Expected values are: trace|debug|info|warning|error|critical|off
+      logLevel: warning
+
+      # Specify the path to the outlier event log.
+      # Example: /dev/stdout
+      outlierLogPath: ""
+
+      #If set to true, istio-proxy container will have privileged securityContext
+      privileged: false
+
+      # The number of successive failed probes before indicating readiness failure.
+      readinessFailureThreshold: 4
+
+      # The initial delay for readiness probes in seconds.
+      readinessInitialDelaySeconds: 0
+
+      # The period between readiness probes.
+      readinessPeriodSeconds: 15
+
+      # Enables or disables a startup probe.
+      # For optimal startup times, changing this should be tied to the readiness probe values.
+      #
+      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
+      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
+      # and doesn't spam the readiness endpoint too much
+      #
+      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
+      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
+      startupProbe:
+        enabled: true
+        failureThreshold: 600 # 10 minutes
+
+      # Resources for the sidecar.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: 2000m
+          memory: 1024Mi
+
+      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
+      statusPort: 15020
+
+      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
+      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
+      tracer: "none"
+
+    proxy_init:
+      # Base name for the proxy_init container, used to configure iptables.
+      image: proxyv2
+      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
+      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
+      forceApplyIptables: false
+
+    # configure remote pilot and istiod service and endpoint
+    remotePilotAddress: ""
+
+    ##############################################################################################
+    # The following values are found in other charts. To effectively modify these values, make   #
+    # make sure they are consistent across your Istio helm charts                                #
+    ##############################################################################################
+
+    # The customized CA address to retrieve certificates for the pods in the cluster.
+    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+    # If not set explicitly, default to the Istio discovery address.
+    caAddress: ""
+
+    # Enable control of remote clusters.
+    externalIstiod: false
+
+    # Configure a remote cluster as the config cluster for an external istiod.
+    configCluster: false
+
+    # configValidation enables the validation webhook for Istio configuration.
+    configValidation: true
+
+    # Mesh ID means Mesh Identifier. It should be unique within the scope where
+    # meshes will interact with each other, but it is not required to be
+    # globally/universally unique. For example, if any of the following are true,
+    # then two meshes must have different Mesh IDs:
+    # - Meshes will have their telemetry aggregated in one place
+    # - Meshes will be federated together
+    # - Policy will be written referencing one mesh from the other
+    #
+    # If an administrator expects that any of these conditions may become true in
+    # the future, they should ensure their meshes have different Mesh IDs
+    # assigned.
+    #
+    # Within a multicluster mesh, each cluster must be (manually or auto)
+    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
+    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
+    # of migration TBD, and it may be a disruptive operation to change the Mesh
+    # ID post-install.
+    #
+    # If the mesh admin does not specify a value, Istio will use the value of the
+    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
+    # value.
+    meshID: ""
+
+    # Configure the mesh networks to be used by the Split Horizon EDS.
+    #
+    # The following example defines two networks with different endpoints association methods.
+    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
+    # mapped to network1. The gateway for this network example is specified by its public IP
+    # address and port.
+    # The second network, `network2`, in this example is defined differently with all endpoints
+    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
+    # gateway is also defined differently with the name of the gateway service on the remote
+    # cluster. The public IP for the gateway will be determined from that remote service (only
+    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
+    # it still need to be configured manually).
+    #
+    # meshNetworks:
+    #   network1:
+    #     endpoints:
+    #     - fromCidr: "192.168.0.1/24"
+    #     gateways:
+    #     - address: 1.1.1.1
+    #       port: 80
+    #   network2:
+    #     endpoints:
+    #     - fromRegistry: reg1
+    #     gateways:
+    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
+    #       port: 443
+    #
+    meshNetworks: {}
+
+    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
+    mountMtlsCerts: false
+
+    multiCluster:
+      # Set to true to connect two kubernetes clusters via their respective
+      # ingressgateway services when pods in each cluster cannot directly
+      # talk to one another. All clusters should be using Istio mTLS and must
+      # have a shared root CA for this model to work.
+      enabled: false
+      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
+      # to properly label proxies
+      clusterName: ""
+
+    # Network defines the network this cluster belong to. This name
+    # corresponds to the networks in the map of mesh networks.
+    network: ""
+
+    # Configure the certificate provider for control plane communication.
+    # Currently, two providers are supported: "kubernetes" and "istiod".
+    # As some platforms may not have kubernetes signing APIs,
+    # Istiod is the default
+    pilotCertProvider: istiod
+
+    sds:
+      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
+      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
+      # JWT is intended for the CA.
+      token:
+        aud: istio-ca
+
+    sts:
+      # The service port used by Security Token Service (STS) server to handle token exchange requests.
+      # Setting this port to a non-zero value enables STS server.
+      servicePort: 0
+
+    # The name of the CA for workload certificates.
+    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
+    # will be used as the certificates for workloads.
+    # The default value is "" and when caName="", the CA will be configured by other
+    # mechanisms (e.g., environmental variable CA_PROVIDER).
+    caName: ""
+
+    waypoint:
+      # Resources for the waypoint proxy.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: "2"
+          memory: 1Gi
+
+      # If specified, affinity defines the scheduling constraints of waypoint pods.
+      affinity: {}
+
+      # Topology Spread Constraints for the waypoint proxy.
+      topologySpreadConstraints: []
+
+      # Node labels for the waypoint proxy.
+      nodeSelector: {}
+
+      # Tolerations for the waypoint proxy.
+      tolerations: []
+
+  base:
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  # Gateway Settings
+  gateways:
+    # Define the security context for the pod.
+    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+    securityContext: {}
+
+    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
+    seccompProfile: {}
+
+  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
+  # For example:
+  # gatewayClasses:
+  #   istio:
+  #     service:
+  #       spec:
+  #         type: ClusterIP
+  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
+  gatewayClasses: {}
diff --git a/resources/v1.26.5/charts/ztunnel/Chart.yaml b/resources/v1.26.5/charts/ztunnel/Chart.yaml
new file mode 100644
index 000000000..e88d7c36c
--- /dev/null
+++ b/resources/v1.26.5/charts/ztunnel/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+appVersion: 1.26.5
+description: Helm chart for istio ztunnel components
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio-ztunnel
+- istio
+name: ztunnel
+sources:
+- https://github.com/istio/istio
+version: 1.26.5
diff --git a/resources/v1.24.1/charts/ztunnel/README.md b/resources/v1.26.5/charts/ztunnel/README.md
similarity index 100%
rename from resources/v1.24.1/charts/ztunnel/README.md
rename to resources/v1.26.5/charts/ztunnel/README.md
diff --git a/resources/v1.24.1/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.26.5/charts/ztunnel/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.1/charts/ztunnel/files/profile-ambient.yaml
rename to resources/v1.26.5/charts/ztunnel/files/profile-ambient.yaml
diff --git a/resources/v1.26.5/charts/ztunnel/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.5/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.5/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.5/charts/ztunnel/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.5/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.5/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.5/charts/ztunnel/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.5/charts/ztunnel/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.5/charts/ztunnel/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.2/charts/ztunnel/files/profile-demo.yaml b/resources/v1.26.5/charts/ztunnel/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.2/charts/ztunnel/files/profile-demo.yaml
rename to resources/v1.26.5/charts/ztunnel/files/profile-demo.yaml
diff --git a/resources/v1.26.5/charts/ztunnel/files/profile-platform-gke.yaml b/resources/v1.26.5/charts/ztunnel/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.26.5/charts/ztunnel/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.1/charts/ztunnel/files/profile-platform-k3d.yaml b/resources/v1.26.5/charts/ztunnel/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.1/charts/ztunnel/files/profile-platform-k3d.yaml
rename to resources/v1.26.5/charts/ztunnel/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.2/charts/ztunnel/files/profile-platform-k3s.yaml b/resources/v1.26.5/charts/ztunnel/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.2/charts/ztunnel/files/profile-platform-k3s.yaml
rename to resources/v1.26.5/charts/ztunnel/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.1/charts/ztunnel/files/profile-platform-microk8s.yaml b/resources/v1.26.5/charts/ztunnel/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.1/charts/ztunnel/files/profile-platform-microk8s.yaml
rename to resources/v1.26.5/charts/ztunnel/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.1/charts/ztunnel/files/profile-platform-minikube.yaml b/resources/v1.26.5/charts/ztunnel/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.1/charts/ztunnel/files/profile-platform-minikube.yaml
rename to resources/v1.26.5/charts/ztunnel/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.1/charts/ztunnel/files/profile-platform-openshift.yaml b/resources/v1.26.5/charts/ztunnel/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.1/charts/ztunnel/files/profile-platform-openshift.yaml
rename to resources/v1.26.5/charts/ztunnel/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.1/charts/ztunnel/files/profile-preview.yaml b/resources/v1.26.5/charts/ztunnel/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.1/charts/ztunnel/files/profile-preview.yaml
rename to resources/v1.26.5/charts/ztunnel/files/profile-preview.yaml
diff --git a/resources/v1.24.1/charts/ztunnel/files/profile-remote.yaml b/resources/v1.26.5/charts/ztunnel/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.1/charts/ztunnel/files/profile-remote.yaml
rename to resources/v1.26.5/charts/ztunnel/files/profile-remote.yaml
diff --git a/resources/v1.24.1/charts/ztunnel/files/profile-stable.yaml b/resources/v1.26.5/charts/ztunnel/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.1/charts/ztunnel/files/profile-stable.yaml
rename to resources/v1.26.5/charts/ztunnel/files/profile-stable.yaml
diff --git a/resources/v1.24.1/charts/ztunnel/templates/NOTES.txt b/resources/v1.26.5/charts/ztunnel/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.1/charts/ztunnel/templates/NOTES.txt
rename to resources/v1.26.5/charts/ztunnel/templates/NOTES.txt
diff --git a/resources/v1.26.5/charts/ztunnel/templates/_helpers.tpl b/resources/v1.26.5/charts/ztunnel/templates/_helpers.tpl
new file mode 100644
index 000000000..46a7a0b79
--- /dev/null
+++ b/resources/v1.26.5/charts/ztunnel/templates/_helpers.tpl
@@ -0,0 +1 @@
+{{ define "ztunnel.release-name" }}{{ .Values.resourceName| default "ztunnel" }}{{ end }}
diff --git a/resources/v1.26.5/charts/ztunnel/templates/daemonset.yaml b/resources/v1.26.5/charts/ztunnel/templates/daemonset.yaml
new file mode 100644
index 000000000..720970c97
--- /dev/null
+++ b/resources/v1.26.5/charts/ztunnel/templates/daemonset.yaml
@@ -0,0 +1,205 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
+  annotations:
+{{- if .Values.revision }}
+    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
+    {{- toYaml $annos | nindent 4}}
+{{- else }}
+    {{- .Values.annotations | toYaml | nindent 4 }}
+{{- end }}
+spec:
+  {{- with .Values.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app: ztunnel
+  template:
+    metadata:
+      labels:
+        sidecar.istio.io/inject: "false"
+        istio.io/dataplane-mode: none
+        app: ztunnel
+        app.kubernetes.io/name: ztunnel
+        {{- include "istio.labels" . | nindent 8}}
+{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+{{- if .Values.revision }}
+        istio.io/rev: {{ .Values.revision }}
+{{- end }}
+{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
+    spec:
+      nodeSelector:
+        kubernetes.io/os: linux
+{{- if .Values.nodeSelector }}
+{{ toYaml .Values.nodeSelector | indent 8 }}
+{{- end }}
+{{- if .Values.affinity }}
+      affinity:
+{{ toYaml .Values.affinity | trim | indent 8 }}
+{{- end }}
+      serviceAccountName: {{ include "ztunnel.release-name" . }}
+      tolerations:
+        - effect: NoSchedule
+          operator: Exists
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - effect: NoExecute
+          operator: Exists
+      containers:
+      - name: istio-proxy
+{{- if contains "/" .Values.image }}
+        image: "{{ .Values.image }}"
+{{- else }}
+        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
+{{- end }}
+        ports:
+        - containerPort: 15020
+          name: ztunnel-stats
+          protocol: TCP
+        resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 10 }}
+{{- end }}
+{{- with .Values.imagePullPolicy }}
+        imagePullPolicy: {{ . }}
+{{- end }}
+        securityContext:
+          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
+          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
+          allowPrivilegeEscalation: true
+          privileged: false
+          capabilities:
+            drop:
+            - ALL
+            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
+            - NET_ADMIN # Required for TPROXY and setsockopt
+            - SYS_ADMIN # Required for `setns` - doing things in other netns
+            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
+          readOnlyRootFilesystem: true
+          runAsGroup: 1337
+          runAsNonRoot: false
+          runAsUser: 0
+{{- if .Values.seLinuxOptions }}
+          seLinuxOptions:
+{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
+{{- end }}
+        readinessProbe:
+          httpGet:
+            port: 15021
+            path: /healthz/ready
+        args:
+        - proxy
+        - ztunnel
+        env:
+        - name: CA_ADDRESS
+        {{- if .Values.caAddress }}
+          value: {{ .Values.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: XDS_ADDRESS
+        {{- if .Values.xdsAddress }}
+          value: {{ .Values.xdsAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
+        {{- end }}
+        {{- if .Values.logAsJson }}
+        - name: LOG_FORMAT
+          value: json
+        {{- end}}
+        - name: RUST_LOG
+          value: {{ .Values.logLevel | quote }}
+        - name: RUST_BACKTRACE
+          value: "1"
+        - name: ISTIO_META_CLUSTER_ID
+          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
+        - name: INPOD_ENABLED
+          value: "true"
+        - name: TERMINATION_GRACE_PERIOD_SECONDS
+          value: "{{ .Values.terminationGracePeriodSeconds }}"
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
+        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- end }}
+        {{- with .Values.env }}
+        {{- range $key, $val := . }}
+        - name: {{ $key }}
+          value: "{{ $val }}"
+        {{- end }}
+        {{- end }}
+        volumeMounts:
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - mountPath: /var/run/ztunnel
+          name: cni-ztunnel-sock-dir
+        - mountPath: /tmp
+          name: tmp
+        {{- with .Values.volumeMounts }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+      priorityClassName: system-node-critical
+      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
+      volumes:
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: istio-token
+              expirationSeconds: 43200
+              audience: istio-ca
+      - name: istiod-ca-cert
+        {{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:root-cert
+              path: root-cert.pem
+        {{- else }}
+        configMap:
+          name: istio-ca-root-cert
+        {{- end }}
+      - name: cni-ztunnel-sock-dir
+        hostPath:
+          path: /var/run/ztunnel
+          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
+      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
+      - name: tmp
+        emptyDir: {}
+      {{- with .Values.volumes }}
+        {{- toYaml . | nindent 6}}
+      {{- end }}
diff --git a/resources/v1.25.2/charts/ztunnel/templates/rbac.yaml b/resources/v1.26.5/charts/ztunnel/templates/rbac.yaml
similarity index 100%
rename from resources/v1.25.2/charts/ztunnel/templates/rbac.yaml
rename to resources/v1.26.5/charts/ztunnel/templates/rbac.yaml
diff --git a/resources/v1.26.5/charts/ztunnel/templates/resourcequota.yaml b/resources/v1.26.5/charts/ztunnel/templates/resourcequota.yaml
new file mode 100644
index 000000000..a1c0e5496
--- /dev/null
+++ b/resources/v1.26.5/charts/ztunnel/templates/resourcequota.yaml
@@ -0,0 +1,20 @@
+{{- if .Values.resourceQuotas.enabled }}
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
+spec:
+  hard:
+    pods: {{ .Values.resourceQuotas.pods | quote }}
+  scopeSelector:
+    matchExpressions:
+    - operator: In
+      scopeName: PriorityClass
+      values:
+      - system-node-critical
+{{- end }}
diff --git a/resources/v1.26.5/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.26.5/charts/ztunnel/templates/zzz_profile.yaml
new file mode 100644
index 000000000..606c55669
--- /dev/null
+++ b/resources/v1.26.5/charts/ztunnel/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if true }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.26.5/charts/ztunnel/values.yaml b/resources/v1.26.5/charts/ztunnel/values.yaml
new file mode 100644
index 000000000..10b86fe72
--- /dev/null
+++ b/resources/v1.26.5/charts/ztunnel/values.yaml
@@ -0,0 +1,114 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
+  hub: gcr.io/istio-release
+  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
+  tag: 1.26.5
+  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
+  variant: ""
+
+  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
+  # If Image contains a "/", it will replace the entire `image` in the pod.
+  image: ztunnel
+
+  # resourceName, if set, will override the naming of resources. If not set, will default to 'ztunnel'.
+  # If you set this, you MUST also set `trustedZtunnelName` in the `istiod` chart.
+  resourceName: ""
+
+  # Labels to apply to all top level resources
+  labels: {}
+  # Annotations to apply to all top level resources
+  annotations: {}
+
+  # Additional volumeMounts to the ztunnel container
+  volumeMounts: []
+
+  # Additional volumes to the ztunnel pod
+  volumes: []
+
+  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
+  podAnnotations:
+    prometheus.io/port: "15020"
+    prometheus.io/scrape: "true"
+
+  # Additional labels to apply on the pod level
+  podLabels: {}
+
+  # Pod resource configuration
+  resources:
+    requests:
+      cpu: 200m
+      # Ztunnel memory scales with the size of the cluster and traffic load
+      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
+      memory: 512Mi
+
+  resourceQuotas:
+    enabled: false
+    pods: 5000
+
+  # List of secret names to add to the service account as image pull secrets
+  imagePullSecrets: []
+
+  # A `key: value` mapping of environment variables to add to the pod
+  env: {}
+
+  # Override for the pod imagePullPolicy
+  imagePullPolicy: ""
+
+  # Settings for multicluster
+  multiCluster:
+    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
+    # with Istiod configuration.
+    clusterName: ""
+
+  # meshConfig defines runtime configuration of components.
+  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
+  # components.
+  # TODO: https://github.com/istio/istio/issues/43248
+  meshConfig:
+    defaultConfig:
+      proxyMetadata: {}
+
+  # This value defines:
+  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
+  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
+  # Default K8S value is 30 seconds
+  terminationGracePeriodSeconds: 30
+
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
+  revision: ""
+
+  # The customized CA address to retrieve certificates for the pods in the cluster.
+  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+  caAddress: ""
+
+  # The customized XDS address to retrieve configuration.
+  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
+  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
+  xdsAddress: ""
+
+  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
+  istioNamespace: istio-system
+
+  # Configuration log level of ztunnel binary, default is info.
+  # Valid values are: trace, debug, info, warn, error
+  logLevel: info
+
+  # To output all logs in json format
+  logAsJson: false
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seLinuxOptions: {}
+  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
+  #seLinuxOptions:
+  #  type: spc_t
+
+  # K8s DaemonSet update strategy.
+  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
diff --git a/resources/v1.26.5/cni-1.26.5.tgz.etag b/resources/v1.26.5/cni-1.26.5.tgz.etag
new file mode 100644
index 000000000..ca9ea4df2
--- /dev/null
+++ b/resources/v1.26.5/cni-1.26.5.tgz.etag
@@ -0,0 +1 @@
+2380f90e769c09ac48696d669f5faf9b
diff --git a/resources/v1.26.5/commit b/resources/v1.26.5/commit
new file mode 100644
index 000000000..8fe00a57f
--- /dev/null
+++ b/resources/v1.26.5/commit
@@ -0,0 +1 @@
+1.26.5
diff --git a/resources/v1.26.5/gateway-1.26.5.tgz.etag b/resources/v1.26.5/gateway-1.26.5.tgz.etag
new file mode 100644
index 000000000..64a5a87a1
--- /dev/null
+++ b/resources/v1.26.5/gateway-1.26.5.tgz.etag
@@ -0,0 +1 @@
+8408b19fb295e218beeb16e15fd9860a
diff --git a/resources/v1.26.5/istiod-1.26.5.tgz.etag b/resources/v1.26.5/istiod-1.26.5.tgz.etag
new file mode 100644
index 000000000..310bd18dc
--- /dev/null
+++ b/resources/v1.26.5/istiod-1.26.5.tgz.etag
@@ -0,0 +1 @@
+055c1de6a6f1e674051456be9525e7fe
diff --git a/resources/v1.24.1/profiles/ambient.yaml b/resources/v1.26.5/profiles/ambient.yaml
similarity index 100%
rename from resources/v1.24.1/profiles/ambient.yaml
rename to resources/v1.26.5/profiles/ambient.yaml
diff --git a/resources/v1.25.2/profiles/default.yaml b/resources/v1.26.5/profiles/default.yaml
similarity index 100%
rename from resources/v1.25.2/profiles/default.yaml
rename to resources/v1.26.5/profiles/default.yaml
diff --git a/resources/v1.24.1/profiles/demo.yaml b/resources/v1.26.5/profiles/demo.yaml
similarity index 100%
rename from resources/v1.24.1/profiles/demo.yaml
rename to resources/v1.26.5/profiles/demo.yaml
diff --git a/resources/v1.24.1/profiles/empty.yaml b/resources/v1.26.5/profiles/empty.yaml
similarity index 100%
rename from resources/v1.24.1/profiles/empty.yaml
rename to resources/v1.26.5/profiles/empty.yaml
diff --git a/resources/v1.24.1/profiles/openshift-ambient.yaml b/resources/v1.26.5/profiles/openshift-ambient.yaml
similarity index 100%
rename from resources/v1.24.1/profiles/openshift-ambient.yaml
rename to resources/v1.26.5/profiles/openshift-ambient.yaml
diff --git a/resources/v1.24.1/profiles/openshift.yaml b/resources/v1.26.5/profiles/openshift.yaml
similarity index 100%
rename from resources/v1.24.1/profiles/openshift.yaml
rename to resources/v1.26.5/profiles/openshift.yaml
diff --git a/resources/v1.24.1/profiles/preview.yaml b/resources/v1.26.5/profiles/preview.yaml
similarity index 100%
rename from resources/v1.24.1/profiles/preview.yaml
rename to resources/v1.26.5/profiles/preview.yaml
diff --git a/resources/v1.24.1/profiles/remote.yaml b/resources/v1.26.5/profiles/remote.yaml
similarity index 100%
rename from resources/v1.24.1/profiles/remote.yaml
rename to resources/v1.26.5/profiles/remote.yaml
diff --git a/resources/v1.24.1/profiles/stable.yaml b/resources/v1.26.5/profiles/stable.yaml
similarity index 100%
rename from resources/v1.24.1/profiles/stable.yaml
rename to resources/v1.26.5/profiles/stable.yaml
diff --git a/resources/v1.26.5/ztunnel-1.26.5.tgz.etag b/resources/v1.26.5/ztunnel-1.26.5.tgz.etag
new file mode 100644
index 000000000..37d19e1bb
--- /dev/null
+++ b/resources/v1.26.5/ztunnel-1.26.5.tgz.etag
@@ -0,0 +1 @@
+03e45a84d653c2a3d804043379438f07
diff --git a/resources/v1.26.6/base-1.26.6.tgz.etag b/resources/v1.26.6/base-1.26.6.tgz.etag
new file mode 100644
index 000000000..39e2e584a
--- /dev/null
+++ b/resources/v1.26.6/base-1.26.6.tgz.etag
@@ -0,0 +1 @@
+e07791e14063cfedd0ee61203d6406ec
diff --git a/resources/v1.26.6/charts/base/Chart.yaml b/resources/v1.26.6/charts/base/Chart.yaml
new file mode 100644
index 000000000..ea428a19c
--- /dev/null
+++ b/resources/v1.26.6/charts/base/Chart.yaml
@@ -0,0 +1,10 @@
+apiVersion: v2
+appVersion: 1.26.6
+description: Helm chart for deploying Istio cluster resources and CRDs
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+name: base
+sources:
+- https://github.com/istio/istio
+version: 1.26.6
diff --git a/resources/v1.24.2/charts/base/README.md b/resources/v1.26.6/charts/base/README.md
similarity index 100%
rename from resources/v1.24.2/charts/base/README.md
rename to resources/v1.26.6/charts/base/README.md
diff --git a/resources/v1.24.2/charts/base/files/profile-ambient.yaml b/resources/v1.26.6/charts/base/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.2/charts/base/files/profile-ambient.yaml
rename to resources/v1.26.6/charts/base/files/profile-ambient.yaml
diff --git a/resources/v1.26.6/charts/base/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.6/charts/base/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.6/charts/base/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.6/charts/base/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.6/charts/base/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.6/charts/base/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.6/charts/base/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.6/charts/base/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.6/charts/base/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.3/charts/base/files/profile-demo.yaml b/resources/v1.26.6/charts/base/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.3/charts/base/files/profile-demo.yaml
rename to resources/v1.26.6/charts/base/files/profile-demo.yaml
diff --git a/resources/v1.26.6/charts/base/files/profile-platform-gke.yaml b/resources/v1.26.6/charts/base/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.26.6/charts/base/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.2/charts/base/files/profile-platform-k3d.yaml b/resources/v1.26.6/charts/base/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.2/charts/base/files/profile-platform-k3d.yaml
rename to resources/v1.26.6/charts/base/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.3/charts/base/files/profile-platform-k3s.yaml b/resources/v1.26.6/charts/base/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.3/charts/base/files/profile-platform-k3s.yaml
rename to resources/v1.26.6/charts/base/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.2/charts/base/files/profile-platform-microk8s.yaml b/resources/v1.26.6/charts/base/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.2/charts/base/files/profile-platform-microk8s.yaml
rename to resources/v1.26.6/charts/base/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.2/charts/base/files/profile-platform-minikube.yaml b/resources/v1.26.6/charts/base/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.2/charts/base/files/profile-platform-minikube.yaml
rename to resources/v1.26.6/charts/base/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.2/charts/base/files/profile-platform-openshift.yaml b/resources/v1.26.6/charts/base/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.2/charts/base/files/profile-platform-openshift.yaml
rename to resources/v1.26.6/charts/base/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.2/charts/base/files/profile-preview.yaml b/resources/v1.26.6/charts/base/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.2/charts/base/files/profile-preview.yaml
rename to resources/v1.26.6/charts/base/files/profile-preview.yaml
diff --git a/resources/v1.24.2/charts/base/files/profile-remote.yaml b/resources/v1.26.6/charts/base/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.2/charts/base/files/profile-remote.yaml
rename to resources/v1.26.6/charts/base/files/profile-remote.yaml
diff --git a/resources/v1.24.2/charts/base/files/profile-stable.yaml b/resources/v1.26.6/charts/base/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.2/charts/base/files/profile-stable.yaml
rename to resources/v1.26.6/charts/base/files/profile-stable.yaml
diff --git a/resources/v1.24.2/charts/base/templates/NOTES.txt b/resources/v1.26.6/charts/base/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.2/charts/base/templates/NOTES.txt
rename to resources/v1.26.6/charts/base/templates/NOTES.txt
diff --git a/resources/v1.24.2/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml b/resources/v1.26.6/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
similarity index 100%
rename from resources/v1.24.2/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
rename to resources/v1.26.6/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
diff --git a/resources/v1.24.2/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml b/resources/v1.26.6/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
similarity index 100%
rename from resources/v1.24.2/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
rename to resources/v1.26.6/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
diff --git a/resources/v1.24.2/charts/base/templates/reader-serviceaccount.yaml b/resources/v1.26.6/charts/base/templates/reader-serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.2/charts/base/templates/reader-serviceaccount.yaml
rename to resources/v1.26.6/charts/base/templates/reader-serviceaccount.yaml
diff --git a/resources/v1.25.5/charts/istiod/templates/zzz_profile.yaml b/resources/v1.26.6/charts/base/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.25.5/charts/istiod/templates/zzz_profile.yaml
rename to resources/v1.26.6/charts/base/templates/zzz_profile.yaml
diff --git a/resources/v1.25.3/charts/base/values.yaml b/resources/v1.26.6/charts/base/values.yaml
similarity index 100%
rename from resources/v1.25.3/charts/base/values.yaml
rename to resources/v1.26.6/charts/base/values.yaml
diff --git a/resources/v1.26.6/charts/cni/Chart.yaml b/resources/v1.26.6/charts/cni/Chart.yaml
new file mode 100644
index 000000000..3c84bd2d2
--- /dev/null
+++ b/resources/v1.26.6/charts/cni/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+appVersion: 1.26.6
+description: Helm chart for istio-cni components
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio-cni
+- istio
+name: cni
+sources:
+- https://github.com/istio/istio
+version: 1.26.6
diff --git a/resources/v1.24.2/charts/cni/README.md b/resources/v1.26.6/charts/cni/README.md
similarity index 100%
rename from resources/v1.24.2/charts/cni/README.md
rename to resources/v1.26.6/charts/cni/README.md
diff --git a/resources/v1.24.2/charts/cni/files/profile-ambient.yaml b/resources/v1.26.6/charts/cni/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.2/charts/cni/files/profile-ambient.yaml
rename to resources/v1.26.6/charts/cni/files/profile-ambient.yaml
diff --git a/resources/v1.26.6/charts/cni/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.6/charts/cni/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.6/charts/cni/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.6/charts/cni/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.6/charts/cni/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.6/charts/cni/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.6/charts/cni/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.6/charts/cni/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.6/charts/cni/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.3/charts/cni/files/profile-demo.yaml b/resources/v1.26.6/charts/cni/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.3/charts/cni/files/profile-demo.yaml
rename to resources/v1.26.6/charts/cni/files/profile-demo.yaml
diff --git a/resources/v1.26.6/charts/cni/files/profile-platform-gke.yaml b/resources/v1.26.6/charts/cni/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.26.6/charts/cni/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.2/charts/cni/files/profile-platform-k3d.yaml b/resources/v1.26.6/charts/cni/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.2/charts/cni/files/profile-platform-k3d.yaml
rename to resources/v1.26.6/charts/cni/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.3/charts/cni/files/profile-platform-k3s.yaml b/resources/v1.26.6/charts/cni/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.3/charts/cni/files/profile-platform-k3s.yaml
rename to resources/v1.26.6/charts/cni/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.2/charts/cni/files/profile-platform-microk8s.yaml b/resources/v1.26.6/charts/cni/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.2/charts/cni/files/profile-platform-microk8s.yaml
rename to resources/v1.26.6/charts/cni/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.2/charts/cni/files/profile-platform-minikube.yaml b/resources/v1.26.6/charts/cni/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.2/charts/cni/files/profile-platform-minikube.yaml
rename to resources/v1.26.6/charts/cni/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.2/charts/cni/files/profile-platform-openshift.yaml b/resources/v1.26.6/charts/cni/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.2/charts/cni/files/profile-platform-openshift.yaml
rename to resources/v1.26.6/charts/cni/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.2/charts/cni/files/profile-preview.yaml b/resources/v1.26.6/charts/cni/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.2/charts/cni/files/profile-preview.yaml
rename to resources/v1.26.6/charts/cni/files/profile-preview.yaml
diff --git a/resources/v1.24.2/charts/cni/files/profile-remote.yaml b/resources/v1.26.6/charts/cni/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.2/charts/cni/files/profile-remote.yaml
rename to resources/v1.26.6/charts/cni/files/profile-remote.yaml
diff --git a/resources/v1.24.2/charts/cni/files/profile-stable.yaml b/resources/v1.26.6/charts/cni/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.2/charts/cni/files/profile-stable.yaml
rename to resources/v1.26.6/charts/cni/files/profile-stable.yaml
diff --git a/resources/v1.24.2/charts/cni/templates/NOTES.txt b/resources/v1.26.6/charts/cni/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.2/charts/cni/templates/NOTES.txt
rename to resources/v1.26.6/charts/cni/templates/NOTES.txt
diff --git a/resources/v1.24.2/charts/cni/templates/_helpers.tpl b/resources/v1.26.6/charts/cni/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.2/charts/cni/templates/_helpers.tpl
rename to resources/v1.26.6/charts/cni/templates/_helpers.tpl
diff --git a/resources/v1.25.3/charts/cni/templates/clusterrole.yaml b/resources/v1.26.6/charts/cni/templates/clusterrole.yaml
similarity index 100%
rename from resources/v1.25.3/charts/cni/templates/clusterrole.yaml
rename to resources/v1.26.6/charts/cni/templates/clusterrole.yaml
diff --git a/resources/v1.24.2/charts/cni/templates/clusterrolebinding.yaml b/resources/v1.26.6/charts/cni/templates/clusterrolebinding.yaml
similarity index 100%
rename from resources/v1.24.2/charts/cni/templates/clusterrolebinding.yaml
rename to resources/v1.26.6/charts/cni/templates/clusterrolebinding.yaml
diff --git a/resources/v1.25.4/charts/cni/templates/configmap-cni.yaml b/resources/v1.26.6/charts/cni/templates/configmap-cni.yaml
similarity index 100%
rename from resources/v1.25.4/charts/cni/templates/configmap-cni.yaml
rename to resources/v1.26.6/charts/cni/templates/configmap-cni.yaml
diff --git a/resources/v1.26.6/charts/cni/templates/daemonset.yaml b/resources/v1.26.6/charts/cni/templates/daemonset.yaml
new file mode 100644
index 000000000..cdccd3654
--- /dev/null
+++ b/resources/v1.26.6/charts/cni/templates/daemonset.yaml
@@ -0,0 +1,245 @@
+# This manifest installs the Istio install-cni container, as well
+# as the Istio CNI plugin and config on
+# each master and worker node in a Kubernetes cluster.
+#
+# $detectedBinDir exists to support a GKE-specific platform override,
+# and is deprecated in favor of using the explicit `gke` platform profile.
+{{- $detectedBinDir := (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
+    "/home/kubernetes/bin"
+    "/opt/cni/bin"
+}}
+{{- if .Values.cniBinDir }}
+{{ $detectedBinDir = .Values.cniBinDir }}
+{{- end }}
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  # Note that this is templated but evaluates to a fixed name
+  # which the CNI plugin may fall back onto in some failsafe scenarios.
+  # if this name is changed, CNI plugin logic that checks for this name
+  # format should also be updated.
+  name: {{ template "name" . }}-node
+  namespace: {{ .Release.Namespace }}
+  labels:
+    k8s-app: {{ template "name" . }}-node
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      k8s-app: {{ template "name" . }}-node
+  {{- with .Values.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  template:
+    metadata:
+      labels:
+        k8s-app: {{ template "name" . }}-node
+        sidecar.istio.io/inject: "false"
+        istio.io/dataplane-mode: none
+        app.kubernetes.io/name: {{ template "name" . }}
+        {{- include "istio.labels" . | nindent 8 }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+        # Add Prometheus Scrape annotations
+        prometheus.io/scrape: 'true'
+        prometheus.io/port: "15014"
+        prometheus.io/path: '/metrics'
+        # Add AppArmor annotation
+        # This is required to avoid conflicts with AppArmor profiles which block certain
+        # privileged pod capabilities.
+        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
+        # securityContext which is otherwise preferred.
+        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
+        # Custom annotations
+        {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+        {{- end }}
+    spec:
+{{- if and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace }}
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+{{- end }}
+      nodeSelector:
+        kubernetes.io/os: linux
+      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      tolerations:
+        # Make sure istio-cni-node gets scheduled on all nodes.
+        - effect: NoSchedule
+          operator: Exists
+        # Mark the pod as a critical add-on for rescheduling.
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - effect: NoExecute
+          operator: Exists
+      priorityClassName: system-node-critical
+      serviceAccountName: {{ template "name" . }}
+      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
+      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
+      terminationGracePeriodSeconds: 5
+      containers:
+        # This container installs the Istio CNI binaries
+        # and CNI network config file on each node.
+        - name: install-cni
+{{- if contains "/" .Values.image }}
+          image: "{{ .Values.image }}"
+{{- else }}
+          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
+{{- end }}
+{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
+          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
+{{- end }}
+          ports:
+          - containerPort: 15014
+            name: metrics
+            protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8000
+          securityContext:
+            privileged: false
+            runAsGroup: 0
+            runAsUser: 0
+            runAsNonRoot: false
+            # Both ambient and sidecar repair mode require elevated node privileges to function.
+            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
+            # add capabilities based on feature.
+            capabilities:
+              drop:
+              - ALL
+              add:
+              # CAP_NET_ADMIN is required to allow ipset and route table access
+              - NET_ADMIN
+              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
+              - NET_RAW
+              # CAP_SYS_PTRACE is required for repair and ambient mode to describe
+              # the pod's network namespace.
+              - SYS_PTRACE
+              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
+              # network namespaces in `/proc` to obtain descriptors for entering pod network
+              # namespaces. There does not appear to be a more granular capability for this.
+              - SYS_ADMIN
+              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
+              # the typical ability to read/write to folders owned by others.
+              # This can cause problems if the hostPath mounts we use, which we require write access into,
+              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
+              - DAC_OVERRIDE
+{{- if .Values.seLinuxOptions }}
+{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
+            seLinuxOptions:
+{{ toYaml . | trim | indent 14 }}
+{{- end }}
+{{- end }}
+{{- if .Values.seccompProfile }}
+            seccompProfile:
+{{ toYaml .Values.seccompProfile | trim | indent 14 }}
+{{- end }}
+          command: ["install-cni"]
+          args:
+            {{- if or .Values.logging.level .Values.global.logging.level }}
+            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
+            {{- end}}
+            {{- if .Values.global.logAsJson }}
+            - --log_as_json
+            {{- end}}
+          envFrom:
+            - configMapRef:
+                name: {{ template "name" . }}-config
+          env:
+            - name: REPAIR_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: REPAIR_RUN_AS_DAEMON
+              value: "true"
+            - name: REPAIR_SIDECAR_ANNOTATION
+              value: "sidecar.istio.io/status"
+            {{- if not (and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace) }}
+            - name: ALLOW_SWITCH_TO_HOST_NS
+              value: "true"
+            {{- end }}
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+            - name: GOMEMLIMIT
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.memory
+            - name: GOMAXPROCS
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.cpu
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+          volumeMounts:
+            - mountPath: /host/opt/cni/bin
+              name: cni-bin-dir
+            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
+            - mountPath: /host/proc
+              name: cni-host-procfs
+              readOnly: true
+            {{- end }}
+            - mountPath: /host/etc/cni/net.d
+              name: cni-net-dir
+            - mountPath: /var/run/istio-cni
+              name: cni-socket-dir
+            {{- if .Values.ambient.enabled }}
+            - mountPath: /host/var/run/netns
+              mountPropagation: HostToContainer
+              name: cni-netns-dir
+            - mountPath: /var/run/ztunnel
+              name: cni-ztunnel-sock-dir
+            {{ end }}
+          resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 12 }}
+{{- else }}
+{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
+{{- end }}
+      volumes:
+        # Used to install CNI.
+        - name: cni-bin-dir
+          hostPath:
+            path: {{ $detectedBinDir }}
+        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
+        - name: cni-host-procfs
+          hostPath:
+            path: /proc
+            type: Directory
+        {{- end }}
+        {{- if .Values.ambient.enabled }}
+        - name: cni-ztunnel-sock-dir
+          hostPath:
+            path: /var/run/ztunnel
+            type: DirectoryOrCreate
+        {{- end }}
+        - name: cni-net-dir
+          hostPath:
+            path: {{ .Values.cniConfDir }}
+        # Used for UDS sockets for logging, ambient eventing
+        - name: cni-socket-dir
+          hostPath:
+            path: /var/run/istio-cni
+        - name: cni-netns-dir
+          hostPath:
+            path: {{ .Values.cniNetnsDir }}
+            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
+            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
+            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.24.2/charts/cni/templates/network-attachment-definition.yaml b/resources/v1.26.6/charts/cni/templates/network-attachment-definition.yaml
similarity index 100%
rename from resources/v1.24.2/charts/cni/templates/network-attachment-definition.yaml
rename to resources/v1.26.6/charts/cni/templates/network-attachment-definition.yaml
diff --git a/resources/v1.24.2/charts/cni/templates/resourcequota.yaml b/resources/v1.26.6/charts/cni/templates/resourcequota.yaml
similarity index 100%
rename from resources/v1.24.2/charts/cni/templates/resourcequota.yaml
rename to resources/v1.26.6/charts/cni/templates/resourcequota.yaml
diff --git a/resources/v1.24.2/charts/cni/templates/serviceaccount.yaml b/resources/v1.26.6/charts/cni/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.2/charts/cni/templates/serviceaccount.yaml
rename to resources/v1.26.6/charts/cni/templates/serviceaccount.yaml
diff --git a/resources/v1.24.2/charts/cni/templates/zzy_descope_legacy.yaml b/resources/v1.26.6/charts/cni/templates/zzy_descope_legacy.yaml
similarity index 100%
rename from resources/v1.24.2/charts/cni/templates/zzy_descope_legacy.yaml
rename to resources/v1.26.6/charts/cni/templates/zzy_descope_legacy.yaml
diff --git a/resources/v1.25.5/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.26.6/charts/cni/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.25.5/charts/revisiontags/templates/zzz_profile.yaml
rename to resources/v1.26.6/charts/cni/templates/zzz_profile.yaml
diff --git a/resources/v1.26.6/charts/cni/values.yaml b/resources/v1.26.6/charts/cni/values.yaml
new file mode 100644
index 000000000..51050067d
--- /dev/null
+++ b/resources/v1.26.6/charts/cni/values.yaml
@@ -0,0 +1,152 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  hub: ""
+  tag: ""
+  variant: ""
+  image: install-cni
+  pullPolicy: ""
+
+  # Same as `global.logging.level`, but will override it if set
+  logging:
+    level: ""
+
+  # Configuration file to insert istio-cni plugin configuration
+  # by default this will be the first file found in the cni-conf-dir
+  # Example
+  # cniConfFileName: 10-calico.conflist
+
+  # CNI-and-platform specific path defaults.
+  # These may need to be set to platform-specific values, consult
+  # overrides for your platform in `manifests/helm-profiles/platform-*.yaml`
+  cniBinDir: /opt/cni/bin
+  cniConfDir: /etc/cni/net.d
+  cniConfFileName: ""
+  cniNetnsDir: "/var/run/netns"
+
+  excludeNamespaces:
+    - kube-system
+
+  # Allows user to set custom affinity for the DaemonSet
+  affinity: {}
+
+  # Custom annotations on pod level, if you need them
+  podAnnotations: {}
+
+  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
+  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
+  chained: true
+
+  # Custom configuration happens based on the CNI provider.
+  # Possible values: "default", "multus"
+  provider: "default"
+
+  # Configure ambient settings
+  ambient:
+    # If enabled, ambient redirection will be enabled
+    enabled: false
+    # Set ambient config dir path: defaults to /etc/ambient-config
+    configDir: ""
+    # If enabled, and ambient is enabled, DNS redirection will be enabled
+    dnsCapture: true
+    # If enabled, and ambient is enabled, enables ipv6 support
+    ipv6: true
+    # If enabled, and ambient is enabled, the CNI agent will reconcile incompatible iptables rules and chains at startup.
+    # This will eventually be enabled by default
+    reconcileIptablesOnStartup: false
+    # If enabled, and ambient is enabled, the CNI agent will always share the network namespace of the host node it is running on
+    shareHostNetworkNamespace: false
+
+
+  repair:
+    enabled: true
+    hub: ""
+    tag: ""
+
+    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
+    # This defines the action the controller will take when a pod is detected as broken.
+
+    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
+    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
+    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
+    labelPods: false
+    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
+    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
+    deletePods: false
+    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
+    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
+    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
+    repairPods: true
+
+    initContainerName: "istio-validation"
+
+    brokenPodLabelKey: "cni.istio.io/uninitialized"
+    brokenPodLabelValue: "true"
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
+  seLinuxOptions: {}
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 100Mi
+
+  resourceQuotas:
+    enabled: false
+    pods: 5000
+
+  # K8s DaemonSet update strategy.
+  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  global:
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+
+    # Default tag for Istio images.
+    tag: 1.26.6
+
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # change cni scope level to control logging out of istio-cni-node DaemonSet
+    logging:
+      level: info
+
+    logAsJson: false
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Default resources allocated
+    defaultResources:
+      requests:
+        cpu: 100m
+        memory: 100Mi
+
+  # A `key: value` mapping of environment variables to add to the pod
+  env: {}
diff --git a/resources/v1.26.6/charts/gateway/Chart.yaml b/resources/v1.26.6/charts/gateway/Chart.yaml
new file mode 100644
index 000000000..9ca41c9c6
--- /dev/null
+++ b/resources/v1.26.6/charts/gateway/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+appVersion: 1.26.6
+description: Helm chart for deploying Istio gateways
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+- gateways
+name: gateway
+sources:
+- https://github.com/istio/istio
+type: application
+version: 1.26.6
diff --git a/resources/v1.24.2/charts/gateway/README.md b/resources/v1.26.6/charts/gateway/README.md
similarity index 100%
rename from resources/v1.24.2/charts/gateway/README.md
rename to resources/v1.26.6/charts/gateway/README.md
diff --git a/resources/v1.24.2/charts/gateway/files/profile-ambient.yaml b/resources/v1.26.6/charts/gateway/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.2/charts/gateway/files/profile-ambient.yaml
rename to resources/v1.26.6/charts/gateway/files/profile-ambient.yaml
diff --git a/resources/v1.26.6/charts/gateway/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.6/charts/gateway/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.6/charts/gateway/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.6/charts/gateway/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.6/charts/gateway/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.6/charts/gateway/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.6/charts/gateway/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.6/charts/gateway/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.6/charts/gateway/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.3/charts/gateway/files/profile-demo.yaml b/resources/v1.26.6/charts/gateway/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.3/charts/gateway/files/profile-demo.yaml
rename to resources/v1.26.6/charts/gateway/files/profile-demo.yaml
diff --git a/resources/v1.26.6/charts/gateway/files/profile-platform-gke.yaml b/resources/v1.26.6/charts/gateway/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.26.6/charts/gateway/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.2/charts/gateway/files/profile-platform-k3d.yaml b/resources/v1.26.6/charts/gateway/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.2/charts/gateway/files/profile-platform-k3d.yaml
rename to resources/v1.26.6/charts/gateway/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.3/charts/gateway/files/profile-platform-k3s.yaml b/resources/v1.26.6/charts/gateway/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.3/charts/gateway/files/profile-platform-k3s.yaml
rename to resources/v1.26.6/charts/gateway/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.2/charts/gateway/files/profile-platform-microk8s.yaml b/resources/v1.26.6/charts/gateway/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.2/charts/gateway/files/profile-platform-microk8s.yaml
rename to resources/v1.26.6/charts/gateway/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.2/charts/gateway/files/profile-platform-minikube.yaml b/resources/v1.26.6/charts/gateway/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.2/charts/gateway/files/profile-platform-minikube.yaml
rename to resources/v1.26.6/charts/gateway/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.2/charts/gateway/files/profile-platform-openshift.yaml b/resources/v1.26.6/charts/gateway/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.2/charts/gateway/files/profile-platform-openshift.yaml
rename to resources/v1.26.6/charts/gateway/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.2/charts/gateway/files/profile-preview.yaml b/resources/v1.26.6/charts/gateway/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.2/charts/gateway/files/profile-preview.yaml
rename to resources/v1.26.6/charts/gateway/files/profile-preview.yaml
diff --git a/resources/v1.24.2/charts/gateway/files/profile-remote.yaml b/resources/v1.26.6/charts/gateway/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.2/charts/gateway/files/profile-remote.yaml
rename to resources/v1.26.6/charts/gateway/files/profile-remote.yaml
diff --git a/resources/v1.24.2/charts/gateway/files/profile-stable.yaml b/resources/v1.26.6/charts/gateway/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.2/charts/gateway/files/profile-stable.yaml
rename to resources/v1.26.6/charts/gateway/files/profile-stable.yaml
diff --git a/resources/v1.24.2/charts/gateway/templates/NOTES.txt b/resources/v1.26.6/charts/gateway/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.2/charts/gateway/templates/NOTES.txt
rename to resources/v1.26.6/charts/gateway/templates/NOTES.txt
diff --git a/resources/v1.24.2/charts/gateway/templates/_helpers.tpl b/resources/v1.26.6/charts/gateway/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.2/charts/gateway/templates/_helpers.tpl
rename to resources/v1.26.6/charts/gateway/templates/_helpers.tpl
diff --git a/resources/v1.26.6/charts/gateway/templates/deployment.yaml b/resources/v1.26.6/charts/gateway/templates/deployment.yaml
new file mode 100644
index 000000000..d83ff3b49
--- /dev/null
+++ b/resources/v1.26.6/charts/gateway/templates/deployment.yaml
@@ -0,0 +1,131 @@
+apiVersion: apps/v1
+kind: {{ .Values.kind | default "Deployment" }}
+metadata:
+  name: {{ include "gateway.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "gateway.name" . }}
+    {{- include "istio.labels" . | nindent 4}}
+    {{- include "gateway.labels" . | nindent 4}}
+  annotations:
+    {{- .Values.annotations | toYaml | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  {{- if and (hasKey .Values "replicaCount") (ne .Values.replicaCount nil) }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  {{- end }}
+  {{- with .Values.strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.minReadySeconds }}
+  minReadySeconds: {{ . }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "gateway.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
+        {{- include "gateway.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/name: {{ include "gateway.name" . }}
+        {{- include "istio.labels" .  | nindent 8}}
+        {{- range $key, $val := .Values.labels }}
+        {{- if and (ne $key "app") (ne $key "istio") }}
+        {{ $key | quote }}: {{ $val | quote }}
+        {{- end }}
+        {{- end }}
+        {{- with .Values.networkGateway }}
+        topology.istio.io/network: "{{.}}"
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
+      securityContext:
+      {{- if .Values.securityContext }}
+        {{- toYaml .Values.securityContext | nindent 8 }}
+      {{- else }}
+        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
+        sysctls:
+        - name: net.ipv4.ip_unprivileged_port_start
+          value: "0"
+      {{- end }}
+      {{- with .Values.volumes }}
+      volumes:
+        {{ toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: istio-proxy
+          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
+          image: auto
+          {{- with .Values.imagePullPolicy }}
+          imagePullPolicy: {{ . }}
+          {{- end }}
+          securityContext:
+          {{- if .Values.containerSecurityContext }}
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          {{- else }}
+            capabilities:
+              drop:
+              - ALL
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: true
+            {{- if not (eq (.Values.platform | default "") "openshift") }}
+            runAsUser: 1337
+            runAsGroup: 1337
+            {{- end }}
+            runAsNonRoot: true
+          {{- end }}
+          env:
+          {{- with .Values.networkGateway }}
+          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
+            value: "{{.}}"
+          {{- end }}
+          {{- range $key, $val := .Values.env }}
+          - name: {{ $key }}
+            value: {{ $val | quote }}
+          {{- end }}
+          ports:
+          - containerPort: 15090
+            protocol: TCP
+            name: http-envoy-prom
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          {{- with .Values.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
+      {{- with .Values.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
diff --git a/resources/v1.24.2/charts/gateway/templates/hpa.yaml b/resources/v1.26.6/charts/gateway/templates/hpa.yaml
similarity index 100%
rename from resources/v1.24.2/charts/gateway/templates/hpa.yaml
rename to resources/v1.26.6/charts/gateway/templates/hpa.yaml
diff --git a/resources/v1.24.2/charts/gateway/templates/poddisruptionbudget.yaml b/resources/v1.26.6/charts/gateway/templates/poddisruptionbudget.yaml
similarity index 100%
rename from resources/v1.24.2/charts/gateway/templates/poddisruptionbudget.yaml
rename to resources/v1.26.6/charts/gateway/templates/poddisruptionbudget.yaml
diff --git a/resources/v1.24.2/charts/gateway/templates/role.yaml b/resources/v1.26.6/charts/gateway/templates/role.yaml
similarity index 100%
rename from resources/v1.24.2/charts/gateway/templates/role.yaml
rename to resources/v1.26.6/charts/gateway/templates/role.yaml
diff --git a/resources/v1.26.6/charts/gateway/templates/service.yaml b/resources/v1.26.6/charts/gateway/templates/service.yaml
new file mode 100644
index 000000000..3e28418f7
--- /dev/null
+++ b/resources/v1.26.6/charts/gateway/templates/service.yaml
@@ -0,0 +1,69 @@
+{{- if not (eq .Values.service.type "None") }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "gateway.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "gateway.name" . }}
+    {{- include "istio.labels" . | nindent 4}}
+    {{- include "gateway.labels" . | nindent 4 }}
+    {{- with .Values.networkGateway }}
+    topology.istio.io/network: "{{.}}"
+    {{- end }}
+  annotations:
+    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
+spec:
+{{- with .Values.service.loadBalancerIP }}
+  loadBalancerIP: "{{ . }}"
+{{- end }}
+{{- if eq .Values.service.type "LoadBalancer" }}
+  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
+  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
+  {{- end }}
+  {{- if hasKey .Values.service "loadBalancerClass" }}
+  loadBalancerClass: {{ .Values.service.loadBalancerClass }}
+  {{- end }}
+{{- end }}
+{{- if .Values.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
+{{- end }}
+{{- if .Values.service.ipFamilies }}
+  ipFamilies:
+{{- range .Values.service.ipFamilies }}
+  - {{ . }}
+{{- end }}
+{{- end }}
+{{- with .Values.service.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+{{ toYaml . | indent 4 }}
+{{- end }}
+{{- with .Values.service.externalTrafficPolicy }}
+  externalTrafficPolicy: "{{ . }}"
+{{- end }}
+  type: {{ .Values.service.type }}
+  ports:
+{{- if .Values.networkGateway }}
+  - name: status-port
+    port: 15021
+    targetPort: 15021
+  - name: tls
+    port: 15443
+    targetPort: 15443
+  - name: tls-istiod
+    port: 15012
+    targetPort: 15012
+  - name: tls-webhook
+    port: 15017
+    targetPort: 15017
+{{- else }}
+{{ .Values.service.ports | toYaml | indent 4 }}
+{{- end }}
+{{- if .Values.service.externalIPs }}
+  externalIPs: {{- range .Values.service.externalIPs }}
+    - {{.}}
+  {{- end }}
+{{- end }}
+  selector:
+    {{- include "gateway.selectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/resources/v1.24.2/charts/gateway/templates/serviceaccount.yaml b/resources/v1.26.6/charts/gateway/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.2/charts/gateway/templates/serviceaccount.yaml
rename to resources/v1.26.6/charts/gateway/templates/serviceaccount.yaml
diff --git a/resources/v1.26.6/charts/gateway/templates/zzz_profile.yaml b/resources/v1.26.6/charts/gateway/templates/zzz_profile.yaml
new file mode 100644
index 000000000..606c55669
--- /dev/null
+++ b/resources/v1.26.6/charts/gateway/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if true }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.26.6/charts/gateway/values.schema.json b/resources/v1.26.6/charts/gateway/values.schema.json
new file mode 100644
index 000000000..d81fcffaa
--- /dev/null
+++ b/resources/v1.26.6/charts/gateway/values.schema.json
@@ -0,0 +1,368 @@
+{
+  "$schema": "http://json-schema.org/schema#",
+  "$defs": {
+    "values": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "_internal_defaults_do_not_set": {
+          "type": "object"
+        },
+        "global": {
+          "type": "object"
+        },
+        "affinity": {
+          "type": "object"
+        },
+        "securityContext": {
+          "type": [
+            "object",
+            "null"
+          ]
+        },
+        "containerSecurityContext": {
+          "type": [
+            "object",
+            "null"
+          ]
+        },
+        "kind": {
+          "type": "string",
+          "enum": [
+            "Deployment",
+            "DaemonSet"
+          ]
+        },
+        "annotations": {
+          "additionalProperties": {
+            "type": [
+              "string",
+              "integer"
+            ]
+          },
+          "type": "object"
+        },
+        "autoscaling": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            },
+            "maxReplicas": {
+              "type": "integer"
+            },
+            "minReplicas": {
+              "type": "integer"
+            },
+            "targetCPUUtilizationPercentage": {
+              "type": "integer"
+            }
+          }
+        },
+        "env": {
+          "type": "object"
+        },
+        "envVarFrom": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string"
+              },
+              "valueFrom": {
+                "type": "object"
+              }
+            }
+          }
+        },
+        "strategy": {
+          "type": "object"
+        },
+        "minReadySeconds": {
+          "type": [
+            "null",
+            "integer"
+          ]
+        },
+        "readinessProbe": {
+          "type": [
+            "null",
+            "object"
+          ]
+        },
+        "labels": {
+          "type": "object"
+        },
+        "name": {
+          "type": "string"
+        },
+        "nodeSelector": {
+          "type": "object"
+        },
+        "podAnnotations": {
+          "type": "object",
+          "properties": {
+            "inject.istio.io/templates": {
+              "type": "string"
+            },
+            "prometheus.io/path": {
+              "type": "string"
+            },
+            "prometheus.io/port": {
+              "type": "string"
+            },
+            "prometheus.io/scrape": {
+              "type": "string"
+            }
+          }
+        },
+        "replicaCount": {
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "resources": {
+          "type": "object",
+          "properties": {
+            "limits": {
+              "type": "object",
+              "properties": {
+                "cpu": {
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                },
+                "memory": {
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                }
+              }
+            },
+            "requests": {
+              "type": "object",
+              "properties": {
+                "cpu": {
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                },
+                "memory": {
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                }
+              }
+            }
+          }
+        },
+        "revision": {
+          "type": "string"
+        },
+        "defaultRevision": {
+          "type": "string"
+        },
+        "compatibilityVersion": {
+          "type": "string"
+        },
+        "profile": {
+          "type": "string"
+        },
+        "platform": {
+          "type": "string"
+        },
+        "pilot": {
+          "type": "object"
+        },
+        "runAsRoot": {
+          "type": "boolean"
+        },
+        "unprivilegedPort": {
+          "type": [
+            "string",
+            "boolean"
+          ],
+          "enum": [
+            true,
+            false,
+            "auto"
+          ]
+        },
+        "service": {
+          "type": "object",
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "externalTrafficPolicy": {
+              "type": "string"
+            },
+            "loadBalancerIP": {
+              "type": "string"
+            },
+            "loadBalancerSourceRanges": {
+              "type": "array"
+            },
+            "ipFamilies": {
+              "items": {
+                "type": "string",
+                "enum": [
+                  "IPv4",
+                  "IPv6"
+                ]
+              }
+            },
+            "ipFamilyPolicy": {
+              "type": "string",
+              "enum": [
+                "",
+                "SingleStack",
+                "PreferDualStack",
+                "RequireDualStack"
+              ]
+            },
+            "ports": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string"
+                  },
+                  "port": {
+                    "type": "integer"
+                  },
+                  "protocol": {
+                    "type": "string"
+                  },
+                  "targetPort": {
+                    "type": "integer"
+                  }
+                }
+              }
+            },
+            "type": {
+              "type": "string"
+            }
+          }
+        },
+        "serviceAccount": {
+          "type": "object",
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "name": {
+              "type": "string"
+            },
+            "create": {
+              "type": "boolean"
+            }
+          }
+        },
+        "rbac": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            }
+          }
+        },
+        "tolerations": {
+          "type": "array"
+        },
+        "topologySpreadConstraints": {
+          "type": "array"
+        },
+        "networkGateway": {
+          "type": "string"
+        },
+        "imagePullPolicy": {
+          "type": "string",
+          "enum": [
+            "",
+            "Always",
+            "IfNotPresent",
+            "Never"
+          ]
+        },
+        "imagePullSecrets": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "podDisruptionBudget": {
+          "type": "object",
+          "properties": {
+            "minAvailable": {
+              "type": [
+                "integer",
+                "string"
+              ]
+            },
+            "maxUnavailable": {
+              "type": [
+                "integer",
+                "string"
+              ]
+            },
+            "unhealthyPodEvictionPolicy": {
+              "type": "string",
+              "enum": [
+                "",
+                "IfHealthyBudget",
+                "AlwaysAllow"
+              ]
+            }
+          }
+        },
+        "terminationGracePeriodSeconds": {
+          "type": "number"
+        },
+        "volumes": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "volumeMounts": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "initContainers": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "additionalContainers": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "priorityClassName": {
+          "type": "string"
+        }
+      }
+    }
+  },
+  "defaults": {
+    "$ref": "#/$defs/values"
+  },
+  "$ref": "#/$defs/values"
+}
diff --git a/resources/v1.26.6/charts/gateway/values.yaml b/resources/v1.26.6/charts/gateway/values.yaml
new file mode 100644
index 000000000..4e65676ba
--- /dev/null
+++ b/resources/v1.26.6/charts/gateway/values.yaml
@@ -0,0 +1,170 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  # Name allows overriding the release name. Generally this should not be set
+  name: ""
+  # revision declares which revision this gateway is a part of
+  revision: ""
+
+  # Controls the spec.replicas setting for the Gateway deployment if set.
+  # Otherwise defaults to Kubernetes Deployment default (1).
+  replicaCount:
+
+  kind: Deployment
+
+  rbac:
+    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
+    # when using http://gateway-api.org/.
+    enabled: true
+
+  serviceAccount:
+    # If set, a service account will be created. Otherwise, the default is used
+    create: true
+    # Annotations to add to the service account
+    annotations: {}
+    # The name of the service account to use.
+    # If not set, the release name is used
+    name: ""
+
+  podAnnotations:
+    prometheus.io/port: "15020"
+    prometheus.io/scrape: "true"
+    prometheus.io/path: "/stats/prometheus"
+    inject.istio.io/templates: "gateway"
+    sidecar.istio.io/inject: "true"
+
+  # Define the security context for the pod.
+  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+  securityContext: {}
+  containerSecurityContext: {}
+
+  service:
+    # Type of service. Set to "None" to disable the service entirely
+    type: LoadBalancer
+    ports:
+    - name: status-port
+      port: 15021
+      protocol: TCP
+      targetPort: 15021
+    - name: http2
+      port: 80
+      protocol: TCP
+      targetPort: 80
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 443
+    annotations: {}
+    loadBalancerIP: ""
+    loadBalancerSourceRanges: []
+    externalTrafficPolicy: ""
+    externalIPs: []
+    ipFamilyPolicy: ""
+    ipFamilies: []
+    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
+    # allocateLoadBalancerNodePorts: false
+    ## Set LoadBalancer class (only for LoadBalancers).
+    # loadBalancerClass: ""
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 2000m
+      memory: 1024Mi
+
+  autoscaling:
+    enabled: true
+    minReplicas: 1
+    maxReplicas: 5
+    targetCPUUtilizationPercentage: 80
+    targetMemoryUtilizationPercentage: {}
+    autoscaleBehavior: {}
+
+  # Pod environment variables
+  env: {}
+
+  # Deployment Update strategy
+  strategy: {}
+  
+  # Sets the Deployment minReadySeconds value
+  minReadySeconds:
+  
+  # Optionally configure a custom readinessProbe. By default the control plane
+  # automatically injects the readinessProbe. If you wish to override that
+  # behavior, you may define your own readinessProbe here.
+  readinessProbe: {}
+
+  # Labels to apply to all resources
+  labels:
+    # By default, don't enroll gateways into the ambient dataplane
+    "istio.io/dataplane-mode": none
+
+  # Annotations to apply to all resources
+  annotations: {}
+
+  nodeSelector: {}
+
+  tolerations: []
+
+  topologySpreadConstraints: []
+
+  affinity: {}
+
+  # If specified, the gateway will act as a network gateway for the given network.
+  networkGateway: ""
+
+  # Specify image pull policy if default behavior isn't desired.
+  # Default behavior: latest images will be Always else IfNotPresent
+  imagePullPolicy: ""
+
+  imagePullSecrets: []
+
+  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
+  #
+  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
+  # which means that no PodDisruptionBudget resource will be created.
+  #
+  # To enable the PodDisruptionBudget, configure it by specifying the
+  # `minAvailable` or `maxUnavailable`. For example, to set the
+  # minimum number of available replicas to 1, you can update this value as follows:
+  #
+  # podDisruptionBudget:
+  #   minAvailable: 1
+  #
+  # Or, to allow a maximum of 1 unavailable replica, you can set:
+  #
+  # podDisruptionBudget:
+  #   maxUnavailable: 1
+  #
+  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
+  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
+  #
+  # podDisruptionBudget:
+  #   minAvailable: 1
+  #   unhealthyPodEvictionPolicy: AlwaysAllow
+  #
+  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
+  #
+  # podDisruptionBudget: {}
+  #
+  podDisruptionBudget: {}
+
+  # Sets the per-pod terminationGracePeriodSeconds setting.
+  terminationGracePeriodSeconds: 30
+
+  # A list of `Volumes` added into the Gateway Pods. See
+  # https://kubernetes.io/docs/concepts/storage/volumes/.
+  volumes: []
+
+  # A list of `VolumeMounts` added into the Gateway Pods. See
+  # https://kubernetes.io/docs/concepts/storage/volumes/.
+  volumeMounts: []
+
+  # Configure this to a higher priority class in order to make sure your Istio gateway pods
+  # will not be killed because of low priority class.
+  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+  # for more detail.
+  priorityClassName: ""
diff --git a/resources/v1.26.6/charts/istiod/Chart.yaml b/resources/v1.26.6/charts/istiod/Chart.yaml
new file mode 100644
index 000000000..336c6e2e0
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+appVersion: 1.26.6
+description: Helm chart for istio control plane
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+- istiod
+- istio-discovery
+name: istiod
+sources:
+- https://github.com/istio/istio
+version: 1.26.6
diff --git a/resources/v1.24.2/charts/istiod/README.md b/resources/v1.26.6/charts/istiod/README.md
similarity index 100%
rename from resources/v1.24.2/charts/istiod/README.md
rename to resources/v1.26.6/charts/istiod/README.md
diff --git a/resources/v1.26.6/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.26.6/charts/istiod/files/gateway-injection-template.yaml
new file mode 100644
index 000000000..7d23f15f9
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/files/gateway-injection-template.yaml
@@ -0,0 +1,261 @@
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations:
+    istio.io/rev: {{ .Revision | default "default" | quote }}
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}"
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}"
+    {{- end }}
+    {{- end }}
+spec:
+  securityContext:
+  {{- if .Values.gateways.securityContext }}
+    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
+  {{- else }}
+    sysctls:
+    - name: net.ipv4.ip_unprivileged_port_start
+      value: "0"
+  {{- end }}
+  containers:
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    ports:
+    - containerPort: 15090
+      protocol: TCP
+      name: http-envoy-prom
+    args:
+    - proxy
+    - router
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+  {{- if .Values.global.proxy.lifecycle }}
+    lifecycle:
+      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
+  {{- end }}
+    securityContext:
+      runAsUser: {{ .ProxyUID | default "1337" }}
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+    env:
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: ISTIO_CPU_LIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: GOMEMLIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.memory
+    - name: GOMAXPROCS
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    {{- if .CompliancePolicy }}
+    - name: COMPLIANCE_POLICY
+      value: "{{ .CompliancePolicy }}"
+    {{- end }}
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    - name: ISTIO_META_INTERCEPTION_MODE
+      value: "{{ .ProxyConfig.InterceptionMode.String }}"
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- if .DeploymentMeta.Name }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ .DeploymentMeta.Name }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    - name: credential-socket
+      mountPath: /var/run/secrets/credential-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    # SDS channel between istioagent and Envoy
+    - mountPath: /etc/istio/proxy
+      name: istio-envoy
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+  volumes:
+  - emptyDir: {}
+    name: workload-socket
+  - emptyDir: {}
+    name: credential-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else}}
+  - emptyDir: {}
+    name: workload-certs
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-envoy
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+          name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+          path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: istio-ca-root-cert
+  {{- end }}
+  {{- end }}
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.26.6/charts/istiod/files/grpc-agent.yaml b/resources/v1.26.6/charts/istiod/files/grpc-agent.yaml
new file mode 100644
index 000000000..dda3aeaa9
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/files/grpc-agent.yaml
@@ -0,0 +1,318 @@
+{{- define "resources"  }}
+  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
+      requests:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
+        {{ end }}
+    {{- end }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+      limits:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
+        {{ end }}
+    {{- end }}
+  {{- else }}
+    {{- if .Values.global.proxy.resources }}
+      {{ toYaml .Values.global.proxy.resources | indent 6 }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations: {
+    istio.io/rev: {{ .Revision | default "default" | quote }},
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- end }}
+    sidecar.istio.io/rewriteAppHTTPProbers: "false",
+  }
+spec:
+  containers:
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    ports:
+    - containerPort: 15020
+      protocol: TCP
+      name: mesh-metrics
+    args:
+    - proxy
+    - sidecar
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+    lifecycle:
+      postStart:
+        exec:
+          command:
+          - pilot-agent
+          - wait
+          - --url=http://localhost:15020/healthz/ready
+    env:
+    - name: ISTIO_META_GENERATOR
+      value: grpc
+    - name: OUTPUT_CERTS
+      value: /var/lib/istio/data
+    {{- if eq .InboundTrafficPolicyMode "localhost" }}
+    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
+      value: "true"
+    {{- end }}
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- if .DeploymentMeta.Name }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ .DeploymentMeta.Name }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    # grpc uses xds:/// to resolve – no need to resolve VIP
+    - name: ISTIO_META_DNS_CAPTURE
+      value: "false"
+    - name: DISABLE_ENVOY
+      value: "true"
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15020
+      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
+    resources:
+  {{ template "resources" . }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    # UDS channel between istioagent and gRPC client for XDS/SDS
+    - mountPath: /etc/istio/proxy
+      name: istio-xds
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+    {{- end }}
+      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
+      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
+    - name: "{{  $index }}"
+      {{ toYaml $value | indent 6 }}
+      {{ end }}
+      {{- end }}
+{{- range $index, $container := .Spec.Containers  }}
+{{ if not (eq $container.Name "istio-proxy") }}
+  - name: {{ $container.Name }}
+    env:
+      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
+        value: "true"
+      - name: "GRPC_XDS_BOOTSTRAP"
+        value: "/etc/istio/proxy/grpc-bootstrap.json"
+    volumeMounts:
+      - mountPath: /var/lib/istio/data
+        name: istio-data
+      # UDS channel between istioagent and gRPC client for XDS/SDS
+      - mountPath: /etc/istio/proxy
+        name: istio-xds
+      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
+      - name: gke-workload-certificate
+        mountPath: /var/run/secrets/workload-spiffe-credentials
+        readOnly: true
+      {{- else }}
+      - name: workload-certs
+        mountPath: /var/run/secrets/workload-spiffe-credentials
+      {{- end }}
+{{- end }}
+{{- end }}
+  volumes:
+  - emptyDir:
+    name: workload-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else }}
+  - emptyDir:
+    name: workload-certs
+  {{- end }}
+  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+  - name: custom-bootstrap-volume
+    configMap:
+      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-xds
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+          name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+          path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: istio-ca-root-cert
+  {{- end }}
+  {{- end }}
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
+    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
+  - name: "{{ $index }}"
+    {{ toYaml $value | indent 4 }}
+    {{ end }}
+    {{ end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.24.2/charts/istiod/files/grpc-simple.yaml b/resources/v1.26.6/charts/istiod/files/grpc-simple.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/files/grpc-simple.yaml
rename to resources/v1.26.6/charts/istiod/files/grpc-simple.yaml
diff --git a/resources/v1.26.6/charts/istiod/files/injection-template.yaml b/resources/v1.26.6/charts/istiod/files/injection-template.yaml
new file mode 100644
index 000000000..bfd922b04
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/files/injection-template.yaml
@@ -0,0 +1,531 @@
+{{- define "resources"  }}
+  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
+      requests:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
+        {{ end }}
+    {{- end }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+      limits:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
+        {{ end }}
+    {{- end }}
+  {{- else }}
+    {{- if .Values.global.proxy.resources }}
+      {{ toYaml .Values.global.proxy.resources | indent 6 }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
+{{ $tproxy := (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) }}
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
+    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
+    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
+    {{- end }}
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations: {
+    istio.io/rev: {{ .Revision | default "default" | quote }},
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- end }}
+{{- if .Values.pilot.cni.enabled }}
+    {{- if eq .Values.pilot.cni.provider "multus" }}
+    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
+    {{- end }}
+    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
+    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
+    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
+    traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}",
+    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
+    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
+    {{- end }}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
+    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
+    {{- end }}
+    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
+    {{ with index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}istio.io/reroute-virtual-interfaces: "{{.}}",{{ end }}
+    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
+{{- end }}
+  }
+spec:
+  {{- $holdProxy := and
+      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
+      (not $nativeSidecar) }}
+  {{- $noInitContainer := and
+      (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE`)
+      (not $nativeSidecar) }}
+  {{ if $noInitContainer }}
+  initContainers: []
+  {{ else -}}
+  initContainers:
+  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
+  {{ if .Values.pilot.cni.enabled -}}
+  - name: istio-validation
+  {{ else -}}
+  - name: istio-init
+  {{ end -}}
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    args:
+    - istio-iptables
+    - "-p"
+    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
+    - "-z"
+    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
+    - "-u"
+    - {{ if $tproxy }} "1337" {{ else }} {{ .ProxyUID | default "1337" | quote }} {{ end }}
+    - "-m"
+    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
+    - "-i"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
+    - "-x"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
+    - "-b"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
+    - "-d"
+  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
+    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
+  {{- else }}
+    - "15090,15021"
+  {{- end }}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
+    - "-q"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
+    {{ end -}}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
+    - "-o"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
+    {{ end -}}
+    {{ if (isset .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces`) -}}
+    - "-k"
+    - "{{ index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}"
+    {{ else if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
+    - "-k"
+    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
+    {{ end -}}
+     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
+    - "-c"
+    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
+    {{ end -}}
+    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
+    {{ if .Values.global.logAsJson -}}
+    - "--log_as_json"
+    {{ end -}}
+    {{ if .Values.pilot.cni.enabled -}}
+    - "--run-validation"
+    - "--skip-rule-apply"
+    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
+    - "--force-apply"
+    {{ end -}}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+  {{- if .ProxyConfig.ProxyMetadata }}
+    env:
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+  {{- end }}
+    resources:
+  {{ template "resources" . }}
+    securityContext:
+      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
+      privileged: {{ .Values.global.proxy.privileged }}
+      capabilities:
+    {{- if not .Values.pilot.cni.enabled }}
+        add:
+        - NET_ADMIN
+        - NET_RAW
+    {{- end }}
+        drop:
+        - ALL
+    {{- if not .Values.pilot.cni.enabled }}
+      readOnlyRootFilesystem: false
+      runAsGroup: 0
+      runAsNonRoot: false
+      runAsUser: 0
+    {{- else }}
+      readOnlyRootFilesystem: true
+      runAsGroup: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyGID | default "1337" }} {{ end }}
+      runAsUser: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyUID | default "1337" }} {{ end }}
+      runAsNonRoot: true
+    {{- end }}
+  {{ end -}}
+  {{ end -}}
+  {{ if not $nativeSidecar }}
+  containers:
+  {{ end }}
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
+    ports:
+    - containerPort: 15090
+      protocol: TCP
+      name: http-envoy-prom
+    args:
+    - proxy
+    - sidecar
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+  {{- if .Values.global.proxy.outlierLogPath }}
+    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
+  {{- end}}
+  {{- if .Values.global.proxy.lifecycle }}
+    lifecycle:
+      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
+  {{- else if $holdProxy }}
+    lifecycle:
+      postStart:
+        exec:
+          command:
+          - pilot-agent
+          - wait
+  {{- else if $nativeSidecar }}
+    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
+    lifecycle:
+      preStop:
+        exec:
+          command:
+          - pilot-agent
+          - request
+          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
+          - POST
+          - drain
+  {{- end }}
+    env:
+    {{- if eq .InboundTrafficPolicyMode "localhost" }}
+    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
+      value: "true"
+    {{- end }}
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: ISTIO_CPU_LIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: GOMEMLIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.memory
+    - name: GOMAXPROCS
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    {{- if .CompliancePolicy }}
+    - name: COMPLIANCE_POLICY
+      value: "{{ .CompliancePolicy }}"
+    {{- end }}
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    - name: ISTIO_META_INTERCEPTION_MODE
+      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- with (index .ObjectMeta.Labels `service.istio.io/workload-name` | default .DeploymentMeta.Name) }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ . }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - name: ISTIO_BOOTSTRAP_OVERRIDE
+      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
+    {{- end }}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
+    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
+  {{ if .Values.global.proxy.startupProbe.enabled }}
+    startupProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: 0
+      periodSeconds: 1
+      timeoutSeconds: 3
+      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
+  {{ end }}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
+    {{ end -}}
+    securityContext:
+      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
+      allowPrivilegeEscalation: true
+      capabilities:
+        add:
+        - NET_ADMIN
+        drop:
+        - ALL
+      privileged: true
+      readOnlyRootFilesystem: true
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+      runAsNonRoot: false
+      runAsUser: 0
+      {{- else }}
+      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
+      capabilities:
+        {{ if or (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
+        add:
+        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY` -}}
+        - NET_ADMIN
+        {{- end }}
+        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
+        - NET_BIND_SERVICE
+        {{- end }}
+        {{- end }}
+        drop:
+        - ALL
+      privileged: {{ .Values.global.proxy.privileged }}
+      readOnlyRootFilesystem: true
+      {{ if or ($tproxy) (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) -}}
+      runAsNonRoot: false
+      runAsUser: 0
+      runAsGroup: 1337
+      {{- else -}}
+      runAsNonRoot: true
+      runAsUser: {{ .ProxyUID | default "1337" }}
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+      {{- end }}
+      {{- end }}
+    resources:
+  {{ template "resources" . }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    - name: credential-socket
+      mountPath: /var/run/secrets/credential-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - mountPath: /etc/istio/custom-bootstrap
+      name: custom-bootstrap-volume
+    {{- end }}
+    # SDS channel between istioagent and Envoy
+    - mountPath: /etc/istio/proxy
+      name: istio-envoy
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
+    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
+      name: lightstep-certs
+      readOnly: true
+    {{- end }}
+      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
+      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
+    - name: "{{  $index }}"
+      {{ toYaml $value | indent 6 }}
+      {{ end }}
+      {{- end }}
+  volumes:
+  - emptyDir:
+    name: workload-socket
+  - emptyDir:
+    name: credential-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else }}
+  - emptyDir:
+    name: workload-certs
+  {{- end }}
+  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+  - name: custom-bootstrap-volume
+    configMap:
+      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-envoy
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+          name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+          path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: istio-ca-root-cert
+  {{- end }}
+  {{- end }}
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
+    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
+  - name: "{{ $index }}"
+    {{ toYaml $value | indent 4 }}
+    {{ end }}
+    {{ end }}
+  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
+  - name: lightstep-certs
+    secret:
+      optional: true
+      secretName: lightstep.cacert
+  {{- end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.26.6/charts/istiod/files/kube-gateway.yaml b/resources/v1.26.6/charts/istiod/files/kube-gateway.yaml
new file mode 100644
index 000000000..447ecae83
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/files/kube-gateway.yaml
@@ -0,0 +1,401 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{.ServiceAccount | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  {{- if ge .KubeVersion 128 }}
+  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+  {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.istio.io/managed" "istio.io-gateway-controller"
+      ) | nindent 4 }}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: {{.Name}}
+    uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      "{{.GatewayNameLabel}}": {{.Name}}
+  template:
+    metadata:
+      annotations:
+        {{- toJsonMap
+          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
+          (strdict "istio.io/rev" (.Revision | default "default"))
+          (strdict
+            "prometheus.io/path" "/stats/prometheus"
+            "prometheus.io/port" "15020"
+            "prometheus.io/scrape" "true"
+          ) | nindent 8 }}
+      labels:
+        {{- toJsonMap
+          (strdict
+            "sidecar.istio.io/inject" "false"
+            "service.istio.io/canonical-name" .DeploymentName
+            "service.istio.io/canonical-revision" "latest"
+           )
+          .InfrastructureLabels
+          (strdict
+            "gateway.networking.k8s.io/gateway-name" .Name
+            "gateway.istio.io/managed" "istio.io-gateway-controller"
+          ) | nindent 8 }}
+    spec:
+      securityContext:
+      {{- if .Values.gateways.securityContext }}
+        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
+      {{- else }}
+        sysctls:
+        - name: net.ipv4.ip_unprivileged_port_start
+          value: "0"
+      {{- if .Values.gateways.seccompProfile }}
+        seccompProfile:
+      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
+      {{- end }}
+      {{- end }}
+      serviceAccountName: {{.ServiceAccount | quote}}
+      containers:
+      - name: istio-proxy
+      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+      {{- else }}
+        image: "{{ .ProxyImage }}"
+      {{- end }}
+        {{- if .Values.global.proxy.resources }}
+        resources:
+          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
+        {{- end }}
+        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
+          allowPrivilegeEscalation: false
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsUser: {{ .ProxyUID | default "1337" }}
+          runAsGroup: {{ .ProxyGID | default "1337" }}
+          runAsNonRoot: true
+        ports:
+        - containerPort: 15020
+          name: metrics
+          protocol: TCP
+        - containerPort: 15021
+          name: status-port
+          protocol: TCP
+        - containerPort: 15090
+          protocol: TCP
+          name: http-envoy-prom
+        args:
+        - proxy
+        - router
+        - --domain
+        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+        - --proxyLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
+        - --proxyComponentLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
+        - --log_output_level
+        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
+      {{- if .Values.global.sts.servicePort }}
+        - --stsPort={{ .Values.global.sts.servicePort }}
+      {{- end }}
+      {{- if .Values.global.logAsJson }}
+        - --log_as_json
+      {{- end }}
+      {{- if .Values.global.proxy.lifecycle }}
+        lifecycle:
+          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
+      {{- end }}
+        env:
+        - name: PILOT_CERT_PROVIDER
+          value: {{ .Values.global.pilotCertProvider }}
+        - name: CA_ADDR
+        {{- if .Values.global.caAddress }}
+          value: {{ .Values.global.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        - name: ISTIO_CPU_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: PROXY_CONFIG
+          value: |
+                 {{ protoToJSON .ProxyConfig }}
+        - name: ISTIO_META_POD_PORTS
+          value: "[]"
+        - name: ISTIO_META_APP_CONTAINERS
+          value: ""
+        - name: GOMEMLIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.memory
+        - name: GOMAXPROCS
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: ISTIO_META_CLUSTER_ID
+          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
+        - name: ISTIO_META_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: ISTIO_META_INTERCEPTION_MODE
+          value: "{{ .ProxyConfig.InterceptionMode.String }}"
+        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
+        - name: ISTIO_META_NETWORK
+          value: {{.|quote}}
+        {{- end }}
+        - name: ISTIO_META_WORKLOAD_NAME
+          value: {{.DeploymentName|quote}}
+        - name: ISTIO_META_OWNER
+          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
+        {{- if .Values.global.meshID }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ .Values.global.meshID }}"
+        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+        {{- end }}
+        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+        - name: TRUST_DOMAIN
+          value: "{{ . }}"
+        {{- end }}
+        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
+        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
+          value: {{.|quote}}
+        {{- end }}
+        startupProbe:
+          failureThreshold: 30
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 1
+          periodSeconds: 1
+          successThreshold: 1
+          timeoutSeconds: 1
+        readinessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 0
+          periodSeconds: 15
+          successThreshold: 1
+          timeoutSeconds: 1
+        volumeMounts:
+        - name: workload-socket
+          mountPath: /var/run/secrets/workload-spiffe-uds
+        - name: credential-socket
+          mountPath: /var/run/secrets/credential-uds
+        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+        - name: gke-workload-certificate
+          mountPath: /var/run/secrets/workload-spiffe-credentials
+          readOnly: true
+        {{- else }}
+        - name: workload-certs
+          mountPath: /var/run/secrets/workload-spiffe-credentials
+        {{- end }}
+        {{- if eq .Values.global.pilotCertProvider "istiod" }}
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        {{- end }}
+        - mountPath: /var/lib/istio/data
+          name: istio-data
+        # SDS channel between istioagent and Envoy
+        - mountPath: /etc/istio/proxy
+          name: istio-envoy
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - name: istio-podinfo
+          mountPath: /etc/istio/pod
+      volumes:
+      - emptyDir: {}
+        name: workload-socket
+      - emptyDir: {}
+        name: credential-socket
+      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+      - name: gke-workload-certificate
+        csi:
+          driver: workloadcertificates.security.cloud.google.com
+      {{- else}}
+      - emptyDir: {}
+        name: workload-certs
+      {{- end }}
+      # SDS channel between istioagent and Envoy
+      - emptyDir:
+          medium: Memory
+        name: istio-envoy
+      - name: istio-data
+        emptyDir: {}
+      - name: istio-podinfo
+        downwardAPI:
+          items:
+            - path: "labels"
+              fieldRef:
+                fieldPath: metadata.labels
+            - path: "annotations"
+              fieldRef:
+                fieldPath: metadata.annotations
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: istio-token
+              expirationSeconds: 43200
+              audience: {{ .Values.global.sds.token.aud }}
+      {{- if eq .Values.global.pilotCertProvider "istiod" }}
+      - name: istiod-ca-cert
+      {{- if eq ((.Values.pilot).env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:root-cert
+              path: root-cert.pem
+      {{- else }}
+        configMap:
+          name: istio-ca-root-cert
+      {{- end }}
+      {{- end }}
+      {{- if .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: {{.Name}}
+    uid: {{.UID}}
+spec:
+  ipFamilyPolicy: PreferDualStack
+  ports:
+  {{- range $key, $val := .Ports }}
+  - name: {{ $val.Name | quote }}
+    port: {{ $val.Port }}
+    protocol: TCP
+    appProtocol: {{ $val.AppProtocol }}
+  {{- end }}
+  selector:
+    "{{.GatewayNameLabel}}": {{.Name}}
+  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
+  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
+  {{- end }}
+  type: {{ .ServiceType | quote }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name:  {{.DeploymentName | quote}}
+  maxReplicas: 1
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
+
diff --git a/resources/v1.24.2/charts/istiod/files/profile-ambient.yaml b/resources/v1.26.6/charts/istiod/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/files/profile-ambient.yaml
rename to resources/v1.26.6/charts/istiod/files/profile-ambient.yaml
diff --git a/resources/v1.26.6/charts/istiod/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.6/charts/istiod/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.6/charts/istiod/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.6/charts/istiod/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.6/charts/istiod/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.6/charts/istiod/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.3/charts/istiod/files/profile-demo.yaml b/resources/v1.26.6/charts/istiod/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.3/charts/istiod/files/profile-demo.yaml
rename to resources/v1.26.6/charts/istiod/files/profile-demo.yaml
diff --git a/resources/v1.26.6/charts/istiod/files/profile-platform-gke.yaml b/resources/v1.26.6/charts/istiod/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.2/charts/istiod/files/profile-platform-k3d.yaml b/resources/v1.26.6/charts/istiod/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/files/profile-platform-k3d.yaml
rename to resources/v1.26.6/charts/istiod/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.3/charts/istiod/files/profile-platform-k3s.yaml b/resources/v1.26.6/charts/istiod/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.3/charts/istiod/files/profile-platform-k3s.yaml
rename to resources/v1.26.6/charts/istiod/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.2/charts/istiod/files/profile-platform-microk8s.yaml b/resources/v1.26.6/charts/istiod/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/files/profile-platform-microk8s.yaml
rename to resources/v1.26.6/charts/istiod/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.2/charts/istiod/files/profile-platform-minikube.yaml b/resources/v1.26.6/charts/istiod/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/files/profile-platform-minikube.yaml
rename to resources/v1.26.6/charts/istiod/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.2/charts/istiod/files/profile-platform-openshift.yaml b/resources/v1.26.6/charts/istiod/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/files/profile-platform-openshift.yaml
rename to resources/v1.26.6/charts/istiod/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.2/charts/istiod/files/profile-preview.yaml b/resources/v1.26.6/charts/istiod/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/files/profile-preview.yaml
rename to resources/v1.26.6/charts/istiod/files/profile-preview.yaml
diff --git a/resources/v1.24.2/charts/istiod/files/profile-remote.yaml b/resources/v1.26.6/charts/istiod/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/files/profile-remote.yaml
rename to resources/v1.26.6/charts/istiod/files/profile-remote.yaml
diff --git a/resources/v1.24.2/charts/istiod/files/profile-stable.yaml b/resources/v1.26.6/charts/istiod/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/files/profile-stable.yaml
rename to resources/v1.26.6/charts/istiod/files/profile-stable.yaml
diff --git a/resources/v1.26.6/charts/istiod/files/waypoint.yaml b/resources/v1.26.6/charts/istiod/files/waypoint.yaml
new file mode 100644
index 000000000..421cabeae
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/files/waypoint.yaml
@@ -0,0 +1,396 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{.ServiceAccount | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  {{- if ge .KubeVersion 128 }}
+  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+  {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.istio.io/managed" "istio.io-mesh-controller"
+      ) | nindent 4 }}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      "{{.GatewayNameLabel}}": "{{.Name}}"
+  template:
+    metadata:
+      annotations:
+        {{- toJsonMap
+          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
+          (strdict "istio.io/rev" (.Revision | default "default"))
+          (strdict
+            "prometheus.io/path" "/stats/prometheus"
+            "prometheus.io/port" "15020"
+            "prometheus.io/scrape" "true"
+          ) | nindent 8 }}
+      labels:
+        {{- toJsonMap
+          (strdict
+            "sidecar.istio.io/inject" "false"
+            "istio.io/dataplane-mode" "none"
+            "service.istio.io/canonical-name" .DeploymentName
+            "service.istio.io/canonical-revision" "latest"
+           )
+          .InfrastructureLabels
+          (strdict
+            "gateway.networking.k8s.io/gateway-name" .Name
+            "gateway.istio.io/managed" "istio.io-mesh-controller"
+          ) | nindent 8}}
+    spec:
+      {{- if .Values.global.waypoint.affinity }}
+      affinity:
+      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.topologySpreadConstraints }}
+      topologySpreadConstraints:
+      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.nodeSelector }}
+      nodeSelector:
+      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.tolerations }}
+      tolerations:
+      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: 2
+      serviceAccountName: {{.ServiceAccount | quote}}
+      containers:
+      - name: istio-proxy
+        ports:
+        - containerPort: 15020
+          name: metrics
+          protocol: TCP
+        - containerPort: 15021
+          name: status-port
+          protocol: TCP
+        - containerPort: 15090
+          protocol: TCP
+          name: http-envoy-prom
+        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+        {{- else }}
+        image: "{{ .ProxyImage }}"
+        {{- end }}
+        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+        args:
+        - proxy
+        - waypoint
+        - --domain
+        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+        - --serviceCluster
+        - {{.ServiceAccount}}.$(POD_NAMESPACE)
+        - --proxyLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
+        - --proxyComponentLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
+        - --log_output_level
+        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
+        {{- if .Values.global.logAsJson }}
+        - --log_as_json
+        {{- end }}
+        {{- if .Values.global.proxy.outlierLogPath }}
+        - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
+        {{- end}}
+        env:
+        - name: ISTIO_META_SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: ISTIO_META_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: PILOT_CERT_PROVIDER
+          value: {{ .Values.global.pilotCertProvider }}
+        - name: CA_ADDR
+        {{- if .Values.global.caAddress }}
+          value: {{ .Values.global.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        - name: ISTIO_CPU_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: PROXY_CONFIG
+          value: |
+                 {{ protoToJSON .ProxyConfig }}
+        {{- if .ProxyConfig.ProxyMetadata }}
+        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- end }}
+        - name: GOMEMLIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.memory
+        - name: GOMAXPROCS
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: ISTIO_META_CLUSTER_ID
+          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
+        {{- if $network }}
+        - name: ISTIO_META_NETWORK
+          value: "{{ $network }}"
+        {{- end }}
+        - name: ISTIO_META_INTERCEPTION_MODE
+          value: REDIRECT
+        - name: ISTIO_META_WORKLOAD_NAME
+          value: {{.DeploymentName}}
+        - name: ISTIO_META_OWNER
+          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
+        {{- if .Values.global.meshID }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ .Values.global.meshID }}"
+        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+        {{- end }}
+        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: TRUST_DOMAIN
+          value: "{{ . }}"
+        {{- end }}
+        {{- if .Values.global.waypoint.resources }}
+        resources:
+        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
+        {{- end }}
+        startupProbe:
+          failureThreshold: 30
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 1
+          periodSeconds: 1
+          successThreshold: 1
+          timeoutSeconds: 1
+        readinessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 0
+          periodSeconds: 15
+          successThreshold: 1
+          timeoutSeconds: 1
+        securityContext:
+          privileged: false
+        {{- if not (eq .Values.global.platform "openshift") }}
+          runAsGroup: 1337
+          runAsUser: 1337
+        {{- end }}
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          capabilities:
+            drop:
+            - ALL
+{{- if .Values.gateways.seccompProfile }}
+          seccompProfile:
+{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
+{{- end }}
+        volumeMounts:
+        - mountPath: /var/run/secrets/workload-spiffe-uds
+          name: workload-socket
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        - mountPath: /var/lib/istio/data
+          name: istio-data
+        - mountPath: /etc/istio/proxy
+          name: istio-envoy
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - mountPath: /etc/istio/pod
+          name: istio-podinfo
+      volumes:
+      - emptyDir: {}
+        name: workload-socket
+      - emptyDir:
+          medium: Memory
+        name: istio-envoy
+      - emptyDir:
+          medium: Memory
+        name: go-proxy-envoy
+      - emptyDir: {}
+        name: istio-data
+      - emptyDir: {}
+        name: go-proxy-data
+      - downwardAPI:
+          items:
+          - fieldRef:
+              fieldPath: metadata.labels
+            path: labels
+          - fieldRef:
+              fieldPath: metadata.annotations
+            path: annotations
+        name: istio-podinfo
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              audience: istio-ca
+              expirationSeconds: 43200
+              path: istio-token
+      - name: istiod-ca-cert
+      {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:root-cert
+              path: root-cert.pem
+      {{- else }}
+        configMap:
+          name: istio-ca-root-cert
+      {{- end }}
+      {{- if .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    {{ toJsonMap
+      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
+      (omit .InfrastructureAnnotations
+        "kubectl.kubernetes.io/last-applied-configuration"
+        "gateway.istio.io/name-override"
+        "gateway.istio.io/service-account"
+        "gateway.istio.io/controller-version"
+      ) | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+spec:
+  ipFamilyPolicy: PreferDualStack
+  ports:
+  {{- range $key, $val := .Ports }}
+  - name: {{ $val.Name | quote }}
+    port: {{ $val.Port }}
+    protocol: TCP
+    appProtocol: {{ $val.AppProtocol }}
+  {{- end }}
+  selector:
+    "{{.GatewayNameLabel}}": "{{.Name}}"
+  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
+  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
+  {{- end }}
+  type: {{ .ServiceType | quote }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name:  {{.DeploymentName | quote}}
+  maxReplicas: 1
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
+
diff --git a/resources/v1.24.2/charts/istiod/templates/NOTES.txt b/resources/v1.26.6/charts/istiod/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/NOTES.txt
rename to resources/v1.26.6/charts/istiod/templates/NOTES.txt
diff --git a/resources/v1.24.2/charts/istiod/templates/_helpers.tpl b/resources/v1.26.6/charts/istiod/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/_helpers.tpl
rename to resources/v1.26.6/charts/istiod/templates/_helpers.tpl
diff --git a/resources/v1.24.2/charts/istiod/templates/autoscale.yaml b/resources/v1.26.6/charts/istiod/templates/autoscale.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/autoscale.yaml
rename to resources/v1.26.6/charts/istiod/templates/autoscale.yaml
diff --git a/resources/v1.26.6/charts/istiod/templates/clusterrole.yaml b/resources/v1.26.6/charts/istiod/templates/clusterrole.yaml
new file mode 100644
index 000000000..d4d79d00f
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/templates/clusterrole.yaml
@@ -0,0 +1,206 @@
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (and .Values.istiodRemote.enabled .Values.global.configCluster) (not .Values.istiodRemote.enabled) }}
+{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  # sidecar injection controller
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+
+  # configuration validation webhook controller
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update"]
+
+  # istio configuration
+  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
+  # please proceed with caution
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["get", "watch", "list"]
+    resources: ["*"]
+{{- if .Values.global.istiod.enableAnalysis }}
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["update", "patch"]
+    resources:
+    - authorizationpolicies/status
+    - destinationrules/status
+    - envoyfilters/status
+    - gateways/status
+    - peerauthentications/status
+    - proxyconfigs/status
+    - requestauthentications/status
+    - serviceentries/status
+    - sidecars/status
+    - telemetries/status
+    - virtualservices/status
+    - wasmplugins/status
+    - workloadentries/status
+    - workloadgroups/status
+{{- end }}
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "workloadentries" ]
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "workloadentries/status",  "serviceentries/status" ]
+  - apiGroups: ["security.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "authorizationpolicies/status" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "services/status" ]
+
+  # auto-detect installed CRD definitions
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+
+  # discovery and routing
+  - apiGroups: [""]
+    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+
+{{- if .Values.taint.enabled }}
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["patch"]
+{{- end }}
+
+  # ingress controller
+{{- if .Values.global.istiod.enableAnalysis }}
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["*"]
+{{- end}}
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses", "ingressclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["*"]
+
+  # required for CA's namespace controller
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create", "get", "list", "watch", "update"]
+
+  # Istiod and bootstrap.
+{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
+{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
+  - apiGroups: ["certificates.k8s.io"]
+    resources:
+      - "certificatesigningrequests"
+      - "certificatesigningrequests/approval"
+      - "certificatesigningrequests/status"
+    verbs: ["update", "create", "get", "delete", "watch"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources:
+      - "signers"
+    resourceNames:
+{{- range .Values.global.certSigners }}
+    - {{ . | quote }}
+{{- end }}
+    verbs: ["approve"]
+{{- end}}
+{{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["clustertrustbundles"]
+    verbs: ["update", "create", "delete", "list", "watch", "get"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["signers"]
+    resourceNames: ["istio.io/istiod-ca"]
+    verbs: ["attest"]
+{{- end }}
+
+  # Used by Istiod to verify the JWT tokens
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]
+
+  # Used by Istiod to verify gateway SDS
+  - apiGroups: ["authorization.k8s.io"]
+    resources: ["subjectaccessreviews"]
+    verbs: ["create"]
+
+  # Use for Kubernetes Service APIs
+  - apiGroups: ["gateway.networking.k8s.io", "gateway.networking.x-k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["gateway.networking.x-k8s.io"]
+    resources:
+    - xbackendtrafficpolicies/status
+    verbs: ["update", "patch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources:
+    - backendtlspolicies/status
+    - gatewayclasses/status
+    - gateways/status
+    - grpcroutes/status
+    - httproutes/status
+    - referencegrants/status
+    - tcproutes/status
+    - tlsroutes/status
+    - udproutes/status
+    verbs: ["update", "patch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources: ["gatewayclasses"]
+    verbs: ["create", "update", "patch", "delete"]
+
+  # Needed for multicluster secret reading, possibly ingress certs in the future
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "watch", "list"]
+
+  # Used for MCS serviceexport management
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceexports"]
+    verbs: [ "get", "watch", "list", "create", "delete"]
+
+  # Used for MCS serviceimport management
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceimports"]
+    verbs: ["get", "watch", "list"]
+---
+{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["apps"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "deployments" ]
+  - apiGroups: ["autoscaling"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "horizontalpodautoscalers" ]
+  - apiGroups: ["policy"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "poddisruptionbudgets" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "services" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "serviceaccounts"]
+{{- end }}
+{{- end }}
diff --git a/resources/v1.24.2/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.26.6/charts/istiod/templates/clusterrolebinding.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/clusterrolebinding.yaml
rename to resources/v1.26.6/charts/istiod/templates/clusterrolebinding.yaml
diff --git a/resources/v1.24.2/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.26.6/charts/istiod/templates/configmap-jwks.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/configmap-jwks.yaml
rename to resources/v1.26.6/charts/istiod/templates/configmap-jwks.yaml
diff --git a/resources/v1.26.6/charts/istiod/templates/configmap-values.yaml b/resources/v1.26.6/charts/istiod/templates/configmap-values.yaml
new file mode 100644
index 000000000..75e6e0bcc
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/templates/configmap-values.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+  original-values: |-
+{{ .Values._original | toPrettyJson | indent 4 }}
+{{- $_ := unset $.Values "_original" }}
+  merged-values: |-
+{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.25.3/charts/istiod/templates/configmap.yaml b/resources/v1.26.6/charts/istiod/templates/configmap.yaml
similarity index 100%
rename from resources/v1.25.3/charts/istiod/templates/configmap.yaml
rename to resources/v1.26.6/charts/istiod/templates/configmap.yaml
diff --git a/resources/v1.26.6/charts/istiod/templates/deployment.yaml b/resources/v1.26.6/charts/istiod/templates/deployment.yaml
new file mode 100644
index 000000000..73917d860
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/templates/deployment.yaml
@@ -0,0 +1,304 @@
+# Not created if istiod is running remotely
+{{- if not .Values.istiodRemote.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istiod
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    istio: pilot
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+{{- range $key, $val := .Values.deploymentLabels }}
+    {{ $key }}: "{{ $val }}"
+{{- end }}
+spec:
+{{- if not .Values.autoscaleEnabled }}
+{{- if .Values.replicaCount }}
+  replicas: {{ .Values.replicaCount }}
+{{- end }}
+{{- end }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingMaxSurge }}
+      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
+  selector:
+    matchLabels:
+      {{- if ne .Values.revision "" }}
+      app: istiod
+      istio.io/rev: {{ .Values.revision | default "default" | quote }}
+      {{- else }}
+      istio: pilot
+      {{- end }}
+  template:
+    metadata:
+      labels:
+        app: istiod
+        istio.io/rev: {{ .Values.revision | default "default" | quote }}
+        sidecar.istio.io/inject: "false"
+        operator.istio.io/component: "Pilot"
+        {{- if ne .Values.revision "" }}
+        istio: istiod
+        {{- else }}
+        istio: pilot
+        {{- end }}
+        {{- range $key, $val := .Values.podLabels }}
+        {{ $key }}: "{{ $val }}"
+        {{- end }}
+        istio.io/dataplane-mode: none
+        app.kubernetes.io/name: "istiod"
+        {{- include "istio.labels" . | nindent 8 }}
+      annotations:
+        prometheus.io/port: "15014"
+        prometheus.io/scrape: "true"
+        sidecar.istio.io/inject: "false"
+        {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+        {{- end }}
+    spec:
+{{- if .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 8 }}
+{{- end }}
+{{- with .Values.affinity }}
+      affinity:
+{{- toYaml . | nindent 8 }}
+{{- end }}
+      tolerations:
+        - key: cni.istio.io/not-ready
+          operator: "Exists"
+{{- with .Values.tolerations }}
+{{- toYaml . | nindent 8 }}
+{{- end }}
+{{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+{{- toYaml . | nindent 8 }}
+{{- end }}
+      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+{{- if .Values.global.priorityClassName }}
+      priorityClassName: "{{ .Values.global.priorityClassName }}"
+{{- end }}
+{{- with .Values.initContainers }}
+      initContainers:
+        {{- tpl (toYaml .) $ | nindent 8 }}
+{{- end }}
+      containers:
+        - name: discovery
+{{- if contains "/" .Values.image }}
+          image: "{{ .Values.image }}"
+{{- else }}
+          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
+{{- end }}
+{{- if .Values.global.imagePullPolicy }}
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+{{- end }}
+          args:
+          - "discovery"
+          - --monitoringAddr=:15014
+{{- if .Values.global.logging.level }}
+          - --log_output_level={{ .Values.global.logging.level }}
+{{- end}}
+{{- if .Values.global.logAsJson }}
+          - --log_as_json
+{{- end }}
+          - --domain
+          - {{ .Values.global.proxy.clusterDomain }}
+{{- if .Values.taint.namespace }}
+          - --cniNamespace={{ .Values.taint.namespace }}
+{{- end }}
+          - --keepaliveMaxServerConnectionAge
+          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
+{{- if .Values.extraContainerArgs }}
+          {{- with .Values.extraContainerArgs }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+{{- end }}
+          ports:
+          - containerPort: 8080
+            protocol: TCP
+            name: http-debug
+          - containerPort: 15010
+            protocol: TCP
+            name: grpc-xds
+          - containerPort: 15012
+            protocol: TCP
+            name: tls-xds
+          - containerPort: 15017
+            protocol: TCP
+            name: https-webhooks
+          - containerPort: 15014
+            protocol: TCP
+            name: http-monitoring
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8080
+            initialDelaySeconds: 1
+            periodSeconds: 3
+            timeoutSeconds: 5
+          env:
+          - name: REVISION
+            value: "{{ .Values.revision | default `default` }}"
+          - name: PILOT_CERT_PROVIDER
+            value: {{ .Values.global.pilotCertProvider }}
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.name
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+          - name: SERVICE_ACCOUNT
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: spec.serviceAccountName
+          - name: KUBECONFIG
+            value: /var/run/secrets/remote/config
+          # If you explicitly told us where ztunnel lives, use that.
+          # Otherwise, assume it lives in our namespace
+          # Also, check for an explicit ENV override (legacy approach) and prefer that
+          # if present
+          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
+          {{ $ztTrustedName := or .Values.trustedZtunnelName "ztunnel" }}
+          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
+          - name: CA_TRUSTED_NODE_ACCOUNTS
+            value: "{{ $ztTrustedNS }}/{{ $ztTrustedName }}"
+          {{- end }}
+          {{- if .Values.env }}
+          {{- range $key, $val := .Values.env }}
+          - name: {{ $key }}
+            value: "{{ $val }}"
+          {{- end }}
+          {{- end }}
+          {{- with .Values.envVarFrom }}
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+{{- if .Values.traceSampling }}
+          - name: PILOT_TRACE_SAMPLING
+            value: "{{ .Values.traceSampling }}"
+{{- end }}
+# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
+# don't set it here to avoid duplication.
+# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
+{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
+          - name: EXTERNAL_ISTIOD
+            value: "{{ .Values.global.externalIstiod }}"
+{{- end }}
+          - name: PILOT_ENABLE_ANALYSIS
+            value: "{{ .Values.global.istiod.enableAnalysis }}"
+          - name: CLUSTER_ID
+            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
+          - name: GOMEMLIMIT
+            valueFrom:
+              resourceFieldRef:
+                resource: limits.memory
+                divisor: "1"
+          - name: GOMAXPROCS
+            valueFrom:
+              resourceFieldRef:
+                resource: limits.cpu
+                divisor: "1"
+          - name: PLATFORM
+            value: "{{ coalesce .Values.global.platform .Values.platform }}"
+          resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 12 }}
+{{- else }}
+{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
+{{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+              - ALL
+{{- if .Values.seccompProfile }}
+            seccompProfile:
+{{ toYaml .Values.seccompProfile | trim | indent 14 }}
+{{- end }}
+          volumeMounts:
+          - name: istio-token
+            mountPath: /var/run/secrets/tokens
+            readOnly: true
+          - name: local-certs
+            mountPath: /var/run/secrets/istio-dns
+          - name: cacerts
+            mountPath: /etc/cacerts
+            readOnly: true
+          - name: istio-kubeconfig
+            mountPath: /var/run/secrets/remote
+            readOnly: true
+          {{- if .Values.jwksResolverExtraRootCA }}
+          - name: extracacerts
+            mountPath: /cacerts
+          {{- end }}
+          - name: istio-csr-dns-cert
+            mountPath: /var/run/secrets/istiod/tls
+            readOnly: true
+          - name: istio-csr-ca-configmap
+            mountPath: /var/run/secrets/istiod/ca
+            readOnly: true
+          {{- with .Values.volumeMounts }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+      volumes:
+      # Technically not needed on this pod - but it helps debugging/testing SDS
+      # Should be removed after everything works.
+      - emptyDir:
+          medium: Memory
+        name: local-certs
+      - name: istio-token
+        projected:
+          sources:
+            - serviceAccountToken:
+                audience: {{ .Values.global.sds.token.aud }}
+                expirationSeconds: 43200
+                path: istio-token
+      # Optional: user-generated root
+      - name: cacerts
+        secret:
+          secretName: cacerts
+          optional: true
+      - name: istio-kubeconfig
+        secret:
+          secretName: istio-kubeconfig
+          optional: true
+      # Optional: istio-csr dns pilot certs
+      - name: istio-csr-dns-cert
+        secret:
+          secretName: istiod-tls
+          optional: true
+      - name: istio-csr-ca-configmap
+  {{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:root-cert
+              path: root-cert.pem
+              optional: true
+  {{- else }}
+        configMap:
+          name: istio-ca-root-cert
+          defaultMode: 420
+          optional: true
+  {{- end }}
+  {{- if .Values.jwksResolverExtraRootCA }}
+      - name: extracacerts
+        configMap:
+          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  {{- end }}
+      {{- with .Values.volumes }}
+        {{- toYaml . | nindent 6}}
+      {{- end }}
+
+---
+{{- end }}
diff --git a/resources/v1.26.6/charts/istiod/templates/gateway-class-configmap.yaml b/resources/v1.26.6/charts/istiod/templates/gateway-class-configmap.yaml
new file mode 100644
index 000000000..6b23d716a
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/templates/gateway-class-configmap.yaml
@@ -0,0 +1,20 @@
+{{ range $key, $value := .Values.gatewayClasses }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-{{ $.Values.revision | default "default"  }}-gatewayclass-{{$key}}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    gateway.istio.io/defaults-for-class: {{$key|quote}}
+    {{- include "istio.labels" $ | nindent 4 }}
+data:
+{{ range $kind, $overlay := $value }}
+  {{$kind}}: |
+{{$overlay|toYaml|trim|indent 4}}
+{{ end }}
+---
+{{ end }}
diff --git a/resources/v1.26.6/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.26.6/charts/istiod/templates/istiod-injector-configmap.yaml
new file mode 100644
index 000000000..171aff886
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/templates/istiod-injector-configmap.yaml
@@ -0,0 +1,81 @@
+{{- if not .Values.global.omitSidecarInjectorConfigMap }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
+  values: |-
+{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
+{{ $pilotVals := pick .Values "cni" "env" -}}
+{{ $vals = set $vals "pilot" $pilotVals -}}
+{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
+{{ $vals = set $vals "gateways" $gatewayVals -}}
+{{ $vals | toPrettyJson | indent 4 }}
+
+  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
+  # and istiod webhook functionality.
+  #
+  # New fields should not use Values - it is a 'primary' config object, users should be able
+  # to fine tune it or use it with kube-inject.
+  config: |-
+    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
+    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
+    defaultTemplates:
+{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
+    - {{ . }}
+{{- end }}
+    {{- else }}
+    defaultTemplates: [sidecar]
+    {{- end }}
+    policy: {{ .Values.global.proxy.autoInject }}
+    alwaysInjectSelector:
+{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
+    neverInjectSelector:
+{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
+    injectedAnnotations:
+      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
+      "{{ $key }}": {{ $val | quote }}
+      {{- end }}
+    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
+         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
+         This should make it obvious that their installation is broken.
+     */}}
+    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
+    templates:
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
+      sidecar: |
+{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
+      gateway: |
+{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
+      grpc-simple: |
+{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
+      grpc-agent: |
+{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
+      waypoint: |
+{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
+      kube-gateway: |
+{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
+{{- end }}
+{{- with .Values.sidecarInjectorWebhook.templates }}
+{{ toYaml . | trim | indent 6 }}
+{{- end }}
+
+{{- end }}
diff --git a/resources/v1.24.2/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.26.6/charts/istiod/templates/mutatingwebhook.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/mutatingwebhook.yaml
rename to resources/v1.26.6/charts/istiod/templates/mutatingwebhook.yaml
diff --git a/resources/v1.24.2/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.26.6/charts/istiod/templates/poddisruptionbudget.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/poddisruptionbudget.yaml
rename to resources/v1.26.6/charts/istiod/templates/poddisruptionbudget.yaml
diff --git a/resources/v1.26.6/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.26.6/charts/istiod/templates/reader-clusterrole.yaml
new file mode 100644
index 000000000..4707c7e9f
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/templates/reader-clusterrole.yaml
@@ -0,0 +1,64 @@
+{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istio-reader
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istio-reader"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - "config.istio.io"
+      - "security.istio.io"
+      - "networking.istio.io"
+      - "authentication.istio.io"
+      - "rbac.istio.io"
+      - "telemetry.istio.io"
+      - "extensions.istio.io"
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    # TODO(keithmattix): See if we can conditionally give permission to read secrets and configmaps iff externalIstiod
+    # is enabled. Best I can tell, these two resources are only needed for configuring proxy TLS (i.e. CA certs).
+    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets", "configmaps"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list" ]
+    resources: [ "workloadentries" ]
+  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
+    resources: ["gateways"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceexports"]
+    verbs: ["get", "list", "watch", "create", "delete"]
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceimports"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]
+  - apiGroups: ["authorization.k8s.io"]
+    resources: ["subjectaccessreviews"]
+    verbs: ["create"]
+{{- if .Values.istiodRemote.enabled }}
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create", "get", "list", "watch", "update"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update"]
+{{- end}}
diff --git a/resources/v1.24.2/charts/istiod/templates/reader-clusterrolebinding.yaml b/resources/v1.26.6/charts/istiod/templates/reader-clusterrolebinding.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/reader-clusterrolebinding.yaml
rename to resources/v1.26.6/charts/istiod/templates/reader-clusterrolebinding.yaml
diff --git a/resources/v1.24.2/charts/istiod/templates/remote-istiod-endpoints.yaml b/resources/v1.26.6/charts/istiod/templates/remote-istiod-endpoints.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/remote-istiod-endpoints.yaml
rename to resources/v1.26.6/charts/istiod/templates/remote-istiod-endpoints.yaml
diff --git a/resources/v1.25.3/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.26.6/charts/istiod/templates/remote-istiod-service.yaml
similarity index 100%
rename from resources/v1.25.3/charts/istiod/templates/remote-istiod-service.yaml
rename to resources/v1.26.6/charts/istiod/templates/remote-istiod-service.yaml
diff --git a/resources/v1.26.6/charts/istiod/templates/revision-tags.yaml b/resources/v1.26.6/charts/istiod/templates/revision-tags.yaml
new file mode 100644
index 000000000..e45b5e1d4
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/templates/revision-tags.yaml
@@ -0,0 +1,148 @@
+# Adapted from istio-discovery/templates/mutatingwebhook.yaml
+# Removed paths for legacy and default selectors since a revision tag
+# is inherently created from a specific revision
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- $whv := dict
+ "revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+{{- range $tagName := $.Values.revisionTags }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq $.Release.Namespace "istio-system"}}
+  name: istio-revision-tag-{{ $tagName }}
+{{- else }}
+  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/tag: {{ $tagName }}
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+
+{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
+{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
+{{- if (eq $tagName "default") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+---
+{{- end }}
diff --git a/resources/v1.24.2/charts/istiod/templates/role.yaml b/resources/v1.26.6/charts/istiod/templates/role.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/role.yaml
rename to resources/v1.26.6/charts/istiod/templates/role.yaml
diff --git a/resources/v1.24.2/charts/istiod/templates/rolebinding.yaml b/resources/v1.26.6/charts/istiod/templates/rolebinding.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/rolebinding.yaml
rename to resources/v1.26.6/charts/istiod/templates/rolebinding.yaml
diff --git a/resources/v1.24.2/charts/istiod/templates/service.yaml b/resources/v1.26.6/charts/istiod/templates/service.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/service.yaml
rename to resources/v1.26.6/charts/istiod/templates/service.yaml
diff --git a/resources/v1.24.4/charts/istiod/templates/serviceaccount.yaml b/resources/v1.26.6/charts/istiod/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.4/charts/istiod/templates/serviceaccount.yaml
rename to resources/v1.26.6/charts/istiod/templates/serviceaccount.yaml
diff --git a/resources/v1.24.2/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.26.6/charts/istiod/templates/validatingadmissionpolicy.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/validatingadmissionpolicy.yaml
rename to resources/v1.26.6/charts/istiod/templates/validatingadmissionpolicy.yaml
diff --git a/resources/v1.24.2/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.26.6/charts/istiod/templates/validatingwebhookconfiguration.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/validatingwebhookconfiguration.yaml
rename to resources/v1.26.6/charts/istiod/templates/validatingwebhookconfiguration.yaml
diff --git a/resources/v1.24.2/charts/istiod/templates/zzy_descope_legacy.yaml b/resources/v1.26.6/charts/istiod/templates/zzy_descope_legacy.yaml
similarity index 100%
rename from resources/v1.24.2/charts/istiod/templates/zzy_descope_legacy.yaml
rename to resources/v1.26.6/charts/istiod/templates/zzy_descope_legacy.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/base/templates/zzz_profile.yaml b/resources/v1.26.6/charts/istiod/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/base/templates/zzz_profile.yaml
rename to resources/v1.26.6/charts/istiod/templates/zzz_profile.yaml
diff --git a/resources/v1.26.6/charts/istiod/values.yaml b/resources/v1.26.6/charts/istiod/values.yaml
new file mode 100644
index 000000000..dc9187775
--- /dev/null
+++ b/resources/v1.26.6/charts/istiod/values.yaml
@@ -0,0 +1,553 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  autoscaleBehavior: {}
+  replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+
+  hub: ""
+  tag: ""
+  variant: ""
+
+  # Can be a full hub/image:tag
+  image: pilot
+  traceSampling: 1.0
+
+  # Resources for a small pilot install
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2048Mi
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # Whether to use an existing CNI installation
+  cni:
+    enabled: false
+    provider: default
+
+  # Additional container arguments
+  extraContainerArgs: []
+
+  env: {}
+
+  envVarFrom: []
+
+  # Settings related to the untaint controller
+  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
+  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
+  taint:
+    # Controls whether or not the untaint controller is active
+    enabled: false
+    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
+    namespace: ""
+
+  affinity: {}
+
+  tolerations: []
+
+  cpu:
+    targetAverageUtilization: 80
+  memory: {}
+    # targetAverageUtilization: 80
+
+  # Additional volumeMounts to the istiod container
+  volumeMounts: []
+
+  # Additional volumes to the istiod pod
+  volumes: []
+
+  # Inject initContainers into the istiod pod
+  initContainers: []
+
+  nodeSelector: {}
+  podAnnotations: {}
+  serviceAnnotations: {}
+  serviceAccountAnnotations: {}
+  sidecarInjectorWebhookAnnotations: {}
+
+  topologySpreadConstraints: []
+
+  # You can use jwksResolverExtraRootCA to provide a root certificate
+  # in PEM format. This will then be trusted by pilot when resolving
+  # JWKS URIs.
+  jwksResolverExtraRootCA: ""
+
+  # The following is used to limit how long a sidecar can be connected
+  # to a pilot. It balances out load across pilot instances at the cost of
+  # increasing system churn.
+  keepaliveMaxServerConnectionAge: 30m
+
+  # Additional labels to apply to the deployment.
+  deploymentLabels: {}
+
+  ## Mesh config settings
+
+  # Install the mesh config map, generated from values.yaml.
+  # If false, pilot wil use default values (by default) or user-supplied values.
+  configMap: true
+
+  # Additional labels to apply on the pod level for monitoring and logging configuration.
+  podLabels: {}
+
+  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
+  ipFamilyPolicy: ""
+  ipFamilies: []
+
+  # Ambient mode only.
+  # Set this if you install ztunnel to a different namespace from `istiod`.
+  # If set, `istiod` will allow connections from trusted node proxy ztunnels
+  # in the provided namespace.
+  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
+  # in the same namespace as itself.
+  trustedZtunnelNamespace: ""
+  # Set this if you install ztunnel with a name different from the default.
+  trustedZtunnelName: ""
+
+  sidecarInjectorWebhook:
+    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
+    # always skip the injection on pods that match that label selector, regardless of the global policy.
+    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
+    neverInjectSelector: []
+    alwaysInjectSelector: []
+
+    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
+    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
+    #
+    # annotations:
+    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+    #
+    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
+    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
+    # injectedAnnotations:
+    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
+    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
+    injectedAnnotations: {}
+
+    # This enables injection of sidecar in all namespaces,
+    # with the exception of namespaces with "istio-injection:disabled" annotation
+    # Only one environment should have this enabled.
+    enableNamespacesByDefault: false
+
+    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
+    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
+    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
+    reinvocationPolicy: Never
+
+    rewriteAppHTTPProbe: true
+
+    # Templates defines a set of custom injection templates that can be used. For example, defining:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
+    # being injected with the hello=world labels.
+    # This is intended for advanced configuration only; most users should use the built in template
+    templates: {}
+
+    # Default templates specifies a set of default templates that are used in sidecar injection.
+    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
+    # To inject other additional templates, define it using the `templates` option, and add it to
+    # the default templates list.
+    # For example:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # defaultTemplates: ["sidecar", "hello"]
+    defaultTemplates: []
+  istiodRemote:
+    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
+    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
+    # to utilize a remote instance.
+    enabled: false
+    # Sidecar injector mutating webhook configuration clientConfig.url value.
+    # For example: https://$remotePilotAddress:15017/inject
+    # The host should not refer to a service running in the cluster; use a service reference by specifying
+    # the clientConfig.service field instead.
+    injectionURL: ""
+
+    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
+    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
+    injectionPath: "/inject"
+
+    injectionCABundle: ""
+  telemetry:
+    enabled: true
+    v2:
+      # For Null VM case now.
+      # This also enables metadata exchange.
+      enabled: true
+      # Indicate if prometheus stats filter is enabled or not
+      prometheus:
+        enabled: true
+      # stackdriver filter settings.
+      stackdriver:
+        enabled: false
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # Revision tags are aliases to Istio control plane revisions
+  revisionTags: []
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
+  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
+  meshConfig:
+    enablePrometheusMerge: true
+
+  experimental:
+    stableValidationPolicy: false
+
+  global:
+    # Used to locate istiod.
+    istioNamespace: istio-system
+    # List of cert-signers to allow "approve" action in the istio cluster role
+    #
+    # certSigners:
+    #   - clusterissuers.cert-manager.io/istio-ca
+    certSigners: []
+    # enable pod disruption budget for the control plane, which is used to
+    # ensure Istio control plane components are gradually upgraded or recovered.
+    defaultPodDisruptionBudget:
+      enabled: true
+      # The values aren't mutable due to a current PodDisruptionBudget limitation
+      # minAvailable: 1
+
+    # A minimal set of requested resources to applied to all deployments so that
+    # Horizontal Pod Autoscaler will be able to function (if set).
+    # Each component can overwrite these default values by adding its own resources
+    # block in the relevant section below and setting the desired resources values.
+    defaultResources:
+      requests:
+        cpu: 10m
+      #   memory: 128Mi
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+    # Default tag for Istio images.
+    tag: 1.26.6
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Enabled by default in master for maximising testing.
+    istiod:
+      enableAnalysis: false
+
+    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
+    logAsJson: false
+
+    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+    # The control plane has different scopes depending on component, but can configure default log level across all components
+    # If empty, default scope and level will be used as configured in code
+    logging:
+      level: "default:info"
+
+    omitSidecarInjectorConfigMap: false
+
+    # Configure whether Operator manages webhook configurations. The current behavior
+    # of Istiod is to manage its own webhook configurations.
+    # When this option is set as true, Istio Operator, instead of webhooks, manages the
+    # webhook configurations. When this option is set as false, webhooks manage their
+    # own webhook configurations.
+    operatorManageWebhooks: false
+
+    # Custom DNS config for the pod to resolve names of services in other
+    # clusters. Use this to add additional search domains, and other settings.
+    # see
+    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
+    # This does not apply to gateway pods as they typically need a different
+    # set of DNS settings than the normal application pods (e.g., in
+    # multicluster scenarios).
+    # NOTE: If using templates, follow the pattern in the commented example below.
+    #podDNSSearchNamespaces:
+    #- global
+    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
+
+    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
+    # system-node-critical, it is better to configure this in order to make sure your Istio pods
+    # will not be killed because of low priority class.
+    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+    # for more detail.
+    priorityClassName: ""
+
+    proxy:
+      image: proxyv2
+
+      # This controls the 'policy' in the sidecar injector.
+      autoInject: enabled
+
+      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
+      # cluster domain. Default value is "cluster.local".
+      clusterDomain: "cluster.local"
+
+      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
+      # not set, then the global "logLevel" will be used.
+      componentLogLevel: "misc:error"
+
+      # istio ingress capture allowlist
+      # examples:
+      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
+      excludeInboundPorts: ""
+      includeInboundPorts: "*"
+
+      # istio egress capture allowlist
+      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
+      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
+      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
+      # be allowed by the sidecar
+      includeIPRanges: "*"
+      excludeIPRanges: ""
+      includeOutboundPorts: ""
+      excludeOutboundPorts: ""
+
+      # Log level for proxy, applies to gateways and sidecars.
+      # Expected values are: trace|debug|info|warning|error|critical|off
+      logLevel: warning
+
+      # Specify the path to the outlier event log.
+      # Example: /dev/stdout
+      outlierLogPath: ""
+
+      #If set to true, istio-proxy container will have privileged securityContext
+      privileged: false
+
+      # The number of successive failed probes before indicating readiness failure.
+      readinessFailureThreshold: 4
+
+      # The initial delay for readiness probes in seconds.
+      readinessInitialDelaySeconds: 0
+
+      # The period between readiness probes.
+      readinessPeriodSeconds: 15
+
+      # Enables or disables a startup probe.
+      # For optimal startup times, changing this should be tied to the readiness probe values.
+      #
+      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
+      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
+      # and doesn't spam the readiness endpoint too much
+      #
+      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
+      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
+      startupProbe:
+        enabled: true
+        failureThreshold: 600 # 10 minutes
+
+      # Resources for the sidecar.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: 2000m
+          memory: 1024Mi
+
+      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
+      statusPort: 15020
+
+      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
+      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
+      tracer: "none"
+
+    proxy_init:
+      # Base name for the proxy_init container, used to configure iptables.
+      image: proxyv2
+      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
+      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
+      forceApplyIptables: false
+
+    # configure remote pilot and istiod service and endpoint
+    remotePilotAddress: ""
+
+    ##############################################################################################
+    # The following values are found in other charts. To effectively modify these values, make   #
+    # make sure they are consistent across your Istio helm charts                                #
+    ##############################################################################################
+
+    # The customized CA address to retrieve certificates for the pods in the cluster.
+    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+    # If not set explicitly, default to the Istio discovery address.
+    caAddress: ""
+
+    # Enable control of remote clusters.
+    externalIstiod: false
+
+    # Configure a remote cluster as the config cluster for an external istiod.
+    configCluster: false
+
+    # configValidation enables the validation webhook for Istio configuration.
+    configValidation: true
+
+    # Mesh ID means Mesh Identifier. It should be unique within the scope where
+    # meshes will interact with each other, but it is not required to be
+    # globally/universally unique. For example, if any of the following are true,
+    # then two meshes must have different Mesh IDs:
+    # - Meshes will have their telemetry aggregated in one place
+    # - Meshes will be federated together
+    # - Policy will be written referencing one mesh from the other
+    #
+    # If an administrator expects that any of these conditions may become true in
+    # the future, they should ensure their meshes have different Mesh IDs
+    # assigned.
+    #
+    # Within a multicluster mesh, each cluster must be (manually or auto)
+    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
+    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
+    # of migration TBD, and it may be a disruptive operation to change the Mesh
+    # ID post-install.
+    #
+    # If the mesh admin does not specify a value, Istio will use the value of the
+    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
+    # value.
+    meshID: ""
+
+    # Configure the mesh networks to be used by the Split Horizon EDS.
+    #
+    # The following example defines two networks with different endpoints association methods.
+    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
+    # mapped to network1. The gateway for this network example is specified by its public IP
+    # address and port.
+    # The second network, `network2`, in this example is defined differently with all endpoints
+    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
+    # gateway is also defined differently with the name of the gateway service on the remote
+    # cluster. The public IP for the gateway will be determined from that remote service (only
+    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
+    # it still need to be configured manually).
+    #
+    # meshNetworks:
+    #   network1:
+    #     endpoints:
+    #     - fromCidr: "192.168.0.1/24"
+    #     gateways:
+    #     - address: 1.1.1.1
+    #       port: 80
+    #   network2:
+    #     endpoints:
+    #     - fromRegistry: reg1
+    #     gateways:
+    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
+    #       port: 443
+    #
+    meshNetworks: {}
+
+    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
+    mountMtlsCerts: false
+
+    multiCluster:
+      # Set to true to connect two kubernetes clusters via their respective
+      # ingressgateway services when pods in each cluster cannot directly
+      # talk to one another. All clusters should be using Istio mTLS and must
+      # have a shared root CA for this model to work.
+      enabled: false
+      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
+      # to properly label proxies
+      clusterName: ""
+
+    # Network defines the network this cluster belong to. This name
+    # corresponds to the networks in the map of mesh networks.
+    network: ""
+
+    # Configure the certificate provider for control plane communication.
+    # Currently, two providers are supported: "kubernetes" and "istiod".
+    # As some platforms may not have kubernetes signing APIs,
+    # Istiod is the default
+    pilotCertProvider: istiod
+
+    sds:
+      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
+      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
+      # JWT is intended for the CA.
+      token:
+        aud: istio-ca
+
+    sts:
+      # The service port used by Security Token Service (STS) server to handle token exchange requests.
+      # Setting this port to a non-zero value enables STS server.
+      servicePort: 0
+
+    # The name of the CA for workload certificates.
+    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
+    # will be used as the certificates for workloads.
+    # The default value is "" and when caName="", the CA will be configured by other
+    # mechanisms (e.g., environmental variable CA_PROVIDER).
+    caName: ""
+
+    waypoint:
+      # Resources for the waypoint proxy.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: "2"
+          memory: 1Gi
+
+      # If specified, affinity defines the scheduling constraints of waypoint pods.
+      affinity: {}
+
+      # Topology Spread Constraints for the waypoint proxy.
+      topologySpreadConstraints: []
+
+      # Node labels for the waypoint proxy.
+      nodeSelector: {}
+
+      # Tolerations for the waypoint proxy.
+      tolerations: []
+
+  base:
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  # Gateway Settings
+  gateways:
+    # Define the security context for the pod.
+    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+    securityContext: {}
+
+    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
+    seccompProfile: {}
+
+  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
+  # For example:
+  # gatewayClasses:
+  #   istio:
+  #     service:
+  #       spec:
+  #         type: ClusterIP
+  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
+  gatewayClasses: {}
diff --git a/resources/v1.26.6/charts/revisiontags/Chart.yaml b/resources/v1.26.6/charts/revisiontags/Chart.yaml
new file mode 100644
index 000000000..518159271
--- /dev/null
+++ b/resources/v1.26.6/charts/revisiontags/Chart.yaml
@@ -0,0 +1,8 @@
+apiVersion: v2
+appVersion: 1.26.6
+description: Helm chart for istio revision tags
+name: revisiontags
+sources:
+- https://github.com/istio-ecosystem/sail-operator
+version: 0.1.0
+
diff --git a/resources/v1.24.2/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.26.6/charts/revisiontags/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.2/charts/revisiontags/files/profile-ambient.yaml
rename to resources/v1.26.6/charts/revisiontags/files/profile-ambient.yaml
diff --git a/resources/v1.26.6/charts/revisiontags/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.6/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.6/charts/revisiontags/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.6/charts/revisiontags/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.6/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.6/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.6/charts/revisiontags/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.6/charts/revisiontags/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.6/charts/revisiontags/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.3/charts/revisiontags/files/profile-demo.yaml b/resources/v1.26.6/charts/revisiontags/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.3/charts/revisiontags/files/profile-demo.yaml
rename to resources/v1.26.6/charts/revisiontags/files/profile-demo.yaml
diff --git a/resources/v1.26.6/charts/revisiontags/files/profile-platform-gke.yaml b/resources/v1.26.6/charts/revisiontags/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.26.6/charts/revisiontags/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.2/charts/revisiontags/files/profile-platform-k3d.yaml b/resources/v1.26.6/charts/revisiontags/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.2/charts/revisiontags/files/profile-platform-k3d.yaml
rename to resources/v1.26.6/charts/revisiontags/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.3/charts/revisiontags/files/profile-platform-k3s.yaml b/resources/v1.26.6/charts/revisiontags/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.3/charts/revisiontags/files/profile-platform-k3s.yaml
rename to resources/v1.26.6/charts/revisiontags/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.2/charts/revisiontags/files/profile-platform-microk8s.yaml b/resources/v1.26.6/charts/revisiontags/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.2/charts/revisiontags/files/profile-platform-microk8s.yaml
rename to resources/v1.26.6/charts/revisiontags/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.2/charts/revisiontags/files/profile-platform-minikube.yaml b/resources/v1.26.6/charts/revisiontags/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.2/charts/revisiontags/files/profile-platform-minikube.yaml
rename to resources/v1.26.6/charts/revisiontags/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.2/charts/revisiontags/files/profile-platform-openshift.yaml b/resources/v1.26.6/charts/revisiontags/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.2/charts/revisiontags/files/profile-platform-openshift.yaml
rename to resources/v1.26.6/charts/revisiontags/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.2/charts/revisiontags/files/profile-preview.yaml b/resources/v1.26.6/charts/revisiontags/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.2/charts/revisiontags/files/profile-preview.yaml
rename to resources/v1.26.6/charts/revisiontags/files/profile-preview.yaml
diff --git a/resources/v1.24.2/charts/revisiontags/files/profile-remote.yaml b/resources/v1.26.6/charts/revisiontags/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.2/charts/revisiontags/files/profile-remote.yaml
rename to resources/v1.26.6/charts/revisiontags/files/profile-remote.yaml
diff --git a/resources/v1.24.2/charts/revisiontags/files/profile-stable.yaml b/resources/v1.26.6/charts/revisiontags/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.2/charts/revisiontags/files/profile-stable.yaml
rename to resources/v1.26.6/charts/revisiontags/files/profile-stable.yaml
diff --git a/resources/v1.26.6/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.26.6/charts/revisiontags/templates/revision-tags.yaml
new file mode 100644
index 000000000..e45b5e1d4
--- /dev/null
+++ b/resources/v1.26.6/charts/revisiontags/templates/revision-tags.yaml
@@ -0,0 +1,148 @@
+# Adapted from istio-discovery/templates/mutatingwebhook.yaml
+# Removed paths for legacy and default selectors since a revision tag
+# is inherently created from a specific revision
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- $whv := dict
+ "revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+{{- range $tagName := $.Values.revisionTags }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq $.Release.Namespace "istio-system"}}
+  name: istio-revision-tag-{{ $tagName }}
+{{- else }}
+  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/tag: {{ $tagName }}
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+
+{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
+{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
+{{- if (eq $tagName "default") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+---
+{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/templates/zzz_profile.yaml b/resources/v1.26.6/charts/revisiontags/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/cni/templates/zzz_profile.yaml
rename to resources/v1.26.6/charts/revisiontags/templates/zzz_profile.yaml
diff --git a/resources/v1.26.6/charts/revisiontags/values.yaml b/resources/v1.26.6/charts/revisiontags/values.yaml
new file mode 100644
index 000000000..dc9187775
--- /dev/null
+++ b/resources/v1.26.6/charts/revisiontags/values.yaml
@@ -0,0 +1,553 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  autoscaleBehavior: {}
+  replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+
+  hub: ""
+  tag: ""
+  variant: ""
+
+  # Can be a full hub/image:tag
+  image: pilot
+  traceSampling: 1.0
+
+  # Resources for a small pilot install
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2048Mi
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # Whether to use an existing CNI installation
+  cni:
+    enabled: false
+    provider: default
+
+  # Additional container arguments
+  extraContainerArgs: []
+
+  env: {}
+
+  envVarFrom: []
+
+  # Settings related to the untaint controller
+  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
+  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
+  taint:
+    # Controls whether or not the untaint controller is active
+    enabled: false
+    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
+    namespace: ""
+
+  affinity: {}
+
+  tolerations: []
+
+  cpu:
+    targetAverageUtilization: 80
+  memory: {}
+    # targetAverageUtilization: 80
+
+  # Additional volumeMounts to the istiod container
+  volumeMounts: []
+
+  # Additional volumes to the istiod pod
+  volumes: []
+
+  # Inject initContainers into the istiod pod
+  initContainers: []
+
+  nodeSelector: {}
+  podAnnotations: {}
+  serviceAnnotations: {}
+  serviceAccountAnnotations: {}
+  sidecarInjectorWebhookAnnotations: {}
+
+  topologySpreadConstraints: []
+
+  # You can use jwksResolverExtraRootCA to provide a root certificate
+  # in PEM format. This will then be trusted by pilot when resolving
+  # JWKS URIs.
+  jwksResolverExtraRootCA: ""
+
+  # The following is used to limit how long a sidecar can be connected
+  # to a pilot. It balances out load across pilot instances at the cost of
+  # increasing system churn.
+  keepaliveMaxServerConnectionAge: 30m
+
+  # Additional labels to apply to the deployment.
+  deploymentLabels: {}
+
+  ## Mesh config settings
+
+  # Install the mesh config map, generated from values.yaml.
+  # If false, pilot wil use default values (by default) or user-supplied values.
+  configMap: true
+
+  # Additional labels to apply on the pod level for monitoring and logging configuration.
+  podLabels: {}
+
+  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
+  ipFamilyPolicy: ""
+  ipFamilies: []
+
+  # Ambient mode only.
+  # Set this if you install ztunnel to a different namespace from `istiod`.
+  # If set, `istiod` will allow connections from trusted node proxy ztunnels
+  # in the provided namespace.
+  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
+  # in the same namespace as itself.
+  trustedZtunnelNamespace: ""
+  # Set this if you install ztunnel with a name different from the default.
+  trustedZtunnelName: ""
+
+  sidecarInjectorWebhook:
+    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
+    # always skip the injection on pods that match that label selector, regardless of the global policy.
+    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
+    neverInjectSelector: []
+    alwaysInjectSelector: []
+
+    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
+    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
+    #
+    # annotations:
+    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+    #
+    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
+    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
+    # injectedAnnotations:
+    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
+    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
+    injectedAnnotations: {}
+
+    # This enables injection of sidecar in all namespaces,
+    # with the exception of namespaces with "istio-injection:disabled" annotation
+    # Only one environment should have this enabled.
+    enableNamespacesByDefault: false
+
+    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
+    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
+    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
+    reinvocationPolicy: Never
+
+    rewriteAppHTTPProbe: true
+
+    # Templates defines a set of custom injection templates that can be used. For example, defining:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
+    # being injected with the hello=world labels.
+    # This is intended for advanced configuration only; most users should use the built in template
+    templates: {}
+
+    # Default templates specifies a set of default templates that are used in sidecar injection.
+    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
+    # To inject other additional templates, define it using the `templates` option, and add it to
+    # the default templates list.
+    # For example:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # defaultTemplates: ["sidecar", "hello"]
+    defaultTemplates: []
+  istiodRemote:
+    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
+    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
+    # to utilize a remote instance.
+    enabled: false
+    # Sidecar injector mutating webhook configuration clientConfig.url value.
+    # For example: https://$remotePilotAddress:15017/inject
+    # The host should not refer to a service running in the cluster; use a service reference by specifying
+    # the clientConfig.service field instead.
+    injectionURL: ""
+
+    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
+    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
+    injectionPath: "/inject"
+
+    injectionCABundle: ""
+  telemetry:
+    enabled: true
+    v2:
+      # For Null VM case now.
+      # This also enables metadata exchange.
+      enabled: true
+      # Indicate if prometheus stats filter is enabled or not
+      prometheus:
+        enabled: true
+      # stackdriver filter settings.
+      stackdriver:
+        enabled: false
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # Revision tags are aliases to Istio control plane revisions
+  revisionTags: []
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
+  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
+  meshConfig:
+    enablePrometheusMerge: true
+
+  experimental:
+    stableValidationPolicy: false
+
+  global:
+    # Used to locate istiod.
+    istioNamespace: istio-system
+    # List of cert-signers to allow "approve" action in the istio cluster role
+    #
+    # certSigners:
+    #   - clusterissuers.cert-manager.io/istio-ca
+    certSigners: []
+    # enable pod disruption budget for the control plane, which is used to
+    # ensure Istio control plane components are gradually upgraded or recovered.
+    defaultPodDisruptionBudget:
+      enabled: true
+      # The values aren't mutable due to a current PodDisruptionBudget limitation
+      # minAvailable: 1
+
+    # A minimal set of requested resources to applied to all deployments so that
+    # Horizontal Pod Autoscaler will be able to function (if set).
+    # Each component can overwrite these default values by adding its own resources
+    # block in the relevant section below and setting the desired resources values.
+    defaultResources:
+      requests:
+        cpu: 10m
+      #   memory: 128Mi
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+    # Default tag for Istio images.
+    tag: 1.26.6
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Enabled by default in master for maximising testing.
+    istiod:
+      enableAnalysis: false
+
+    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
+    logAsJson: false
+
+    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+    # The control plane has different scopes depending on component, but can configure default log level across all components
+    # If empty, default scope and level will be used as configured in code
+    logging:
+      level: "default:info"
+
+    omitSidecarInjectorConfigMap: false
+
+    # Configure whether Operator manages webhook configurations. The current behavior
+    # of Istiod is to manage its own webhook configurations.
+    # When this option is set as true, Istio Operator, instead of webhooks, manages the
+    # webhook configurations. When this option is set as false, webhooks manage their
+    # own webhook configurations.
+    operatorManageWebhooks: false
+
+    # Custom DNS config for the pod to resolve names of services in other
+    # clusters. Use this to add additional search domains, and other settings.
+    # see
+    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
+    # This does not apply to gateway pods as they typically need a different
+    # set of DNS settings than the normal application pods (e.g., in
+    # multicluster scenarios).
+    # NOTE: If using templates, follow the pattern in the commented example below.
+    #podDNSSearchNamespaces:
+    #- global
+    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
+
+    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
+    # system-node-critical, it is better to configure this in order to make sure your Istio pods
+    # will not be killed because of low priority class.
+    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+    # for more detail.
+    priorityClassName: ""
+
+    proxy:
+      image: proxyv2
+
+      # This controls the 'policy' in the sidecar injector.
+      autoInject: enabled
+
+      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
+      # cluster domain. Default value is "cluster.local".
+      clusterDomain: "cluster.local"
+
+      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
+      # not set, then the global "logLevel" will be used.
+      componentLogLevel: "misc:error"
+
+      # istio ingress capture allowlist
+      # examples:
+      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
+      excludeInboundPorts: ""
+      includeInboundPorts: "*"
+
+      # istio egress capture allowlist
+      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
+      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
+      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
+      # be allowed by the sidecar
+      includeIPRanges: "*"
+      excludeIPRanges: ""
+      includeOutboundPorts: ""
+      excludeOutboundPorts: ""
+
+      # Log level for proxy, applies to gateways and sidecars.
+      # Expected values are: trace|debug|info|warning|error|critical|off
+      logLevel: warning
+
+      # Specify the path to the outlier event log.
+      # Example: /dev/stdout
+      outlierLogPath: ""
+
+      #If set to true, istio-proxy container will have privileged securityContext
+      privileged: false
+
+      # The number of successive failed probes before indicating readiness failure.
+      readinessFailureThreshold: 4
+
+      # The initial delay for readiness probes in seconds.
+      readinessInitialDelaySeconds: 0
+
+      # The period between readiness probes.
+      readinessPeriodSeconds: 15
+
+      # Enables or disables a startup probe.
+      # For optimal startup times, changing this should be tied to the readiness probe values.
+      #
+      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
+      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
+      # and doesn't spam the readiness endpoint too much
+      #
+      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
+      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
+      startupProbe:
+        enabled: true
+        failureThreshold: 600 # 10 minutes
+
+      # Resources for the sidecar.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: 2000m
+          memory: 1024Mi
+
+      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
+      statusPort: 15020
+
+      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
+      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
+      tracer: "none"
+
+    proxy_init:
+      # Base name for the proxy_init container, used to configure iptables.
+      image: proxyv2
+      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
+      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
+      forceApplyIptables: false
+
+    # configure remote pilot and istiod service and endpoint
+    remotePilotAddress: ""
+
+    ##############################################################################################
+    # The following values are found in other charts. To effectively modify these values, make   #
+    # make sure they are consistent across your Istio helm charts                                #
+    ##############################################################################################
+
+    # The customized CA address to retrieve certificates for the pods in the cluster.
+    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+    # If not set explicitly, default to the Istio discovery address.
+    caAddress: ""
+
+    # Enable control of remote clusters.
+    externalIstiod: false
+
+    # Configure a remote cluster as the config cluster for an external istiod.
+    configCluster: false
+
+    # configValidation enables the validation webhook for Istio configuration.
+    configValidation: true
+
+    # Mesh ID means Mesh Identifier. It should be unique within the scope where
+    # meshes will interact with each other, but it is not required to be
+    # globally/universally unique. For example, if any of the following are true,
+    # then two meshes must have different Mesh IDs:
+    # - Meshes will have their telemetry aggregated in one place
+    # - Meshes will be federated together
+    # - Policy will be written referencing one mesh from the other
+    #
+    # If an administrator expects that any of these conditions may become true in
+    # the future, they should ensure their meshes have different Mesh IDs
+    # assigned.
+    #
+    # Within a multicluster mesh, each cluster must be (manually or auto)
+    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
+    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
+    # of migration TBD, and it may be a disruptive operation to change the Mesh
+    # ID post-install.
+    #
+    # If the mesh admin does not specify a value, Istio will use the value of the
+    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
+    # value.
+    meshID: ""
+
+    # Configure the mesh networks to be used by the Split Horizon EDS.
+    #
+    # The following example defines two networks with different endpoints association methods.
+    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
+    # mapped to network1. The gateway for this network example is specified by its public IP
+    # address and port.
+    # The second network, `network2`, in this example is defined differently with all endpoints
+    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
+    # gateway is also defined differently with the name of the gateway service on the remote
+    # cluster. The public IP for the gateway will be determined from that remote service (only
+    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
+    # it still need to be configured manually).
+    #
+    # meshNetworks:
+    #   network1:
+    #     endpoints:
+    #     - fromCidr: "192.168.0.1/24"
+    #     gateways:
+    #     - address: 1.1.1.1
+    #       port: 80
+    #   network2:
+    #     endpoints:
+    #     - fromRegistry: reg1
+    #     gateways:
+    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
+    #       port: 443
+    #
+    meshNetworks: {}
+
+    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
+    mountMtlsCerts: false
+
+    multiCluster:
+      # Set to true to connect two kubernetes clusters via their respective
+      # ingressgateway services when pods in each cluster cannot directly
+      # talk to one another. All clusters should be using Istio mTLS and must
+      # have a shared root CA for this model to work.
+      enabled: false
+      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
+      # to properly label proxies
+      clusterName: ""
+
+    # Network defines the network this cluster belong to. This name
+    # corresponds to the networks in the map of mesh networks.
+    network: ""
+
+    # Configure the certificate provider for control plane communication.
+    # Currently, two providers are supported: "kubernetes" and "istiod".
+    # As some platforms may not have kubernetes signing APIs,
+    # Istiod is the default
+    pilotCertProvider: istiod
+
+    sds:
+      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
+      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
+      # JWT is intended for the CA.
+      token:
+        aud: istio-ca
+
+    sts:
+      # The service port used by Security Token Service (STS) server to handle token exchange requests.
+      # Setting this port to a non-zero value enables STS server.
+      servicePort: 0
+
+    # The name of the CA for workload certificates.
+    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
+    # will be used as the certificates for workloads.
+    # The default value is "" and when caName="", the CA will be configured by other
+    # mechanisms (e.g., environmental variable CA_PROVIDER).
+    caName: ""
+
+    waypoint:
+      # Resources for the waypoint proxy.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: "2"
+          memory: 1Gi
+
+      # If specified, affinity defines the scheduling constraints of waypoint pods.
+      affinity: {}
+
+      # Topology Spread Constraints for the waypoint proxy.
+      topologySpreadConstraints: []
+
+      # Node labels for the waypoint proxy.
+      nodeSelector: {}
+
+      # Tolerations for the waypoint proxy.
+      tolerations: []
+
+  base:
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  # Gateway Settings
+  gateways:
+    # Define the security context for the pod.
+    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+    securityContext: {}
+
+    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
+    seccompProfile: {}
+
+  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
+  # For example:
+  # gatewayClasses:
+  #   istio:
+  #     service:
+  #       spec:
+  #         type: ClusterIP
+  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
+  gatewayClasses: {}
diff --git a/resources/v1.26.6/charts/ztunnel/Chart.yaml b/resources/v1.26.6/charts/ztunnel/Chart.yaml
new file mode 100644
index 000000000..8fbec7309
--- /dev/null
+++ b/resources/v1.26.6/charts/ztunnel/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+appVersion: 1.26.6
+description: Helm chart for istio ztunnel components
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio-ztunnel
+- istio
+name: ztunnel
+sources:
+- https://github.com/istio/istio
+version: 1.26.6
diff --git a/resources/v1.24.2/charts/ztunnel/README.md b/resources/v1.26.6/charts/ztunnel/README.md
similarity index 100%
rename from resources/v1.24.2/charts/ztunnel/README.md
rename to resources/v1.26.6/charts/ztunnel/README.md
diff --git a/resources/v1.24.2/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.26.6/charts/ztunnel/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.24.2/charts/ztunnel/files/profile-ambient.yaml
rename to resources/v1.26.6/charts/ztunnel/files/profile-ambient.yaml
diff --git a/resources/v1.26.6/charts/ztunnel/files/profile-compatibility-version-1.23.yaml b/resources/v1.26.6/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
new file mode 100644
index 000000000..dac910ff5
--- /dev/null
+++ b/resources/v1.26.6/charts/ztunnel/files/profile-compatibility-version-1.23.yaml
@@ -0,0 +1,25 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    ENABLE_INBOUND_RETRY_POLICY: "false"
+    EXCLUDE_UNSAFE_503_FROM_DEFAULT_RETRY: "false"
+    PREFER_DESTINATIONRULE_TLS_FOR_EXTERNAL_SERVICES: "false"
+    ENABLE_ENHANCED_DESTINATIONRULE_MERGE: "false"
+    PILOT_UNIFIED_SIDECAR_SCOPE: "false"
+
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      # 1.24 behaviour changes
+      ENABLE_DEFERRED_STATS_CREATION: "false"
+      BYPASS_OVERLOAD_MANAGER_FOR_STATIC_LISTENERS: "false"
+
+ambient:
+  # Not present in <1.24, defaults to `true` in 1.25+
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.6/charts/ztunnel/files/profile-compatibility-version-1.24.yaml b/resources/v1.26.6/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..b211c8266
--- /dev/null
+++ b/resources/v1.26.6/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.26.6/charts/ztunnel/files/profile-compatibility-version-1.25.yaml b/resources/v1.26.6/charts/ztunnel/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..eb8827cd5
--- /dev/null
+++ b/resources/v1.26.6/charts/ztunnel/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.25.3/charts/ztunnel/files/profile-demo.yaml b/resources/v1.26.6/charts/ztunnel/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.3/charts/ztunnel/files/profile-demo.yaml
rename to resources/v1.26.6/charts/ztunnel/files/profile-demo.yaml
diff --git a/resources/v1.26.6/charts/ztunnel/files/profile-platform-gke.yaml b/resources/v1.26.6/charts/ztunnel/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.26.6/charts/ztunnel/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.2/charts/ztunnel/files/profile-platform-k3d.yaml b/resources/v1.26.6/charts/ztunnel/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.2/charts/ztunnel/files/profile-platform-k3d.yaml
rename to resources/v1.26.6/charts/ztunnel/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.3/charts/ztunnel/files/profile-platform-k3s.yaml b/resources/v1.26.6/charts/ztunnel/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.3/charts/ztunnel/files/profile-platform-k3s.yaml
rename to resources/v1.26.6/charts/ztunnel/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.2/charts/ztunnel/files/profile-platform-microk8s.yaml b/resources/v1.26.6/charts/ztunnel/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.2/charts/ztunnel/files/profile-platform-microk8s.yaml
rename to resources/v1.26.6/charts/ztunnel/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.2/charts/ztunnel/files/profile-platform-minikube.yaml b/resources/v1.26.6/charts/ztunnel/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.2/charts/ztunnel/files/profile-platform-minikube.yaml
rename to resources/v1.26.6/charts/ztunnel/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.2/charts/ztunnel/files/profile-platform-openshift.yaml b/resources/v1.26.6/charts/ztunnel/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.2/charts/ztunnel/files/profile-platform-openshift.yaml
rename to resources/v1.26.6/charts/ztunnel/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.2/charts/ztunnel/files/profile-preview.yaml b/resources/v1.26.6/charts/ztunnel/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.2/charts/ztunnel/files/profile-preview.yaml
rename to resources/v1.26.6/charts/ztunnel/files/profile-preview.yaml
diff --git a/resources/v1.24.2/charts/ztunnel/files/profile-remote.yaml b/resources/v1.26.6/charts/ztunnel/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.2/charts/ztunnel/files/profile-remote.yaml
rename to resources/v1.26.6/charts/ztunnel/files/profile-remote.yaml
diff --git a/resources/v1.24.2/charts/ztunnel/files/profile-stable.yaml b/resources/v1.26.6/charts/ztunnel/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.2/charts/ztunnel/files/profile-stable.yaml
rename to resources/v1.26.6/charts/ztunnel/files/profile-stable.yaml
diff --git a/resources/v1.24.2/charts/ztunnel/templates/NOTES.txt b/resources/v1.26.6/charts/ztunnel/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.2/charts/ztunnel/templates/NOTES.txt
rename to resources/v1.26.6/charts/ztunnel/templates/NOTES.txt
diff --git a/resources/v1.26.6/charts/ztunnel/templates/_helpers.tpl b/resources/v1.26.6/charts/ztunnel/templates/_helpers.tpl
new file mode 100644
index 000000000..46a7a0b79
--- /dev/null
+++ b/resources/v1.26.6/charts/ztunnel/templates/_helpers.tpl
@@ -0,0 +1 @@
+{{ define "ztunnel.release-name" }}{{ .Values.resourceName| default "ztunnel" }}{{ end }}
diff --git a/resources/v1.26.6/charts/ztunnel/templates/daemonset.yaml b/resources/v1.26.6/charts/ztunnel/templates/daemonset.yaml
new file mode 100644
index 000000000..720970c97
--- /dev/null
+++ b/resources/v1.26.6/charts/ztunnel/templates/daemonset.yaml
@@ -0,0 +1,205 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
+  annotations:
+{{- if .Values.revision }}
+    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
+    {{- toYaml $annos | nindent 4}}
+{{- else }}
+    {{- .Values.annotations | toYaml | nindent 4 }}
+{{- end }}
+spec:
+  {{- with .Values.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app: ztunnel
+  template:
+    metadata:
+      labels:
+        sidecar.istio.io/inject: "false"
+        istio.io/dataplane-mode: none
+        app: ztunnel
+        app.kubernetes.io/name: ztunnel
+        {{- include "istio.labels" . | nindent 8}}
+{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+{{- if .Values.revision }}
+        istio.io/rev: {{ .Values.revision }}
+{{- end }}
+{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
+    spec:
+      nodeSelector:
+        kubernetes.io/os: linux
+{{- if .Values.nodeSelector }}
+{{ toYaml .Values.nodeSelector | indent 8 }}
+{{- end }}
+{{- if .Values.affinity }}
+      affinity:
+{{ toYaml .Values.affinity | trim | indent 8 }}
+{{- end }}
+      serviceAccountName: {{ include "ztunnel.release-name" . }}
+      tolerations:
+        - effect: NoSchedule
+          operator: Exists
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - effect: NoExecute
+          operator: Exists
+      containers:
+      - name: istio-proxy
+{{- if contains "/" .Values.image }}
+        image: "{{ .Values.image }}"
+{{- else }}
+        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
+{{- end }}
+        ports:
+        - containerPort: 15020
+          name: ztunnel-stats
+          protocol: TCP
+        resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 10 }}
+{{- end }}
+{{- with .Values.imagePullPolicy }}
+        imagePullPolicy: {{ . }}
+{{- end }}
+        securityContext:
+          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
+          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
+          allowPrivilegeEscalation: true
+          privileged: false
+          capabilities:
+            drop:
+            - ALL
+            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
+            - NET_ADMIN # Required for TPROXY and setsockopt
+            - SYS_ADMIN # Required for `setns` - doing things in other netns
+            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
+          readOnlyRootFilesystem: true
+          runAsGroup: 1337
+          runAsNonRoot: false
+          runAsUser: 0
+{{- if .Values.seLinuxOptions }}
+          seLinuxOptions:
+{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
+{{- end }}
+        readinessProbe:
+          httpGet:
+            port: 15021
+            path: /healthz/ready
+        args:
+        - proxy
+        - ztunnel
+        env:
+        - name: CA_ADDRESS
+        {{- if .Values.caAddress }}
+          value: {{ .Values.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: XDS_ADDRESS
+        {{- if .Values.xdsAddress }}
+          value: {{ .Values.xdsAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
+        {{- end }}
+        {{- if .Values.logAsJson }}
+        - name: LOG_FORMAT
+          value: json
+        {{- end}}
+        - name: RUST_LOG
+          value: {{ .Values.logLevel | quote }}
+        - name: RUST_BACKTRACE
+          value: "1"
+        - name: ISTIO_META_CLUSTER_ID
+          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
+        - name: INPOD_ENABLED
+          value: "true"
+        - name: TERMINATION_GRACE_PERIOD_SECONDS
+          value: "{{ .Values.terminationGracePeriodSeconds }}"
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
+        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- end }}
+        {{- with .Values.env }}
+        {{- range $key, $val := . }}
+        - name: {{ $key }}
+          value: "{{ $val }}"
+        {{- end }}
+        {{- end }}
+        volumeMounts:
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - mountPath: /var/run/ztunnel
+          name: cni-ztunnel-sock-dir
+        - mountPath: /tmp
+          name: tmp
+        {{- with .Values.volumeMounts }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+      priorityClassName: system-node-critical
+      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
+      volumes:
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: istio-token
+              expirationSeconds: 43200
+              audience: istio-ca
+      - name: istiod-ca-cert
+        {{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:root-cert
+              path: root-cert.pem
+        {{- else }}
+        configMap:
+          name: istio-ca-root-cert
+        {{- end }}
+      - name: cni-ztunnel-sock-dir
+        hostPath:
+          path: /var/run/ztunnel
+          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
+      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
+      - name: tmp
+        emptyDir: {}
+      {{- with .Values.volumes }}
+        {{- toYaml . | nindent 6}}
+      {{- end }}
diff --git a/resources/v1.25.3/charts/ztunnel/templates/rbac.yaml b/resources/v1.26.6/charts/ztunnel/templates/rbac.yaml
similarity index 100%
rename from resources/v1.25.3/charts/ztunnel/templates/rbac.yaml
rename to resources/v1.26.6/charts/ztunnel/templates/rbac.yaml
diff --git a/resources/v1.26.6/charts/ztunnel/templates/resourcequota.yaml b/resources/v1.26.6/charts/ztunnel/templates/resourcequota.yaml
new file mode 100644
index 000000000..a1c0e5496
--- /dev/null
+++ b/resources/v1.26.6/charts/ztunnel/templates/resourcequota.yaml
@@ -0,0 +1,20 @@
+{{- if .Values.resourceQuotas.enabled }}
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
+spec:
+  hard:
+    pods: {{ .Values.resourceQuotas.pods | quote }}
+  scopeSelector:
+    matchExpressions:
+    - operator: In
+      scopeName: PriorityClass
+      values:
+      - system-node-critical
+{{- end }}
diff --git a/resources/v1.26.6/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.26.6/charts/ztunnel/templates/zzz_profile.yaml
new file mode 100644
index 000000000..606c55669
--- /dev/null
+++ b/resources/v1.26.6/charts/ztunnel/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if true }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.26.6/charts/ztunnel/values.yaml b/resources/v1.26.6/charts/ztunnel/values.yaml
new file mode 100644
index 000000000..24a28fd3a
--- /dev/null
+++ b/resources/v1.26.6/charts/ztunnel/values.yaml
@@ -0,0 +1,114 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
+  hub: gcr.io/istio-release
+  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
+  tag: 1.26.6
+  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
+  variant: ""
+
+  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
+  # If Image contains a "/", it will replace the entire `image` in the pod.
+  image: ztunnel
+
+  # resourceName, if set, will override the naming of resources. If not set, will default to 'ztunnel'.
+  # If you set this, you MUST also set `trustedZtunnelName` in the `istiod` chart.
+  resourceName: ""
+
+  # Labels to apply to all top level resources
+  labels: {}
+  # Annotations to apply to all top level resources
+  annotations: {}
+
+  # Additional volumeMounts to the ztunnel container
+  volumeMounts: []
+
+  # Additional volumes to the ztunnel pod
+  volumes: []
+
+  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
+  podAnnotations:
+    prometheus.io/port: "15020"
+    prometheus.io/scrape: "true"
+
+  # Additional labels to apply on the pod level
+  podLabels: {}
+
+  # Pod resource configuration
+  resources:
+    requests:
+      cpu: 200m
+      # Ztunnel memory scales with the size of the cluster and traffic load
+      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
+      memory: 512Mi
+
+  resourceQuotas:
+    enabled: false
+    pods: 5000
+
+  # List of secret names to add to the service account as image pull secrets
+  imagePullSecrets: []
+
+  # A `key: value` mapping of environment variables to add to the pod
+  env: {}
+
+  # Override for the pod imagePullPolicy
+  imagePullPolicy: ""
+
+  # Settings for multicluster
+  multiCluster:
+    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
+    # with Istiod configuration.
+    clusterName: ""
+
+  # meshConfig defines runtime configuration of components.
+  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
+  # components.
+  # TODO: https://github.com/istio/istio/issues/43248
+  meshConfig:
+    defaultConfig:
+      proxyMetadata: {}
+
+  # This value defines:
+  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
+  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
+  # Default K8S value is 30 seconds
+  terminationGracePeriodSeconds: 30
+
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
+  revision: ""
+
+  # The customized CA address to retrieve certificates for the pods in the cluster.
+  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+  caAddress: ""
+
+  # The customized XDS address to retrieve configuration.
+  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
+  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
+  xdsAddress: ""
+
+  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
+  istioNamespace: istio-system
+
+  # Configuration log level of ztunnel binary, default is info.
+  # Valid values are: trace, debug, info, warn, error
+  logLevel: info
+
+  # To output all logs in json format
+  logAsJson: false
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seLinuxOptions: {}
+  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
+  #seLinuxOptions:
+  #  type: spc_t
+
+  # K8s DaemonSet update strategy.
+  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
diff --git a/resources/v1.26.6/cni-1.26.6.tgz.etag b/resources/v1.26.6/cni-1.26.6.tgz.etag
new file mode 100644
index 000000000..cc317a401
--- /dev/null
+++ b/resources/v1.26.6/cni-1.26.6.tgz.etag
@@ -0,0 +1 @@
+9b655cbb7050bb2547228fb03afa021c
diff --git a/resources/v1.26.6/commit b/resources/v1.26.6/commit
new file mode 100644
index 000000000..f250c8f60
--- /dev/null
+++ b/resources/v1.26.6/commit
@@ -0,0 +1 @@
+1.26.6
diff --git a/resources/v1.26.6/gateway-1.26.6.tgz.etag b/resources/v1.26.6/gateway-1.26.6.tgz.etag
new file mode 100644
index 000000000..91a0915a4
--- /dev/null
+++ b/resources/v1.26.6/gateway-1.26.6.tgz.etag
@@ -0,0 +1 @@
+af068856ca5a6f5b4c49b4c008f8024d
diff --git a/resources/v1.26.6/istiod-1.26.6.tgz.etag b/resources/v1.26.6/istiod-1.26.6.tgz.etag
new file mode 100644
index 000000000..2b30205fc
--- /dev/null
+++ b/resources/v1.26.6/istiod-1.26.6.tgz.etag
@@ -0,0 +1 @@
+85be991425ebab65f9e821ce49429e61
diff --git a/resources/v1.24.2/profiles/ambient.yaml b/resources/v1.26.6/profiles/ambient.yaml
similarity index 100%
rename from resources/v1.24.2/profiles/ambient.yaml
rename to resources/v1.26.6/profiles/ambient.yaml
diff --git a/resources/v1.25.3/profiles/default.yaml b/resources/v1.26.6/profiles/default.yaml
similarity index 100%
rename from resources/v1.25.3/profiles/default.yaml
rename to resources/v1.26.6/profiles/default.yaml
diff --git a/resources/v1.24.2/profiles/demo.yaml b/resources/v1.26.6/profiles/demo.yaml
similarity index 100%
rename from resources/v1.24.2/profiles/demo.yaml
rename to resources/v1.26.6/profiles/demo.yaml
diff --git a/resources/v1.24.2/profiles/empty.yaml b/resources/v1.26.6/profiles/empty.yaml
similarity index 100%
rename from resources/v1.24.2/profiles/empty.yaml
rename to resources/v1.26.6/profiles/empty.yaml
diff --git a/resources/v1.24.2/profiles/openshift-ambient.yaml b/resources/v1.26.6/profiles/openshift-ambient.yaml
similarity index 100%
rename from resources/v1.24.2/profiles/openshift-ambient.yaml
rename to resources/v1.26.6/profiles/openshift-ambient.yaml
diff --git a/resources/v1.24.2/profiles/openshift.yaml b/resources/v1.26.6/profiles/openshift.yaml
similarity index 100%
rename from resources/v1.24.2/profiles/openshift.yaml
rename to resources/v1.26.6/profiles/openshift.yaml
diff --git a/resources/v1.24.2/profiles/preview.yaml b/resources/v1.26.6/profiles/preview.yaml
similarity index 100%
rename from resources/v1.24.2/profiles/preview.yaml
rename to resources/v1.26.6/profiles/preview.yaml
diff --git a/resources/v1.24.2/profiles/remote.yaml b/resources/v1.26.6/profiles/remote.yaml
similarity index 100%
rename from resources/v1.24.2/profiles/remote.yaml
rename to resources/v1.26.6/profiles/remote.yaml
diff --git a/resources/v1.24.2/profiles/stable.yaml b/resources/v1.26.6/profiles/stable.yaml
similarity index 100%
rename from resources/v1.24.2/profiles/stable.yaml
rename to resources/v1.26.6/profiles/stable.yaml
diff --git a/resources/v1.26.6/ztunnel-1.26.6.tgz.etag b/resources/v1.26.6/ztunnel-1.26.6.tgz.etag
new file mode 100644
index 000000000..0626c69a2
--- /dev/null
+++ b/resources/v1.26.6/ztunnel-1.26.6.tgz.etag
@@ -0,0 +1 @@
+938951c3e7e1a6c423d527ae8378abb4
diff --git a/resources/v1.27.2/base-1.27.2.tgz.etag b/resources/v1.27.2/base-1.27.2.tgz.etag
new file mode 100644
index 000000000..8ca19cc00
--- /dev/null
+++ b/resources/v1.27.2/base-1.27.2.tgz.etag
@@ -0,0 +1 @@
+3f9ec4213cb967f1c458fa5621511032
diff --git a/resources/v1.27.2/charts/base/Chart.yaml b/resources/v1.27.2/charts/base/Chart.yaml
new file mode 100644
index 000000000..fa036d733
--- /dev/null
+++ b/resources/v1.27.2/charts/base/Chart.yaml
@@ -0,0 +1,10 @@
+apiVersion: v2
+appVersion: 1.27.2
+description: Helm chart for deploying Istio cluster resources and CRDs
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+name: base
+sources:
+- https://github.com/istio/istio
+version: 1.27.2
diff --git a/resources/v1.24.3/charts/base/README.md b/resources/v1.27.2/charts/base/README.md
similarity index 100%
rename from resources/v1.24.3/charts/base/README.md
rename to resources/v1.27.2/charts/base/README.md
diff --git a/resources/v1.28-alpha.724e2360/charts/base/files/profile-ambient.yaml b/resources/v1.27.2/charts/base/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/base/files/profile-ambient.yaml
rename to resources/v1.27.2/charts/base/files/profile-ambient.yaml
diff --git a/resources/v1.27.2/charts/base/files/profile-compatibility-version-1.24.yaml b/resources/v1.27.2/charts/base/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..4f3dbef7e
--- /dev/null
+++ b/resources/v1.27.2/charts/base/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,15 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.2/charts/base/files/profile-compatibility-version-1.25.yaml b/resources/v1.27.2/charts/base/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..b2f45948c
--- /dev/null
+++ b/resources/v1.27.2/charts/base/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.2/charts/base/files/profile-compatibility-version-1.26.yaml b/resources/v1.27.2/charts/base/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..af1069732
--- /dev/null
+++ b/resources/v1.27.2/charts/base/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
\ No newline at end of file
diff --git a/resources/v1.25.4/charts/base/files/profile-demo.yaml b/resources/v1.27.2/charts/base/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.4/charts/base/files/profile-demo.yaml
rename to resources/v1.27.2/charts/base/files/profile-demo.yaml
diff --git a/resources/v1.27.2/charts/base/files/profile-platform-gke.yaml b/resources/v1.27.2/charts/base/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.27.2/charts/base/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.3/charts/base/files/profile-platform-k3d.yaml b/resources/v1.27.2/charts/base/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.3/charts/base/files/profile-platform-k3d.yaml
rename to resources/v1.27.2/charts/base/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.4/charts/base/files/profile-platform-k3s.yaml b/resources/v1.27.2/charts/base/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.4/charts/base/files/profile-platform-k3s.yaml
rename to resources/v1.27.2/charts/base/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.3/charts/base/files/profile-platform-microk8s.yaml b/resources/v1.27.2/charts/base/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.3/charts/base/files/profile-platform-microk8s.yaml
rename to resources/v1.27.2/charts/base/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.3/charts/base/files/profile-platform-minikube.yaml b/resources/v1.27.2/charts/base/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.3/charts/base/files/profile-platform-minikube.yaml
rename to resources/v1.27.2/charts/base/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.3/charts/base/files/profile-platform-openshift.yaml b/resources/v1.27.2/charts/base/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.3/charts/base/files/profile-platform-openshift.yaml
rename to resources/v1.27.2/charts/base/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.3/charts/base/files/profile-preview.yaml b/resources/v1.27.2/charts/base/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.3/charts/base/files/profile-preview.yaml
rename to resources/v1.27.2/charts/base/files/profile-preview.yaml
diff --git a/resources/v1.24.3/charts/base/files/profile-remote.yaml b/resources/v1.27.2/charts/base/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.3/charts/base/files/profile-remote.yaml
rename to resources/v1.27.2/charts/base/files/profile-remote.yaml
diff --git a/resources/v1.24.3/charts/base/files/profile-stable.yaml b/resources/v1.27.2/charts/base/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.3/charts/base/files/profile-stable.yaml
rename to resources/v1.27.2/charts/base/files/profile-stable.yaml
diff --git a/resources/v1.24.3/charts/base/templates/NOTES.txt b/resources/v1.27.2/charts/base/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.3/charts/base/templates/NOTES.txt
rename to resources/v1.27.2/charts/base/templates/NOTES.txt
diff --git a/resources/v1.24.3/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml b/resources/v1.27.2/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
similarity index 100%
rename from resources/v1.24.3/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
rename to resources/v1.27.2/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
diff --git a/resources/v1.24.3/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml b/resources/v1.27.2/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
similarity index 100%
rename from resources/v1.24.3/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
rename to resources/v1.27.2/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
diff --git a/resources/v1.24.3/charts/base/templates/reader-serviceaccount.yaml b/resources/v1.27.2/charts/base/templates/reader-serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.3/charts/base/templates/reader-serviceaccount.yaml
rename to resources/v1.27.2/charts/base/templates/reader-serviceaccount.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/zzz_profile.yaml b/resources/v1.27.2/charts/base/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/zzz_profile.yaml
rename to resources/v1.27.2/charts/base/templates/zzz_profile.yaml
diff --git a/resources/v1.25.4/charts/base/values.yaml b/resources/v1.27.2/charts/base/values.yaml
similarity index 100%
rename from resources/v1.25.4/charts/base/values.yaml
rename to resources/v1.27.2/charts/base/values.yaml
diff --git a/resources/v1.27.2/charts/cni/Chart.yaml b/resources/v1.27.2/charts/cni/Chart.yaml
new file mode 100644
index 000000000..fd22b7431
--- /dev/null
+++ b/resources/v1.27.2/charts/cni/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+appVersion: 1.27.2
+description: Helm chart for istio-cni components
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio-cni
+- istio
+name: cni
+sources:
+- https://github.com/istio/istio
+version: 1.27.2
diff --git a/resources/v1.24.3/charts/cni/README.md b/resources/v1.27.2/charts/cni/README.md
similarity index 100%
rename from resources/v1.24.3/charts/cni/README.md
rename to resources/v1.27.2/charts/cni/README.md
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-ambient.yaml b/resources/v1.27.2/charts/cni/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/cni/files/profile-ambient.yaml
rename to resources/v1.27.2/charts/cni/files/profile-ambient.yaml
diff --git a/resources/v1.27.2/charts/cni/files/profile-compatibility-version-1.24.yaml b/resources/v1.27.2/charts/cni/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..4f3dbef7e
--- /dev/null
+++ b/resources/v1.27.2/charts/cni/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,15 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.2/charts/cni/files/profile-compatibility-version-1.25.yaml b/resources/v1.27.2/charts/cni/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..b2f45948c
--- /dev/null
+++ b/resources/v1.27.2/charts/cni/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.2/charts/cni/files/profile-compatibility-version-1.26.yaml b/resources/v1.27.2/charts/cni/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..af1069732
--- /dev/null
+++ b/resources/v1.27.2/charts/cni/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
\ No newline at end of file
diff --git a/resources/v1.25.4/charts/cni/files/profile-demo.yaml b/resources/v1.27.2/charts/cni/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.4/charts/cni/files/profile-demo.yaml
rename to resources/v1.27.2/charts/cni/files/profile-demo.yaml
diff --git a/resources/v1.27.2/charts/cni/files/profile-platform-gke.yaml b/resources/v1.27.2/charts/cni/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.27.2/charts/cni/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.3/charts/cni/files/profile-platform-k3d.yaml b/resources/v1.27.2/charts/cni/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.3/charts/cni/files/profile-platform-k3d.yaml
rename to resources/v1.27.2/charts/cni/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.4/charts/cni/files/profile-platform-k3s.yaml b/resources/v1.27.2/charts/cni/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.4/charts/cni/files/profile-platform-k3s.yaml
rename to resources/v1.27.2/charts/cni/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.3/charts/cni/files/profile-platform-microk8s.yaml b/resources/v1.27.2/charts/cni/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.3/charts/cni/files/profile-platform-microk8s.yaml
rename to resources/v1.27.2/charts/cni/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.3/charts/cni/files/profile-platform-minikube.yaml b/resources/v1.27.2/charts/cni/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.3/charts/cni/files/profile-platform-minikube.yaml
rename to resources/v1.27.2/charts/cni/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.3/charts/cni/files/profile-platform-openshift.yaml b/resources/v1.27.2/charts/cni/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.3/charts/cni/files/profile-platform-openshift.yaml
rename to resources/v1.27.2/charts/cni/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.3/charts/cni/files/profile-preview.yaml b/resources/v1.27.2/charts/cni/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.3/charts/cni/files/profile-preview.yaml
rename to resources/v1.27.2/charts/cni/files/profile-preview.yaml
diff --git a/resources/v1.24.3/charts/cni/files/profile-remote.yaml b/resources/v1.27.2/charts/cni/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.3/charts/cni/files/profile-remote.yaml
rename to resources/v1.27.2/charts/cni/files/profile-remote.yaml
diff --git a/resources/v1.24.3/charts/cni/files/profile-stable.yaml b/resources/v1.27.2/charts/cni/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.3/charts/cni/files/profile-stable.yaml
rename to resources/v1.27.2/charts/cni/files/profile-stable.yaml
diff --git a/resources/v1.24.3/charts/cni/templates/NOTES.txt b/resources/v1.27.2/charts/cni/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.3/charts/cni/templates/NOTES.txt
rename to resources/v1.27.2/charts/cni/templates/NOTES.txt
diff --git a/resources/v1.24.3/charts/cni/templates/_helpers.tpl b/resources/v1.27.2/charts/cni/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.3/charts/cni/templates/_helpers.tpl
rename to resources/v1.27.2/charts/cni/templates/_helpers.tpl
diff --git a/resources/v1.25.4/charts/cni/templates/clusterrole.yaml b/resources/v1.27.2/charts/cni/templates/clusterrole.yaml
similarity index 100%
rename from resources/v1.25.4/charts/cni/templates/clusterrole.yaml
rename to resources/v1.27.2/charts/cni/templates/clusterrole.yaml
diff --git a/resources/v1.24.3/charts/cni/templates/clusterrolebinding.yaml b/resources/v1.27.2/charts/cni/templates/clusterrolebinding.yaml
similarity index 100%
rename from resources/v1.24.3/charts/cni/templates/clusterrolebinding.yaml
rename to resources/v1.27.2/charts/cni/templates/clusterrolebinding.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/templates/configmap-cni.yaml b/resources/v1.27.2/charts/cni/templates/configmap-cni.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/cni/templates/configmap-cni.yaml
rename to resources/v1.27.2/charts/cni/templates/configmap-cni.yaml
diff --git a/resources/v1.27.2/charts/cni/templates/daemonset.yaml b/resources/v1.27.2/charts/cni/templates/daemonset.yaml
new file mode 100644
index 000000000..896de3d03
--- /dev/null
+++ b/resources/v1.27.2/charts/cni/templates/daemonset.yaml
@@ -0,0 +1,248 @@
+# This manifest installs the Istio install-cni container, as well
+# as the Istio CNI plugin and config on
+# each master and worker node in a Kubernetes cluster.
+#
+# $detectedBinDir exists to support a GKE-specific platform override,
+# and is deprecated in favor of using the explicit `gke` platform profile.
+{{- $detectedBinDir := (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
+    "/home/kubernetes/bin"
+    "/opt/cni/bin"
+}}
+{{- if .Values.cniBinDir }}
+{{ $detectedBinDir = .Values.cniBinDir }}
+{{- end }}
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  # Note that this is templated but evaluates to a fixed name
+  # which the CNI plugin may fall back onto in some failsafe scenarios.
+  # if this name is changed, CNI plugin logic that checks for this name
+  # format should also be updated.
+  name: {{ template "name" . }}-node
+  namespace: {{ .Release.Namespace }}
+  labels:
+    k8s-app: {{ template "name" . }}-node
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      k8s-app: {{ template "name" . }}-node
+  {{- with .Values.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  template:
+    metadata:
+      labels:
+        k8s-app: {{ template "name" . }}-node
+        sidecar.istio.io/inject: "false"
+        istio.io/dataplane-mode: none
+        app.kubernetes.io/name: {{ template "name" . }}
+        {{- include "istio.labels" . | nindent 8 }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+        # Add Prometheus Scrape annotations
+        prometheus.io/scrape: 'true'
+        prometheus.io/port: "15014"
+        prometheus.io/path: '/metrics'
+        # Add AppArmor annotation
+        # This is required to avoid conflicts with AppArmor profiles which block certain
+        # privileged pod capabilities.
+        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
+        # securityContext which is otherwise preferred.
+        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
+        # Custom annotations
+        {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+        {{- end }}
+    spec:
+{{- if and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace }}
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+{{- end }}
+      nodeSelector:
+        kubernetes.io/os: linux
+      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      priorityClassName: system-node-critical
+      serviceAccountName: {{ template "name" . }}
+      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
+      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
+      terminationGracePeriodSeconds: 5
+      containers:
+        # This container installs the Istio CNI binaries
+        # and CNI network config file on each node.
+        - name: install-cni
+{{- if contains "/" .Values.image }}
+          image: "{{ .Values.image }}"
+{{- else }}
+          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
+{{- end }}
+{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
+          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
+{{- end }}
+          ports:
+          - containerPort: 15014
+            name: metrics
+            protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8000
+          securityContext:
+            privileged: false
+            runAsGroup: 0
+            runAsUser: 0
+            runAsNonRoot: false
+            # Both ambient and sidecar repair mode require elevated node privileges to function.
+            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
+            # add capabilities based on feature.
+            capabilities:
+              drop:
+              - ALL
+              add:
+              # CAP_NET_ADMIN is required to allow ipset and route table access
+              - NET_ADMIN
+              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
+              - NET_RAW
+              # CAP_SYS_PTRACE is required for repair and ambient mode to describe
+              # the pod's network namespace.
+              - SYS_PTRACE
+              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
+              # network namespaces in `/proc` to obtain descriptors for entering pod network
+              # namespaces. There does not appear to be a more granular capability for this.
+              - SYS_ADMIN
+              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
+              # the typical ability to read/write to folders owned by others.
+              # This can cause problems if the hostPath mounts we use, which we require write access into,
+              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
+              - DAC_OVERRIDE
+{{- if .Values.seLinuxOptions }}
+{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
+            seLinuxOptions:
+{{ toYaml . | trim | indent 14 }}
+{{- end }}
+{{- end }}
+{{- if .Values.seccompProfile }}
+            seccompProfile:
+{{ toYaml .Values.seccompProfile | trim | indent 14 }}
+{{- end }}
+          command: ["install-cni"]
+          args:
+            {{- if or .Values.logging.level .Values.global.logging.level }}
+            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
+            {{- end}}
+            {{- if .Values.global.logAsJson }}
+            - --log_as_json
+            {{- end}}
+          envFrom:
+            - configMapRef:
+                name: {{ template "name" . }}-config
+          env:
+            - name: REPAIR_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: REPAIR_RUN_AS_DAEMON
+              value: "true"
+            - name: REPAIR_SIDECAR_ANNOTATION
+              value: "sidecar.istio.io/status"
+            {{- if not (and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace) }}
+            - name: ALLOW_SWITCH_TO_HOST_NS
+              value: "true"
+            {{- end }}
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+            - name: GOMEMLIMIT
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.memory
+                  divisor: '1'
+            - name: GOMAXPROCS
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.cpu
+                  divisor: '1'
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            {{- if .Values.env }}
+            {{- range $key, $val := .Values.env }}
+            - name: {{ $key }}
+              value: "{{ $val }}"
+            {{- end }}
+            {{- end }}
+          volumeMounts:
+            - mountPath: /host/opt/cni/bin
+              name: cni-bin-dir
+            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
+            - mountPath: /host/proc
+              name: cni-host-procfs
+              readOnly: true
+            {{- end }}
+            - mountPath: /host/etc/cni/net.d
+              name: cni-net-dir
+            - mountPath: /var/run/istio-cni
+              name: cni-socket-dir
+            {{- if .Values.ambient.enabled }}
+            - mountPath: /host/var/run/netns
+              mountPropagation: HostToContainer
+              name: cni-netns-dir
+            - mountPath: /var/run/ztunnel
+              name: cni-ztunnel-sock-dir
+            {{ end }}
+          resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 12 }}
+{{- else }}
+{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
+{{- end }}
+      volumes:
+        # Used to install CNI.
+        - name: cni-bin-dir
+          hostPath:
+            path: {{ $detectedBinDir }}
+        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
+        - name: cni-host-procfs
+          hostPath:
+            path: /proc
+            type: Directory
+        {{- end }}
+        {{- if .Values.ambient.enabled }}
+        - name: cni-ztunnel-sock-dir
+          hostPath:
+            path: /var/run/ztunnel
+            type: DirectoryOrCreate
+        {{- end }}
+        - name: cni-net-dir
+          hostPath:
+            path: {{ .Values.cniConfDir }}
+        # Used for UDS sockets for logging, ambient eventing
+        - name: cni-socket-dir
+          hostPath:
+            path: /var/run/istio-cni
+        - name: cni-netns-dir
+          hostPath:
+            path: {{ .Values.cniNetnsDir }}
+            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
+            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
+            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.24.3/charts/cni/templates/network-attachment-definition.yaml b/resources/v1.27.2/charts/cni/templates/network-attachment-definition.yaml
similarity index 100%
rename from resources/v1.24.3/charts/cni/templates/network-attachment-definition.yaml
rename to resources/v1.27.2/charts/cni/templates/network-attachment-definition.yaml
diff --git a/resources/v1.24.3/charts/cni/templates/resourcequota.yaml b/resources/v1.27.2/charts/cni/templates/resourcequota.yaml
similarity index 100%
rename from resources/v1.24.3/charts/cni/templates/resourcequota.yaml
rename to resources/v1.27.2/charts/cni/templates/resourcequota.yaml
diff --git a/resources/v1.24.3/charts/cni/templates/serviceaccount.yaml b/resources/v1.27.2/charts/cni/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.3/charts/cni/templates/serviceaccount.yaml
rename to resources/v1.27.2/charts/cni/templates/serviceaccount.yaml
diff --git a/resources/v1.24.3/charts/cni/templates/zzy_descope_legacy.yaml b/resources/v1.27.2/charts/cni/templates/zzy_descope_legacy.yaml
similarity index 100%
rename from resources/v1.24.3/charts/cni/templates/zzy_descope_legacy.yaml
rename to resources/v1.27.2/charts/cni/templates/zzy_descope_legacy.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.27.2/charts/cni/templates/zzz_profile.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/revisiontags/templates/zzz_profile.yaml
rename to resources/v1.27.2/charts/cni/templates/zzz_profile.yaml
diff --git a/resources/v1.27.2/charts/cni/values.yaml b/resources/v1.27.2/charts/cni/values.yaml
new file mode 100644
index 000000000..d563739cf
--- /dev/null
+++ b/resources/v1.27.2/charts/cni/values.yaml
@@ -0,0 +1,178 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  hub: ""
+  tag: ""
+  variant: ""
+  image: install-cni
+  pullPolicy: ""
+
+  # Same as `global.logging.level`, but will override it if set
+  logging:
+    level: ""
+
+  # Configuration file to insert istio-cni plugin configuration
+  # by default this will be the first file found in the cni-conf-dir
+  # Example
+  # cniConfFileName: 10-calico.conflist
+
+  # CNI-and-platform specific path defaults.
+  # These may need to be set to platform-specific values, consult
+  # overrides for your platform in `manifests/helm-profiles/platform-*.yaml`
+  cniBinDir: /opt/cni/bin
+  cniConfDir: /etc/cni/net.d
+  cniConfFileName: ""
+  cniNetnsDir: "/var/run/netns"
+
+  # If Istio owned CNI config is enabled, defaults to 02-istio-cni.conflist
+  istioOwnedCNIConfigFileName: "" 
+  istioOwnedCNIConfig: false
+
+  excludeNamespaces:
+    - kube-system
+
+  # Allows user to set custom affinity for the DaemonSet
+  affinity: {}
+
+  # Custom annotations on pod level, if you need them
+  podAnnotations: {}
+
+  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
+  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
+  chained: true
+
+  # Custom configuration happens based on the CNI provider.
+  # Possible values: "default", "multus"
+  provider: "default"
+
+  # Configure ambient settings
+  ambient:
+    # If enabled, ambient redirection will be enabled
+    enabled: false
+    # If ambient is enabled, this selector will be used to identify the ambient-enabled pods
+    enablementSelectors: 
+    - podSelector:
+        matchLabels: {istio.io/dataplane-mode: ambient}
+    - podSelector:
+        matchExpressions:
+        - { key: istio.io/dataplane-mode, operator: NotIn, values: [none] }
+      namespaceSelector:
+        matchLabels: {istio.io/dataplane-mode: ambient}
+    # Set ambient config dir path: defaults to /etc/ambient-config
+    configDir: ""
+    # If enabled, and ambient is enabled, DNS redirection will be enabled
+    dnsCapture: true
+    # If enabled, and ambient is enabled, enables ipv6 support
+    ipv6: true
+    # If enabled, and ambient is enabled, the CNI agent will reconcile incompatible iptables rules and chains at startup.
+    # This will eventually be enabled by default
+    reconcileIptablesOnStartup: false
+    # If enabled, and ambient is enabled, the CNI agent will always share the network namespace of the host node it is running on
+    shareHostNetworkNamespace: false
+
+
+  repair:
+    enabled: true
+    hub: ""
+    tag: ""
+
+    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
+    # This defines the action the controller will take when a pod is detected as broken.
+
+    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
+    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
+    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
+    labelPods: false
+    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
+    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
+    deletePods: false
+    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
+    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
+    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
+    repairPods: true
+
+    initContainerName: "istio-validation"
+
+    brokenPodLabelKey: "cni.istio.io/uninitialized"
+    brokenPodLabelValue: "true"
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
+  seLinuxOptions: {}
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 100Mi
+
+  resourceQuotas:
+    enabled: false
+    pods: 5000
+
+  tolerations:
+    # Make sure istio-cni-node gets scheduled on all nodes.
+    - effect: NoSchedule
+      operator: Exists
+    # Mark the pod as a critical add-on for rescheduling.
+    - key: CriticalAddonsOnly
+      operator: Exists
+    - effect: NoExecute
+      operator: Exists
+
+  # K8s DaemonSet update strategy.
+  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  global:
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+
+    # Default tag for Istio images.
+    tag: 1.27.2
+
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # change cni scope level to control logging out of istio-cni-node DaemonSet
+    logging:
+      level: info
+
+    logAsJson: false
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Default resources allocated
+    defaultResources:
+      requests:
+        cpu: 100m
+        memory: 100Mi
+
+    # In order to use native nftable rules instead of iptable rules, set this flag to true.
+    nativeNftables: false
+
+  # A `key: value` mapping of environment variables to add to the pod
+  env: {}
diff --git a/resources/v1.27.2/charts/gateway/Chart.yaml b/resources/v1.27.2/charts/gateway/Chart.yaml
new file mode 100644
index 000000000..e485d21c6
--- /dev/null
+++ b/resources/v1.27.2/charts/gateway/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+appVersion: 1.27.2
+description: Helm chart for deploying Istio gateways
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+- gateways
+name: gateway
+sources:
+- https://github.com/istio/istio
+type: application
+version: 1.27.2
diff --git a/resources/v1.24.3/charts/gateway/README.md b/resources/v1.27.2/charts/gateway/README.md
similarity index 100%
rename from resources/v1.24.3/charts/gateway/README.md
rename to resources/v1.27.2/charts/gateway/README.md
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-ambient.yaml b/resources/v1.27.2/charts/gateway/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/gateway/files/profile-ambient.yaml
rename to resources/v1.27.2/charts/gateway/files/profile-ambient.yaml
diff --git a/resources/v1.27.2/charts/gateway/files/profile-compatibility-version-1.24.yaml b/resources/v1.27.2/charts/gateway/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..4f3dbef7e
--- /dev/null
+++ b/resources/v1.27.2/charts/gateway/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,15 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.2/charts/gateway/files/profile-compatibility-version-1.25.yaml b/resources/v1.27.2/charts/gateway/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..b2f45948c
--- /dev/null
+++ b/resources/v1.27.2/charts/gateway/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.2/charts/gateway/files/profile-compatibility-version-1.26.yaml b/resources/v1.27.2/charts/gateway/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..af1069732
--- /dev/null
+++ b/resources/v1.27.2/charts/gateway/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
\ No newline at end of file
diff --git a/resources/v1.25.4/charts/gateway/files/profile-demo.yaml b/resources/v1.27.2/charts/gateway/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.4/charts/gateway/files/profile-demo.yaml
rename to resources/v1.27.2/charts/gateway/files/profile-demo.yaml
diff --git a/resources/v1.27.2/charts/gateway/files/profile-platform-gke.yaml b/resources/v1.27.2/charts/gateway/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.27.2/charts/gateway/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.3/charts/gateway/files/profile-platform-k3d.yaml b/resources/v1.27.2/charts/gateway/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.3/charts/gateway/files/profile-platform-k3d.yaml
rename to resources/v1.27.2/charts/gateway/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.4/charts/gateway/files/profile-platform-k3s.yaml b/resources/v1.27.2/charts/gateway/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.4/charts/gateway/files/profile-platform-k3s.yaml
rename to resources/v1.27.2/charts/gateway/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.3/charts/gateway/files/profile-platform-microk8s.yaml b/resources/v1.27.2/charts/gateway/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.3/charts/gateway/files/profile-platform-microk8s.yaml
rename to resources/v1.27.2/charts/gateway/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.3/charts/gateway/files/profile-platform-minikube.yaml b/resources/v1.27.2/charts/gateway/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.3/charts/gateway/files/profile-platform-minikube.yaml
rename to resources/v1.27.2/charts/gateway/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.3/charts/gateway/files/profile-platform-openshift.yaml b/resources/v1.27.2/charts/gateway/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.3/charts/gateway/files/profile-platform-openshift.yaml
rename to resources/v1.27.2/charts/gateway/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.3/charts/gateway/files/profile-preview.yaml b/resources/v1.27.2/charts/gateway/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.3/charts/gateway/files/profile-preview.yaml
rename to resources/v1.27.2/charts/gateway/files/profile-preview.yaml
diff --git a/resources/v1.24.3/charts/gateway/files/profile-remote.yaml b/resources/v1.27.2/charts/gateway/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.3/charts/gateway/files/profile-remote.yaml
rename to resources/v1.27.2/charts/gateway/files/profile-remote.yaml
diff --git a/resources/v1.24.3/charts/gateway/files/profile-stable.yaml b/resources/v1.27.2/charts/gateway/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.3/charts/gateway/files/profile-stable.yaml
rename to resources/v1.27.2/charts/gateway/files/profile-stable.yaml
diff --git a/resources/v1.24.3/charts/gateway/templates/NOTES.txt b/resources/v1.27.2/charts/gateway/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.3/charts/gateway/templates/NOTES.txt
rename to resources/v1.27.2/charts/gateway/templates/NOTES.txt
diff --git a/resources/v1.24.3/charts/gateway/templates/_helpers.tpl b/resources/v1.27.2/charts/gateway/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.3/charts/gateway/templates/_helpers.tpl
rename to resources/v1.27.2/charts/gateway/templates/_helpers.tpl
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/templates/deployment.yaml b/resources/v1.27.2/charts/gateway/templates/deployment.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/gateway/templates/deployment.yaml
rename to resources/v1.27.2/charts/gateway/templates/deployment.yaml
diff --git a/resources/v1.24.3/charts/gateway/templates/hpa.yaml b/resources/v1.27.2/charts/gateway/templates/hpa.yaml
similarity index 100%
rename from resources/v1.24.3/charts/gateway/templates/hpa.yaml
rename to resources/v1.27.2/charts/gateway/templates/hpa.yaml
diff --git a/resources/v1.24.3/charts/gateway/templates/poddisruptionbudget.yaml b/resources/v1.27.2/charts/gateway/templates/poddisruptionbudget.yaml
similarity index 100%
rename from resources/v1.24.3/charts/gateway/templates/poddisruptionbudget.yaml
rename to resources/v1.27.2/charts/gateway/templates/poddisruptionbudget.yaml
diff --git a/resources/v1.24.3/charts/gateway/templates/role.yaml b/resources/v1.27.2/charts/gateway/templates/role.yaml
similarity index 100%
rename from resources/v1.24.3/charts/gateway/templates/role.yaml
rename to resources/v1.27.2/charts/gateway/templates/role.yaml
diff --git a/resources/v1.27.2/charts/gateway/templates/service.yaml b/resources/v1.27.2/charts/gateway/templates/service.yaml
new file mode 100644
index 000000000..3e28418f7
--- /dev/null
+++ b/resources/v1.27.2/charts/gateway/templates/service.yaml
@@ -0,0 +1,69 @@
+{{- if not (eq .Values.service.type "None") }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "gateway.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "gateway.name" . }}
+    {{- include "istio.labels" . | nindent 4}}
+    {{- include "gateway.labels" . | nindent 4 }}
+    {{- with .Values.networkGateway }}
+    topology.istio.io/network: "{{.}}"
+    {{- end }}
+  annotations:
+    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
+spec:
+{{- with .Values.service.loadBalancerIP }}
+  loadBalancerIP: "{{ . }}"
+{{- end }}
+{{- if eq .Values.service.type "LoadBalancer" }}
+  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
+  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
+  {{- end }}
+  {{- if hasKey .Values.service "loadBalancerClass" }}
+  loadBalancerClass: {{ .Values.service.loadBalancerClass }}
+  {{- end }}
+{{- end }}
+{{- if .Values.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
+{{- end }}
+{{- if .Values.service.ipFamilies }}
+  ipFamilies:
+{{- range .Values.service.ipFamilies }}
+  - {{ . }}
+{{- end }}
+{{- end }}
+{{- with .Values.service.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+{{ toYaml . | indent 4 }}
+{{- end }}
+{{- with .Values.service.externalTrafficPolicy }}
+  externalTrafficPolicy: "{{ . }}"
+{{- end }}
+  type: {{ .Values.service.type }}
+  ports:
+{{- if .Values.networkGateway }}
+  - name: status-port
+    port: 15021
+    targetPort: 15021
+  - name: tls
+    port: 15443
+    targetPort: 15443
+  - name: tls-istiod
+    port: 15012
+    targetPort: 15012
+  - name: tls-webhook
+    port: 15017
+    targetPort: 15017
+{{- else }}
+{{ .Values.service.ports | toYaml | indent 4 }}
+{{- end }}
+{{- if .Values.service.externalIPs }}
+  externalIPs: {{- range .Values.service.externalIPs }}
+    - {{.}}
+  {{- end }}
+{{- end }}
+  selector:
+    {{- include "gateway.selectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/resources/v1.24.3/charts/gateway/templates/serviceaccount.yaml b/resources/v1.27.2/charts/gateway/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.3/charts/gateway/templates/serviceaccount.yaml
rename to resources/v1.27.2/charts/gateway/templates/serviceaccount.yaml
diff --git a/resources/v1.27.2/charts/gateway/templates/zzz_profile.yaml b/resources/v1.27.2/charts/gateway/templates/zzz_profile.yaml
new file mode 100644
index 000000000..606c55669
--- /dev/null
+++ b/resources/v1.27.2/charts/gateway/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if true }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.27.2/charts/gateway/values.schema.json b/resources/v1.27.2/charts/gateway/values.schema.json
new file mode 100644
index 000000000..bcbb30ccc
--- /dev/null
+++ b/resources/v1.27.2/charts/gateway/values.schema.json
@@ -0,0 +1,353 @@
+{
+  "$schema": "http://json-schema.org/schema#",
+  "$defs": {
+    "values": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "_internal_defaults_do_not_set": {
+          "type": "object"
+        },
+        "global": {
+          "type": "object"
+        },
+        "affinity": {
+          "type": "object"
+        },
+        "securityContext": {
+          "type": [
+            "object",
+            "null"
+          ]
+        },
+        "containerSecurityContext": {
+          "type": [
+            "object",
+            "null"
+          ]
+        },
+        "kind": {
+          "type": "string",
+          "enum": [
+            "Deployment",
+            "DaemonSet"
+          ]
+        },
+        "annotations": {
+          "additionalProperties": {
+            "type": [
+              "string",
+              "integer"
+            ]
+          },
+          "type": "object"
+        },
+        "autoscaling": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            },
+            "maxReplicas": {
+              "type": "integer"
+            },
+            "minReplicas": {
+              "type": "integer"
+            },
+            "targetCPUUtilizationPercentage": {
+              "type": "integer"
+            }
+          }
+        },
+        "env": {
+          "type": "object"
+        },
+        "envVarFrom": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": { "type": "string" },
+              "valueFrom": { "type": "object" }
+            }
+          }
+        },
+        "strategy": {
+          "type": "object"
+        },
+        "minReadySeconds": {
+          "type": [ "null", "integer" ]
+        },
+        "readinessProbe": {
+          "type": [ "null", "object" ]
+        },
+        "labels": {
+          "type": "object"
+        },
+        "name": {
+          "type": "string"
+        },
+        "nodeSelector": {
+          "type": "object"
+        },
+        "podAnnotations": {
+          "type": "object",
+          "properties": {
+            "inject.istio.io/templates": {
+              "type": "string"
+            },
+            "prometheus.io/path": {
+              "type": "string"
+            },
+            "prometheus.io/port": {
+              "type": "string"
+            },
+            "prometheus.io/scrape": {
+              "type": "string"
+            }
+          }
+        },
+        "replicaCount": {
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "resources": {
+          "type": "object",
+          "properties": {
+            "limits": {
+              "type": "object",
+              "properties": {
+                "cpu": {
+                  "type": ["string", "null"]
+                },
+                "memory": {
+                  "type": ["string", "null"]
+                }
+              }
+            },
+            "requests": {
+              "type": "object",
+              "properties": {
+                "cpu": {
+                  "type": ["string", "null"]
+                },
+                "memory": {
+                  "type": ["string", "null"]
+                }
+              }
+            }
+          }
+        },
+        "revision": {
+          "type": "string"
+        },
+        "defaultRevision": {
+          "type": "string"
+        },
+        "compatibilityVersion": {
+          "type": "string"
+        },
+        "profile": {
+          "type": "string"
+        },
+        "platform": {
+          "type": "string"
+        },
+        "pilot": {
+          "type": "object"
+        },
+        "runAsRoot": {
+          "type": "boolean"
+        },
+        "unprivilegedPort": {
+          "type": [
+            "string",
+            "boolean"
+          ],
+          "enum": [
+            true,
+            false,
+            "auto"
+          ]
+        },
+        "service": {
+          "type": "object",
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "externalTrafficPolicy": {
+              "type": "string"
+            },
+            "loadBalancerIP": {
+              "type": "string"
+            },
+            "loadBalancerSourceRanges": {
+              "type": "array"
+            },
+            "ipFamilies": {
+              "items": {
+                "type": "string",
+                "enum": [
+                  "IPv4",
+                  "IPv6"
+                ]
+              }
+            },
+            "ipFamilyPolicy": {
+              "type": "string",
+              "enum": [
+                "",
+                "SingleStack",
+                "PreferDualStack",
+                "RequireDualStack"
+              ]
+            },
+            "ports": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string"
+                  },
+                  "port": {
+                    "type": "integer"
+                  },
+                  "protocol": {
+                    "type": "string"
+                  },
+                  "targetPort": {
+                    "type": "integer"
+                  }
+                }
+              }
+            },
+            "type": {
+              "type": "string"
+            }
+          }
+        },
+        "serviceAccount": {
+          "type": "object",
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "name": {
+              "type": "string"
+            },
+            "create": {
+              "type": "boolean"
+            }
+          }
+        },
+        "rbac": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            }
+          }
+        },
+        "tolerations": {
+          "type": "array"
+        },
+        "topologySpreadConstraints": {
+          "type": "array"
+        },
+        "networkGateway": {
+          "type": "string"
+        },
+        "imagePullPolicy": {
+          "type": "string",
+          "enum": [
+            "",
+            "Always",
+            "IfNotPresent",
+            "Never"
+          ]
+        },
+        "imagePullSecrets": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "podDisruptionBudget": {
+          "type": "object",
+          "properties": {
+            "minAvailable": {
+              "type": [
+                "integer",
+                "string"
+              ]
+            },
+            "maxUnavailable": {
+              "type": [
+                "integer",
+                "string"
+              ]
+            },
+            "unhealthyPodEvictionPolicy": {
+              "type": "string",
+              "enum": [
+                "",
+                "IfHealthyBudget",
+                "AlwaysAllow"
+              ]
+            }
+          }
+        },
+        "terminationGracePeriodSeconds": {
+          "type": "number"
+        },
+        "volumes": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "volumeMounts": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "initContainers": {
+          "type": "array",
+          "items": { "type": "object" }
+        },
+        "additionalContainers": {
+          "type": "array",
+          "items": { "type": "object" }
+        },
+        "priorityClassName": {
+          "type": "string"
+        },
+        "lifecycle": {
+          "type": "object",
+          "properties": {
+            "postStart": {
+              "type": "object"
+            },
+            "preStop": {
+              "type": "object"
+            }
+          }
+        }
+      }
+    }
+  },
+  "defaults": {
+    "$ref": "#/$defs/values"
+  },
+  "$ref": "#/$defs/values"
+}
diff --git a/resources/v1.27.2/charts/gateway/values.yaml b/resources/v1.27.2/charts/gateway/values.yaml
new file mode 100644
index 000000000..c0147ce21
--- /dev/null
+++ b/resources/v1.27.2/charts/gateway/values.yaml
@@ -0,0 +1,192 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  # Name allows overriding the release name. Generally this should not be set
+  name: ""
+  # revision declares which revision this gateway is a part of
+  revision: ""
+
+  # Controls the spec.replicas setting for the Gateway deployment if set.
+  # Otherwise defaults to Kubernetes Deployment default (1).
+  replicaCount:
+
+  kind: Deployment
+
+  rbac:
+    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
+    # when using http://gateway-api.org/.
+    enabled: true
+
+  serviceAccount:
+    # If set, a service account will be created. Otherwise, the default is used
+    create: true
+    # Annotations to add to the service account
+    annotations: {}
+    # The name of the service account to use.
+    # If not set, the release name is used
+    name: ""
+
+  podAnnotations:
+    prometheus.io/port: "15020"
+    prometheus.io/scrape: "true"
+    prometheus.io/path: "/stats/prometheus"
+    inject.istio.io/templates: "gateway"
+    sidecar.istio.io/inject: "true"
+
+  # Define the security context for the pod.
+  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+  securityContext: {}
+  containerSecurityContext: {}
+
+  service:
+    # Type of service. Set to "None" to disable the service entirely
+    type: LoadBalancer
+    ports:
+    - name: status-port
+      port: 15021
+      protocol: TCP
+      targetPort: 15021
+    - name: http2
+      port: 80
+      protocol: TCP
+      targetPort: 80
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 443
+    annotations: {}
+    loadBalancerIP: ""
+    loadBalancerSourceRanges: []
+    externalTrafficPolicy: ""
+    externalIPs: []
+    ipFamilyPolicy: ""
+    ipFamilies: []
+    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
+    # allocateLoadBalancerNodePorts: false
+    ## Set LoadBalancer class (only for LoadBalancers).
+    # loadBalancerClass: ""
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 2000m
+      memory: 1024Mi
+
+  autoscaling:
+    enabled: true
+    minReplicas: 1
+    maxReplicas: 5
+    targetCPUUtilizationPercentage: 80
+    targetMemoryUtilizationPercentage: {}
+    autoscaleBehavior: {}
+
+  # Pod environment variables
+  env: {}
+
+  # Use envVarFrom to define full environment variable entries with complex sources,
+  # such as valueFrom.secretKeyRef, valueFrom.configMapKeyRef. Each item must include a `name` and `valueFrom`.
+  #
+  # Example:
+  # envVarFrom:
+  #   - name: EXAMPLE_SECRET
+  #     valueFrom:
+  #       secretKeyRef:
+  #         name: example-name
+  #         key: example-key
+  envVarFrom: []
+
+  # Deployment Update strategy
+  strategy: {}
+  
+  # Sets the Deployment minReadySeconds value
+  minReadySeconds:
+  
+  # Optionally configure a custom readinessProbe. By default the control plane
+  # automatically injects the readinessProbe. If you wish to override that
+  # behavior, you may define your own readinessProbe here.
+  readinessProbe: {}
+
+  # Labels to apply to all resources
+  labels:
+    # By default, don't enroll gateways into the ambient dataplane
+    "istio.io/dataplane-mode": none
+
+  # Annotations to apply to all resources
+  annotations: {}
+
+  nodeSelector: {}
+
+  tolerations: []
+
+  topologySpreadConstraints: []
+
+  affinity: {}
+
+  # If specified, the gateway will act as a network gateway for the given network.
+  networkGateway: ""
+
+  # Specify image pull policy if default behavior isn't desired.
+  # Default behavior: latest images will be Always else IfNotPresent
+  imagePullPolicy: ""
+
+  imagePullSecrets: []
+
+  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
+  #
+  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
+  # which means that no PodDisruptionBudget resource will be created.
+  #
+  # To enable the PodDisruptionBudget, configure it by specifying the
+  # `minAvailable` or `maxUnavailable`. For example, to set the
+  # minimum number of available replicas to 1, you can update this value as follows:
+  #
+  # podDisruptionBudget:
+  #   minAvailable: 1
+  #
+  # Or, to allow a maximum of 1 unavailable replica, you can set:
+  #
+  # podDisruptionBudget:
+  #   maxUnavailable: 1
+  #
+  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
+  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
+  #
+  # podDisruptionBudget:
+  #   minAvailable: 1
+  #   unhealthyPodEvictionPolicy: AlwaysAllow
+  #
+  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
+  #
+  # podDisruptionBudget: {}
+  #
+  podDisruptionBudget: {}
+
+  # Sets the per-pod terminationGracePeriodSeconds setting.
+  terminationGracePeriodSeconds: 30
+
+  # A list of `Volumes` added into the Gateway Pods. See
+  # https://kubernetes.io/docs/concepts/storage/volumes/.
+  volumes: []
+
+  # A list of `VolumeMounts` added into the Gateway Pods. See
+  # https://kubernetes.io/docs/concepts/storage/volumes/.
+  volumeMounts: []
+
+  # Inject initContainers into the Gateway Pods.
+  initContainers: []
+
+  # Inject additional containers into the Gateway Pods.
+  additionalContainers: []
+
+  # Configure this to a higher priority class in order to make sure your Istio gateway pods
+  # will not be killed because of low priority class.
+  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+  # for more detail.
+  priorityClassName: ""
+
+  # Configure the lifecycle hooks for the gateway. See
+  # https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/.
+  lifecycle: {}
diff --git a/resources/v1.27.2/charts/istiod/Chart.yaml b/resources/v1.27.2/charts/istiod/Chart.yaml
new file mode 100644
index 000000000..af93a3536
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+appVersion: 1.27.2
+description: Helm chart for istio control plane
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+- istiod
+- istio-discovery
+name: istiod
+sources:
+- https://github.com/istio/istio
+version: 1.27.2
diff --git a/resources/v1.24.3/charts/istiod/README.md b/resources/v1.27.2/charts/istiod/README.md
similarity index 100%
rename from resources/v1.24.3/charts/istiod/README.md
rename to resources/v1.27.2/charts/istiod/README.md
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.27.2/charts/istiod/files/gateway-injection-template.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/files/gateway-injection-template.yaml
rename to resources/v1.27.2/charts/istiod/files/gateway-injection-template.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/grpc-agent.yaml b/resources/v1.27.2/charts/istiod/files/grpc-agent.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/files/grpc-agent.yaml
rename to resources/v1.27.2/charts/istiod/files/grpc-agent.yaml
diff --git a/resources/v1.24.3/charts/istiod/files/grpc-simple.yaml b/resources/v1.27.2/charts/istiod/files/grpc-simple.yaml
similarity index 100%
rename from resources/v1.24.3/charts/istiod/files/grpc-simple.yaml
rename to resources/v1.27.2/charts/istiod/files/grpc-simple.yaml
diff --git a/resources/v1.27.2/charts/istiod/files/injection-template.yaml b/resources/v1.27.2/charts/istiod/files/injection-template.yaml
new file mode 100644
index 000000000..df04baf84
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/files/injection-template.yaml
@@ -0,0 +1,541 @@
+{{- define "resources"  }}
+  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
+      requests:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
+        {{ end }}
+    {{- end }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+      limits:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
+        {{ end }}
+    {{- end }}
+  {{- else }}
+    {{- if .Values.global.proxy.resources }}
+      {{ toYaml .Values.global.proxy.resources | indent 6 }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{ $tproxy := (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) }}
+{{ $capNetBindService := (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) }}
+{{ $nativeSidecar := ne (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar` | default (printf "%t" .NativeSidecars)) "false" }}
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
+    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
+    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
+    {{- end }}
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations: {
+    istio.io/rev: {{ .Revision | default "default" | quote }},
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- end }}
+{{- if .Values.pilot.cni.enabled }}
+    {{- if eq .Values.pilot.cni.provider "multus" }}
+    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
+    {{- end }}
+    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
+    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
+    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
+    traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}",
+    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
+    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
+    {{- end }}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
+    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
+    {{- end }}
+    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
+    {{ with index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}istio.io/reroute-virtual-interfaces: "{{.}}",{{ end }}
+    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
+{{- end }}
+  }
+spec:
+  {{- $holdProxy := and
+      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
+      (not $nativeSidecar) }}
+  {{- $noInitContainer := and
+      (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE`)
+      (not $nativeSidecar) }}
+  {{ if $noInitContainer }}
+  initContainers: []
+  {{ else -}}
+  initContainers:
+  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
+  {{ if .Values.pilot.cni.enabled -}}
+  - name: istio-validation
+  {{ else -}}
+  - name: istio-init
+  {{ end -}}
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    args:
+    - istio-iptables
+    - "-p"
+    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
+    - "-z"
+    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
+    - "-u"
+    - {{ if $tproxy }} "1337" {{ else }} {{ .ProxyUID | default "1337" | quote }} {{ end }}
+    - "-m"
+    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
+    - "-i"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
+    - "-x"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
+    - "-b"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
+    - "-d"
+  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
+    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
+  {{- else }}
+    - "15090,15021"
+  {{- end }}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
+    - "-q"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
+    {{ end -}}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
+    - "-o"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
+    {{ end -}}
+    {{ if (isset .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces`) -}}
+    - "-k"
+    - "{{ index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}"
+    {{ else if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
+    - "-k"
+    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
+    {{ end -}}
+     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
+    - "-c"
+    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
+    {{ end -}}
+    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
+    {{ if .Values.global.logAsJson -}}
+    - "--log_as_json"
+    {{ end -}}
+    {{ if .Values.pilot.cni.enabled -}}
+    - "--run-validation"
+    - "--skip-rule-apply"
+    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
+    - "--force-apply"
+    {{ end -}}
+    {{ if .Values.global.nativeNftables -}}
+    - "--native-nftables"
+    {{ end -}}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+  {{- if .ProxyConfig.ProxyMetadata }}
+    env:
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+  {{- end }}
+    resources:
+  {{ template "resources" . }}
+    securityContext:
+      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
+      privileged: {{ .Values.global.proxy.privileged }}
+      capabilities:
+    {{- if not .Values.pilot.cni.enabled }}
+        add:
+        - NET_ADMIN
+        - NET_RAW
+    {{- end }}
+        drop:
+        - ALL
+    {{- if not .Values.pilot.cni.enabled }}
+      readOnlyRootFilesystem: false
+      runAsGroup: 0
+      runAsNonRoot: false
+      runAsUser: 0
+    {{- else }}
+      readOnlyRootFilesystem: true
+      runAsGroup: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyGID | default "1337" }} {{ end }}
+      runAsUser: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyUID | default "1337" }} {{ end }}
+      runAsNonRoot: true
+    {{- end }}
+  {{ end -}}
+  {{ end -}}
+  {{ if not $nativeSidecar }}
+  containers:
+  {{ end }}
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
+    ports:
+    - containerPort: 15090
+      protocol: TCP
+      name: http-envoy-prom
+    args:
+    - proxy
+    - sidecar
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+  {{- if .Values.global.proxy.outlierLogPath }}
+    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
+  {{- end}}
+  {{- if .Values.global.proxy.lifecycle }}
+    lifecycle:
+      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
+  {{- else if $holdProxy }}
+    lifecycle:
+      postStart:
+        exec:
+          command:
+          - pilot-agent
+          - wait
+  {{- else if $nativeSidecar }}
+    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
+    lifecycle:
+      preStop:
+        exec:
+          command:
+          - pilot-agent
+          - request
+          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
+          - POST
+          - drain
+  {{- end }}
+    env:
+    {{- if eq .InboundTrafficPolicyMode "localhost" }}
+    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
+      value: "true"
+    {{- end }}
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: ISTIO_CPU_LIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: GOMEMLIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.memory
+    - name: GOMAXPROCS
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    {{- if .CompliancePolicy }}
+    - name: COMPLIANCE_POLICY
+      value: "{{ .CompliancePolicy }}"
+    {{- end }}
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    - name: ISTIO_META_INTERCEPTION_MODE
+      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- with (index .ObjectMeta.Labels `service.istio.io/workload-name` | default .DeploymentMeta.Name) }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ . }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - name: ISTIO_BOOTSTRAP_OVERRIDE
+      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
+    {{- end }}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
+    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
+  {{ if .Values.global.proxy.startupProbe.enabled }}
+    startupProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: 0
+      periodSeconds: 1
+      timeoutSeconds: 3
+      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
+  {{ end }}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
+    {{ end -}}
+    securityContext:
+      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
+      allowPrivilegeEscalation: true
+      capabilities:
+        add:
+        - NET_ADMIN
+        drop:
+        - ALL
+      privileged: true
+      readOnlyRootFilesystem: true
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+      runAsNonRoot: false
+      runAsUser: 0
+      {{- else }}
+      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
+      capabilities:
+        {{ if or $tproxy $capNetBindService -}}
+        add:
+        {{ if $tproxy -}}
+        - NET_ADMIN
+        {{- end }}
+        {{ if $capNetBindService -}}
+        - NET_BIND_SERVICE
+        {{- end }}
+        {{- end }}
+        drop:
+        - ALL
+      privileged: {{ .Values.global.proxy.privileged }}
+      readOnlyRootFilesystem: true
+      {{ if or $tproxy $capNetBindService -}}
+      runAsNonRoot: false
+      runAsUser: 0
+      runAsGroup: 1337
+      {{- else -}}
+      runAsNonRoot: true
+      runAsUser: {{ .ProxyUID | default "1337" }}
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+      {{- end }}
+      {{- end }}
+    resources:
+  {{ template "resources" . }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    - name: credential-socket
+      mountPath: /var/run/secrets/credential-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    - mountPath: /var/run/secrets/istio/crl
+      name: istio-ca-crl
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - mountPath: /etc/istio/custom-bootstrap
+      name: custom-bootstrap-volume
+    {{- end }}
+    # SDS channel between istioagent and Envoy
+    - mountPath: /etc/istio/proxy
+      name: istio-envoy
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
+    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
+      name: lightstep-certs
+      readOnly: true
+    {{- end }}
+      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
+      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
+    - name: "{{  $index }}"
+      {{ toYaml $value | indent 6 }}
+      {{ end }}
+      {{- end }}
+  volumes:
+  - emptyDir:
+    name: workload-socket
+  - emptyDir:
+    name: credential-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else }}
+  - emptyDir:
+    name: workload-certs
+  {{- end }}
+  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+  - name: custom-bootstrap-volume
+    configMap:
+      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-envoy
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+          name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+          path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+  {{- end }}
+  {{- end }}
+  - name: istio-ca-crl
+    configMap:
+      name: istio-ca-crl
+      optional: true
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
+    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
+  - name: "{{ $index }}"
+    {{ toYaml $value | indent 4 }}
+    {{ end }}
+    {{ end }}
+  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
+  - name: lightstep-certs
+    secret:
+      optional: true
+      secretName: lightstep.cacert
+  {{- end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.27.2/charts/istiod/files/kube-gateway.yaml b/resources/v1.27.2/charts/istiod/files/kube-gateway.yaml
new file mode 100644
index 000000000..616fb42c7
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/files/kube-gateway.yaml
@@ -0,0 +1,401 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{.ServiceAccount | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  {{- if ge .KubeVersion 128 }}
+  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+  {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.istio.io/managed" "istio.io-gateway-controller"
+      ) | nindent 4 }}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: {{.Name}}
+    uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      "{{.GatewayNameLabel}}": {{.Name}}
+  template:
+    metadata:
+      annotations:
+        {{- toJsonMap
+          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
+          (strdict "istio.io/rev" (.Revision | default "default"))
+          (strdict
+            "prometheus.io/path" "/stats/prometheus"
+            "prometheus.io/port" "15020"
+            "prometheus.io/scrape" "true"
+          ) | nindent 8 }}
+      labels:
+        {{- toJsonMap
+          (strdict
+            "sidecar.istio.io/inject" "false"
+            "service.istio.io/canonical-name" .DeploymentName
+            "service.istio.io/canonical-revision" "latest"
+           )
+          .InfrastructureLabels
+          (strdict
+            "gateway.networking.k8s.io/gateway-name" .Name
+            "gateway.istio.io/managed" "istio.io-gateway-controller"
+          ) | nindent 8 }}
+    spec:
+      securityContext:
+      {{- if .Values.gateways.securityContext }}
+        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
+      {{- else }}
+        sysctls:
+        - name: net.ipv4.ip_unprivileged_port_start
+          value: "0"
+      {{- if .Values.gateways.seccompProfile }}
+        seccompProfile:
+      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
+      {{- end }}
+      {{- end }}
+      serviceAccountName: {{.ServiceAccount | quote}}
+      containers:
+      - name: istio-proxy
+      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+      {{- else }}
+        image: "{{ .ProxyImage }}"
+      {{- end }}
+        {{- if .Values.global.proxy.resources }}
+        resources:
+          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
+        {{- end }}
+        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
+          allowPrivilegeEscalation: false
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsUser: {{ .ProxyUID | default "1337" }}
+          runAsGroup: {{ .ProxyGID | default "1337" }}
+          runAsNonRoot: true
+        ports:
+        - containerPort: 15020
+          name: metrics
+          protocol: TCP
+        - containerPort: 15021
+          name: status-port
+          protocol: TCP
+        - containerPort: 15090
+          protocol: TCP
+          name: http-envoy-prom
+        args:
+        - proxy
+        - router
+        - --domain
+        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+        - --proxyLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
+        - --proxyComponentLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
+        - --log_output_level
+        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
+      {{- if .Values.global.sts.servicePort }}
+        - --stsPort={{ .Values.global.sts.servicePort }}
+      {{- end }}
+      {{- if .Values.global.logAsJson }}
+        - --log_as_json
+      {{- end }}
+      {{- if .Values.global.proxy.lifecycle }}
+        lifecycle:
+          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
+      {{- end }}
+        env:
+        - name: PILOT_CERT_PROVIDER
+          value: {{ .Values.global.pilotCertProvider }}
+        - name: CA_ADDR
+        {{- if .Values.global.caAddress }}
+          value: {{ .Values.global.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        - name: ISTIO_CPU_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: PROXY_CONFIG
+          value: |
+                 {{ protoToJSON .ProxyConfig }}
+        - name: ISTIO_META_POD_PORTS
+          value: "[]"
+        - name: ISTIO_META_APP_CONTAINERS
+          value: ""
+        - name: GOMEMLIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.memory
+        - name: GOMAXPROCS
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: ISTIO_META_CLUSTER_ID
+          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
+        - name: ISTIO_META_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: ISTIO_META_INTERCEPTION_MODE
+          value: "{{ .ProxyConfig.InterceptionMode.String }}"
+        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
+        - name: ISTIO_META_NETWORK
+          value: {{.|quote}}
+        {{- end }}
+        - name: ISTIO_META_WORKLOAD_NAME
+          value: {{.DeploymentName|quote}}
+        - name: ISTIO_META_OWNER
+          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
+        {{- if .Values.global.meshID }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ .Values.global.meshID }}"
+        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+        {{- end }}
+        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+        - name: TRUST_DOMAIN
+          value: "{{ . }}"
+        {{- end }}
+        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
+        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
+          value: {{.|quote}}
+        {{- end }}
+        startupProbe:
+          failureThreshold: 30
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 1
+          periodSeconds: 1
+          successThreshold: 1
+          timeoutSeconds: 1
+        readinessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 0
+          periodSeconds: 15
+          successThreshold: 1
+          timeoutSeconds: 1
+        volumeMounts:
+        - name: workload-socket
+          mountPath: /var/run/secrets/workload-spiffe-uds
+        - name: credential-socket
+          mountPath: /var/run/secrets/credential-uds
+        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+        - name: gke-workload-certificate
+          mountPath: /var/run/secrets/workload-spiffe-credentials
+          readOnly: true
+        {{- else }}
+        - name: workload-certs
+          mountPath: /var/run/secrets/workload-spiffe-credentials
+        {{- end }}
+        {{- if eq .Values.global.pilotCertProvider "istiod" }}
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        {{- end }}
+        - mountPath: /var/lib/istio/data
+          name: istio-data
+        # SDS channel between istioagent and Envoy
+        - mountPath: /etc/istio/proxy
+          name: istio-envoy
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - name: istio-podinfo
+          mountPath: /etc/istio/pod
+      volumes:
+      - emptyDir: {}
+        name: workload-socket
+      - emptyDir: {}
+        name: credential-socket
+      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+      - name: gke-workload-certificate
+        csi:
+          driver: workloadcertificates.security.cloud.google.com
+      {{- else}}
+      - emptyDir: {}
+        name: workload-certs
+      {{- end }}
+      # SDS channel between istioagent and Envoy
+      - emptyDir:
+          medium: Memory
+        name: istio-envoy
+      - name: istio-data
+        emptyDir: {}
+      - name: istio-podinfo
+        downwardAPI:
+          items:
+            - path: "labels"
+              fieldRef:
+                fieldPath: metadata.labels
+            - path: "annotations"
+              fieldRef:
+                fieldPath: metadata.annotations
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: istio-token
+              expirationSeconds: 43200
+              audience: {{ .Values.global.sds.token.aud }}
+      {{- if eq .Values.global.pilotCertProvider "istiod" }}
+      - name: istiod-ca-cert
+      {{- if eq ((.Values.pilot).env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+              path: root-cert.pem
+      {{- else }}
+        configMap:
+          name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+      {{- end }}
+      {{- end }}
+      {{- if .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: {{.Name}}
+    uid: {{.UID}}
+spec:
+  ipFamilyPolicy: PreferDualStack
+  ports:
+  {{- range $key, $val := .Ports }}
+  - name: {{ $val.Name | quote }}
+    port: {{ $val.Port }}
+    protocol: TCP
+    appProtocol: {{ $val.AppProtocol }}
+  {{- end }}
+  selector:
+    "{{.GatewayNameLabel}}": {{.Name}}
+  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
+  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
+  {{- end }}
+  type: {{ .ServiceType | quote }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name:  {{.DeploymentName | quote}}
+  maxReplicas: 1
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
+
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-ambient.yaml b/resources/v1.27.2/charts/istiod/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/files/profile-ambient.yaml
rename to resources/v1.27.2/charts/istiod/files/profile-ambient.yaml
diff --git a/resources/v1.27.2/charts/istiod/files/profile-compatibility-version-1.24.yaml b/resources/v1.27.2/charts/istiod/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..4f3dbef7e
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,15 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.2/charts/istiod/files/profile-compatibility-version-1.25.yaml b/resources/v1.27.2/charts/istiod/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..b2f45948c
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.2/charts/istiod/files/profile-compatibility-version-1.26.yaml b/resources/v1.27.2/charts/istiod/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..af1069732
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
\ No newline at end of file
diff --git a/resources/v1.25.4/charts/istiod/files/profile-demo.yaml b/resources/v1.27.2/charts/istiod/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.4/charts/istiod/files/profile-demo.yaml
rename to resources/v1.27.2/charts/istiod/files/profile-demo.yaml
diff --git a/resources/v1.27.2/charts/istiod/files/profile-platform-gke.yaml b/resources/v1.27.2/charts/istiod/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.3/charts/istiod/files/profile-platform-k3d.yaml b/resources/v1.27.2/charts/istiod/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.3/charts/istiod/files/profile-platform-k3d.yaml
rename to resources/v1.27.2/charts/istiod/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.4/charts/istiod/files/profile-platform-k3s.yaml b/resources/v1.27.2/charts/istiod/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.4/charts/istiod/files/profile-platform-k3s.yaml
rename to resources/v1.27.2/charts/istiod/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.3/charts/istiod/files/profile-platform-microk8s.yaml b/resources/v1.27.2/charts/istiod/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.3/charts/istiod/files/profile-platform-microk8s.yaml
rename to resources/v1.27.2/charts/istiod/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.3/charts/istiod/files/profile-platform-minikube.yaml b/resources/v1.27.2/charts/istiod/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.3/charts/istiod/files/profile-platform-minikube.yaml
rename to resources/v1.27.2/charts/istiod/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.3/charts/istiod/files/profile-platform-openshift.yaml b/resources/v1.27.2/charts/istiod/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.3/charts/istiod/files/profile-platform-openshift.yaml
rename to resources/v1.27.2/charts/istiod/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.3/charts/istiod/files/profile-preview.yaml b/resources/v1.27.2/charts/istiod/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.3/charts/istiod/files/profile-preview.yaml
rename to resources/v1.27.2/charts/istiod/files/profile-preview.yaml
diff --git a/resources/v1.24.3/charts/istiod/files/profile-remote.yaml b/resources/v1.27.2/charts/istiod/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.3/charts/istiod/files/profile-remote.yaml
rename to resources/v1.27.2/charts/istiod/files/profile-remote.yaml
diff --git a/resources/v1.24.3/charts/istiod/files/profile-stable.yaml b/resources/v1.27.2/charts/istiod/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.3/charts/istiod/files/profile-stable.yaml
rename to resources/v1.27.2/charts/istiod/files/profile-stable.yaml
diff --git a/resources/v1.27.2/charts/istiod/files/waypoint.yaml b/resources/v1.27.2/charts/istiod/files/waypoint.yaml
new file mode 100644
index 000000000..3e6a2f5dc
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/files/waypoint.yaml
@@ -0,0 +1,396 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{.ServiceAccount | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  {{- if ge .KubeVersion 128 }}
+  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+  {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.istio.io/managed" .ControllerLabel
+      ) | nindent 4 }}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      "{{.GatewayNameLabel}}": "{{.Name}}"
+  template:
+    metadata:
+      annotations:
+        {{- toJsonMap
+          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
+          (strdict "istio.io/rev" (.Revision | default "default"))
+          (strdict
+            "prometheus.io/path" "/stats/prometheus"
+            "prometheus.io/port" "15020"
+            "prometheus.io/scrape" "true"
+          ) | nindent 8 }}
+      labels:
+        {{- toJsonMap
+          (strdict
+            "sidecar.istio.io/inject" "false"
+            "istio.io/dataplane-mode" "none"
+            "service.istio.io/canonical-name" .DeploymentName
+            "service.istio.io/canonical-revision" "latest"
+           )
+          .InfrastructureLabels
+          (strdict
+            "gateway.networking.k8s.io/gateway-name" .Name
+            "gateway.istio.io/managed" .ControllerLabel
+          ) | nindent 8}}
+    spec:
+      {{- if .Values.global.waypoint.affinity }}
+      affinity:
+      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.topologySpreadConstraints }}
+      topologySpreadConstraints:
+      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.nodeSelector }}
+      nodeSelector:
+      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.tolerations }}
+      tolerations:
+      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: 2
+      serviceAccountName: {{.ServiceAccount | quote}}
+      containers:
+      - name: istio-proxy
+        ports:
+        - containerPort: 15020
+          name: metrics
+          protocol: TCP
+        - containerPort: 15021
+          name: status-port
+          protocol: TCP
+        - containerPort: 15090
+          protocol: TCP
+          name: http-envoy-prom
+        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+        {{- else }}
+        image: "{{ .ProxyImage }}"
+        {{- end }}
+        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+        args:
+        - proxy
+        - waypoint
+        - --domain
+        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+        - --serviceCluster
+        - {{.ServiceAccount}}.$(POD_NAMESPACE)
+        - --proxyLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
+        - --proxyComponentLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
+        - --log_output_level
+        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
+        {{- if .Values.global.logAsJson }}
+        - --log_as_json
+        {{- end }}
+        {{- if .Values.global.proxy.outlierLogPath }}
+        - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
+        {{- end}}
+        env:
+        - name: ISTIO_META_SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: ISTIO_META_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: PILOT_CERT_PROVIDER
+          value: {{ .Values.global.pilotCertProvider }}
+        - name: CA_ADDR
+        {{- if .Values.global.caAddress }}
+          value: {{ .Values.global.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        - name: ISTIO_CPU_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: PROXY_CONFIG
+          value: |
+                 {{ protoToJSON .ProxyConfig }}
+        {{- if .ProxyConfig.ProxyMetadata }}
+        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- end }}
+        - name: GOMEMLIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.memory
+        - name: GOMAXPROCS
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: ISTIO_META_CLUSTER_ID
+          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
+        {{- if $network }}
+        - name: ISTIO_META_NETWORK
+          value: "{{ $network }}"
+        {{- end }}
+        - name: ISTIO_META_INTERCEPTION_MODE
+          value: REDIRECT
+        - name: ISTIO_META_WORKLOAD_NAME
+          value: {{.DeploymentName}}
+        - name: ISTIO_META_OWNER
+          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
+        {{- if .Values.global.meshID }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ .Values.global.meshID }}"
+        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+        {{- end }}
+        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: TRUST_DOMAIN
+          value: "{{ . }}"
+        {{- end }}
+        {{- if .Values.global.waypoint.resources }}
+        resources:
+        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
+        {{- end }}
+        startupProbe:
+          failureThreshold: 30
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 1
+          periodSeconds: 1
+          successThreshold: 1
+          timeoutSeconds: 1
+        readinessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 0
+          periodSeconds: 15
+          successThreshold: 1
+          timeoutSeconds: 1
+        securityContext:
+          privileged: false
+        {{- if not (eq .Values.global.platform "openshift") }}
+          runAsGroup: 1337
+          runAsUser: 1337
+        {{- end }}
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          capabilities:
+            drop:
+            - ALL
+{{- if .Values.gateways.seccompProfile }}
+          seccompProfile:
+{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
+{{- end }}
+        volumeMounts:
+        - mountPath: /var/run/secrets/workload-spiffe-uds
+          name: workload-socket
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        - mountPath: /var/lib/istio/data
+          name: istio-data
+        - mountPath: /etc/istio/proxy
+          name: istio-envoy
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - mountPath: /etc/istio/pod
+          name: istio-podinfo
+      volumes:
+      - emptyDir: {}
+        name: workload-socket
+      - emptyDir:
+          medium: Memory
+        name: istio-envoy
+      - emptyDir:
+          medium: Memory
+        name: go-proxy-envoy
+      - emptyDir: {}
+        name: istio-data
+      - emptyDir: {}
+        name: go-proxy-data
+      - downwardAPI:
+          items:
+          - fieldRef:
+              fieldPath: metadata.labels
+            path: labels
+          - fieldRef:
+              fieldPath: metadata.annotations
+            path: annotations
+        name: istio-podinfo
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              audience: istio-ca
+              expirationSeconds: 43200
+              path: istio-token
+      - name: istiod-ca-cert
+      {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+              path: root-cert.pem
+      {{- else }}
+        configMap:
+          name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+      {{- end }}
+      {{- if .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    {{ toJsonMap
+      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
+      (omit .InfrastructureAnnotations
+        "kubectl.kubernetes.io/last-applied-configuration"
+        "gateway.istio.io/name-override"
+        "gateway.istio.io/service-account"
+        "gateway.istio.io/controller-version"
+      ) | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+spec:
+  ipFamilyPolicy: PreferDualStack
+  ports:
+  {{- range $key, $val := .Ports }}
+  - name: {{ $val.Name | quote }}
+    port: {{ $val.Port }}
+    protocol: TCP
+    appProtocol: {{ $val.AppProtocol }}
+  {{- end }}
+  selector:
+    "{{.GatewayNameLabel}}": "{{.Name}}"
+  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
+  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
+  {{- end }}
+  type: {{ .ServiceType | quote }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name:  {{.DeploymentName | quote}}
+  maxReplicas: 1
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
+
diff --git a/resources/v1.24.3/charts/istiod/templates/NOTES.txt b/resources/v1.27.2/charts/istiod/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.3/charts/istiod/templates/NOTES.txt
rename to resources/v1.27.2/charts/istiod/templates/NOTES.txt
diff --git a/resources/v1.24.3/charts/istiod/templates/_helpers.tpl b/resources/v1.27.2/charts/istiod/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.3/charts/istiod/templates/_helpers.tpl
rename to resources/v1.27.2/charts/istiod/templates/_helpers.tpl
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/autoscale.yaml b/resources/v1.27.2/charts/istiod/templates/autoscale.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/autoscale.yaml
rename to resources/v1.27.2/charts/istiod/templates/autoscale.yaml
diff --git a/resources/v1.27.2/charts/istiod/templates/clusterrole.yaml b/resources/v1.27.2/charts/istiod/templates/clusterrole.yaml
new file mode 100644
index 000000000..d9c86f43f
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/templates/clusterrole.yaml
@@ -0,0 +1,213 @@
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  # sidecar injection controller
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+
+  # configuration validation webhook controller
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update"]
+
+  # istio configuration
+  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
+  # please proceed with caution
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["get", "watch", "list"]
+    resources: ["*"]
+{{- if .Values.global.istiod.enableAnalysis }}
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["update", "patch"]
+    resources:
+    - authorizationpolicies/status
+    - destinationrules/status
+    - envoyfilters/status
+    - gateways/status
+    - peerauthentications/status
+    - proxyconfigs/status
+    - requestauthentications/status
+    - serviceentries/status
+    - sidecars/status
+    - telemetries/status
+    - virtualservices/status
+    - wasmplugins/status
+    - workloadentries/status
+    - workloadgroups/status
+{{- end }}
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "workloadentries" ]
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "workloadentries/status",  "serviceentries/status" ]
+  - apiGroups: ["security.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "authorizationpolicies/status" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "services/status" ]
+
+  # auto-detect installed CRD definitions
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+
+  # discovery and routing
+  - apiGroups: [""]
+    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+
+{{- if .Values.taint.enabled }}
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["patch"]
+{{- end }}
+
+  # ingress controller
+{{- if .Values.global.istiod.enableAnalysis }}
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["*"]
+{{- end}}
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses", "ingressclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["*"]
+
+  # required for CA's namespace controller
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create", "get", "list", "watch", "update"]
+
+  # Istiod and bootstrap.
+{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
+{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
+  - apiGroups: ["certificates.k8s.io"]
+    resources:
+      - "certificatesigningrequests"
+      - "certificatesigningrequests/approval"
+      - "certificatesigningrequests/status"
+    verbs: ["update", "create", "get", "delete", "watch"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources:
+      - "signers"
+    resourceNames:
+{{- range .Values.global.certSigners }}
+    - {{ . | quote }}
+{{- end }}
+    verbs: ["approve"]
+{{- end}}
+{{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["clustertrustbundles"]
+    verbs: ["update", "create", "delete", "list", "watch", "get"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["signers"]
+    resourceNames: ["istio.io/istiod-ca"]
+    verbs: ["attest"]
+{{- end }}
+
+  # Used by Istiod to verify the JWT tokens
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]
+
+  # Used by Istiod to verify gateway SDS
+  - apiGroups: ["authorization.k8s.io"]
+    resources: ["subjectaccessreviews"]
+    verbs: ["create"]
+
+  # Use for Kubernetes Service APIs
+  - apiGroups: ["gateway.networking.k8s.io", "gateway.networking.x-k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["gateway.networking.x-k8s.io"]
+    resources:
+    - xbackendtrafficpolicies/status
+    - xlistenersets/status
+    verbs: ["update", "patch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources:
+    - backendtlspolicies/status
+    - gatewayclasses/status
+    - gateways/status
+    - grpcroutes/status
+    - httproutes/status
+    - referencegrants/status
+    - tcproutes/status
+    - tlsroutes/status
+    - udproutes/status
+    verbs: ["update", "patch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources: ["gatewayclasses"]
+    verbs: ["create", "update", "patch", "delete"]
+  - apiGroups: ["inference.networking.x-k8s.io"]
+    resources: ["inferencepools"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["inference.networking.x-k8s.io"]
+    resources: ["inferencepools/status"]
+    verbs: ["update", "patch"]
+
+  # Needed for multicluster secret reading, possibly ingress certs in the future
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "watch", "list"]
+
+  # Used for MCS serviceexport management
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceexports"]
+    verbs: [ "get", "watch", "list", "create", "delete"]
+
+  # Used for MCS serviceimport management
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceimports"]
+    verbs: ["get", "watch", "list"]
+---
+{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["apps"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "deployments" ]
+  - apiGroups: ["autoscaling"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "horizontalpodautoscalers" ]
+  - apiGroups: ["policy"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "poddisruptionbudgets" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "services" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "serviceaccounts"]
+{{- end }}
+{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.27.2/charts/istiod/templates/clusterrolebinding.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/clusterrolebinding.yaml
rename to resources/v1.27.2/charts/istiod/templates/clusterrolebinding.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.27.2/charts/istiod/templates/configmap-jwks.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/configmap-jwks.yaml
rename to resources/v1.27.2/charts/istiod/templates/configmap-jwks.yaml
diff --git a/resources/v1.27.2/charts/istiod/templates/configmap-values.yaml b/resources/v1.27.2/charts/istiod/templates/configmap-values.yaml
new file mode 100644
index 000000000..75e6e0bcc
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/templates/configmap-values.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+  original-values: |-
+{{ .Values._original | toPrettyJson | indent 4 }}
+{{- $_ := unset $.Values "_original" }}
+  merged-values: |-
+{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/configmap.yaml b/resources/v1.27.2/charts/istiod/templates/configmap.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/configmap.yaml
rename to resources/v1.27.2/charts/istiod/templates/configmap.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/deployment.yaml b/resources/v1.27.2/charts/istiod/templates/deployment.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/deployment.yaml
rename to resources/v1.27.2/charts/istiod/templates/deployment.yaml
diff --git a/resources/v1.27.2/charts/istiod/templates/gateway-class-configmap.yaml b/resources/v1.27.2/charts/istiod/templates/gateway-class-configmap.yaml
new file mode 100644
index 000000000..6b23d716a
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/templates/gateway-class-configmap.yaml
@@ -0,0 +1,20 @@
+{{ range $key, $value := .Values.gatewayClasses }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-{{ $.Values.revision | default "default"  }}-gatewayclass-{{$key}}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    gateway.istio.io/defaults-for-class: {{$key|quote}}
+    {{- include "istio.labels" $ | nindent 4 }}
+data:
+{{ range $kind, $overlay := $value }}
+  {{$kind}}: |
+{{$overlay|toYaml|trim|indent 4}}
+{{ end }}
+---
+{{ end }}
diff --git a/resources/v1.27.2/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.27.2/charts/istiod/templates/istiod-injector-configmap.yaml
new file mode 100644
index 000000000..171aff886
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/templates/istiod-injector-configmap.yaml
@@ -0,0 +1,81 @@
+{{- if not .Values.global.omitSidecarInjectorConfigMap }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
+  values: |-
+{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
+{{ $pilotVals := pick .Values "cni" "env" -}}
+{{ $vals = set $vals "pilot" $pilotVals -}}
+{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
+{{ $vals = set $vals "gateways" $gatewayVals -}}
+{{ $vals | toPrettyJson | indent 4 }}
+
+  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
+  # and istiod webhook functionality.
+  #
+  # New fields should not use Values - it is a 'primary' config object, users should be able
+  # to fine tune it or use it with kube-inject.
+  config: |-
+    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
+    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
+    defaultTemplates:
+{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
+    - {{ . }}
+{{- end }}
+    {{- else }}
+    defaultTemplates: [sidecar]
+    {{- end }}
+    policy: {{ .Values.global.proxy.autoInject }}
+    alwaysInjectSelector:
+{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
+    neverInjectSelector:
+{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
+    injectedAnnotations:
+      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
+      "{{ $key }}": {{ $val | quote }}
+      {{- end }}
+    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
+         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
+         This should make it obvious that their installation is broken.
+     */}}
+    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
+    templates:
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
+      sidecar: |
+{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
+      gateway: |
+{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
+      grpc-simple: |
+{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
+      grpc-agent: |
+{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
+      waypoint: |
+{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
+      kube-gateway: |
+{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
+{{- end }}
+{{- with .Values.sidecarInjectorWebhook.templates }}
+{{ toYaml . | trim | indent 6 }}
+{{- end }}
+
+{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.27.2/charts/istiod/templates/mutatingwebhook.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/mutatingwebhook.yaml
rename to resources/v1.27.2/charts/istiod/templates/mutatingwebhook.yaml
diff --git a/resources/v1.27.2/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.27.2/charts/istiod/templates/poddisruptionbudget.yaml
new file mode 100644
index 000000000..d21cd919d
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/templates/poddisruptionbudget.yaml
@@ -0,0 +1,36 @@
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istiod
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    istio: pilot
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  {{- if and .Values.pdb.minAvailable (not (hasKey .Values.pdb "maxUnavailable")) }}
+  minAvailable: {{ .Values.pdb.minAvailable }}
+  {{- else if .Values.pdb.maxUnavailable }}
+  maxUnavailable: {{ .Values.pdb.maxUnavailable }}
+  {{- end }}
+  {{- if .Values.pdb.unhealthyPodEvictionPolicy }}
+  unhealthyPodEvictionPolicy: {{ .Values.pdb.unhealthyPodEvictionPolicy }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app: istiod
+      {{- if ne .Values.revision "" }}
+      istio.io/rev: {{ .Values.revision | quote }}
+      {{- else }}
+      istio: pilot
+      {{- end }}
+---
+{{- end }}
+{{- end }}
diff --git a/resources/v1.24.0/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.27.2/charts/istiod/templates/reader-clusterrole.yaml
similarity index 100%
rename from resources/v1.24.0/charts/istiod/templates/reader-clusterrole.yaml
rename to resources/v1.27.2/charts/istiod/templates/reader-clusterrole.yaml
diff --git a/resources/v1.24.3/charts/istiod/templates/reader-clusterrolebinding.yaml b/resources/v1.27.2/charts/istiod/templates/reader-clusterrolebinding.yaml
similarity index 100%
rename from resources/v1.24.3/charts/istiod/templates/reader-clusterrolebinding.yaml
rename to resources/v1.27.2/charts/istiod/templates/reader-clusterrolebinding.yaml
diff --git a/resources/v1.27.2/charts/istiod/templates/remote-istiod-endpoints.yaml b/resources/v1.27.2/charts/istiod/templates/remote-istiod-endpoints.yaml
new file mode 100644
index 000000000..f13b8ce9a
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/templates/remote-istiod-endpoints.yaml
@@ -0,0 +1,30 @@
+{{- if and .Values.global.remotePilotAddress .Values.istiodRemote.enabled }}
+# if the remotePilotAddress is an IP addr
+{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
+apiVersion: v1
+kind: Endpoints
+metadata:
+  {{- if .Values.istiodRemote.enabledLocalInjectorIstiod }}
+  # This file is only used for remote `istiod` installs.
+  # only primary `istiod` to xds and local `istiod` injection installs.
+  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
+  {{- else }}
+  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
+  {{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+subsets:
+- addresses:
+  - ip: {{ .Values.global.remotePilotAddress }}
+  ports:
+  - port: 15012
+    name: tcp-istiod
+    protocol: TCP
+  - port: 15017
+    name: tcp-webhook
+    protocol: TCP
+---
+{{- end }}
+{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.27.2/charts/istiod/templates/remote-istiod-service.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/remote-istiod-service.yaml
rename to resources/v1.27.2/charts/istiod/templates/remote-istiod-service.yaml
diff --git a/resources/v1.27.2/charts/istiod/templates/revision-tags.yaml b/resources/v1.27.2/charts/istiod/templates/revision-tags.yaml
new file mode 100644
index 000000000..06764a826
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/templates/revision-tags.yaml
@@ -0,0 +1,149 @@
+# Adapted from istio-discovery/templates/mutatingwebhook.yaml
+# Removed paths for legacy and default selectors since a revision tag
+# is inherently created from a specific revision
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- $whv := dict
+"revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "caBundle" .Values.istiodRemote.injectionCABundle
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+{{- range $tagName := $.Values.revisionTags }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq $.Release.Namespace "istio-system"}}
+  name: istio-revision-tag-{{ $tagName }}
+{{- else }}
+  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/tag: {{ $tagName }}
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+
+{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
+{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
+{{- if (eq $tagName "default") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+---
+{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/role.yaml b/resources/v1.27.2/charts/istiod/templates/role.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/role.yaml
rename to resources/v1.27.2/charts/istiod/templates/role.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/rolebinding.yaml b/resources/v1.27.2/charts/istiod/templates/rolebinding.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/rolebinding.yaml
rename to resources/v1.27.2/charts/istiod/templates/rolebinding.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/service.yaml b/resources/v1.27.2/charts/istiod/templates/service.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/service.yaml
rename to resources/v1.27.2/charts/istiod/templates/service.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/serviceaccount.yaml b/resources/v1.27.2/charts/istiod/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/serviceaccount.yaml
rename to resources/v1.27.2/charts/istiod/templates/serviceaccount.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.27.2/charts/istiod/templates/validatingadmissionpolicy.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/validatingadmissionpolicy.yaml
rename to resources/v1.27.2/charts/istiod/templates/validatingadmissionpolicy.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.27.2/charts/istiod/templates/validatingwebhookconfiguration.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/templates/validatingwebhookconfiguration.yaml
rename to resources/v1.27.2/charts/istiod/templates/validatingwebhookconfiguration.yaml
diff --git a/resources/v1.24.3/charts/istiod/templates/zzy_descope_legacy.yaml b/resources/v1.27.2/charts/istiod/templates/zzy_descope_legacy.yaml
similarity index 100%
rename from resources/v1.24.3/charts/istiod/templates/zzy_descope_legacy.yaml
rename to resources/v1.27.2/charts/istiod/templates/zzy_descope_legacy.yaml
diff --git a/resources/v1.27.2/charts/istiod/templates/zzz_profile.yaml b/resources/v1.27.2/charts/istiod/templates/zzz_profile.yaml
new file mode 100644
index 000000000..3d8495648
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if false }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.27.2/charts/istiod/values.yaml b/resources/v1.27.2/charts/istiod/values.yaml
new file mode 100644
index 000000000..89d86fdb8
--- /dev/null
+++ b/resources/v1.27.2/charts/istiod/values.yaml
@@ -0,0 +1,569 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  autoscaleBehavior: {}
+  replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+
+  hub: ""
+  tag: ""
+  variant: ""
+
+  # Can be a full hub/image:tag
+  image: pilot
+  traceSampling: 1.0
+
+  # Resources for a small pilot install
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2048Mi
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # Whether to use an existing CNI installation
+  cni:
+    enabled: false
+    provider: default
+
+  # Additional container arguments
+  extraContainerArgs: []
+
+  env: {}
+
+  envVarFrom: []
+
+  # Settings related to the untaint controller
+  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
+  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
+  taint:
+    # Controls whether or not the untaint controller is active
+    enabled: false
+    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
+    namespace: ""
+
+  affinity: {}
+
+  tolerations: []
+
+  cpu:
+    targetAverageUtilization: 80
+  memory: {}
+    # targetAverageUtilization: 80
+
+  # Additional volumeMounts to the istiod container
+  volumeMounts: []
+
+  # Additional volumes to the istiod pod
+  volumes: []
+
+  # Inject initContainers into the istiod pod
+  initContainers: []
+
+  nodeSelector: {}
+  podAnnotations: {}
+  serviceAnnotations: {}
+  serviceAccountAnnotations: {}
+  sidecarInjectorWebhookAnnotations: {}
+
+  topologySpreadConstraints: []
+
+  # You can use jwksResolverExtraRootCA to provide a root certificate
+  # in PEM format. This will then be trusted by pilot when resolving
+  # JWKS URIs.
+  jwksResolverExtraRootCA: ""
+
+  # The following is used to limit how long a sidecar can be connected
+  # to a pilot. It balances out load across pilot instances at the cost of
+  # increasing system churn.
+  keepaliveMaxServerConnectionAge: 30m
+
+  # Additional labels to apply to the deployment.
+  deploymentLabels: {}
+
+  # Annotations to apply to the istiod deployment.
+  deploymentAnnotations: {}
+
+  ## Mesh config settings
+
+  # Install the mesh config map, generated from values.yaml.
+  # If false, pilot wil use default values (by default) or user-supplied values.
+  configMap: true
+
+  # Additional labels to apply on the pod level for monitoring and logging configuration.
+  podLabels: {}
+
+  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
+  ipFamilyPolicy: ""
+  ipFamilies: []
+
+  # Ambient mode only.
+  # Set this if you install ztunnel to a different namespace from `istiod`.
+  # If set, `istiod` will allow connections from trusted node proxy ztunnels
+  # in the provided namespace.
+  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
+  # in the same namespace as itself.
+  trustedZtunnelNamespace: ""
+  # Set this if you install ztunnel with a name different from the default.
+  trustedZtunnelName: ""
+
+  sidecarInjectorWebhook:
+    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
+    # always skip the injection on pods that match that label selector, regardless of the global policy.
+    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
+    neverInjectSelector: []
+    alwaysInjectSelector: []
+
+    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
+    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
+    #
+    # annotations:
+    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+    #
+    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
+    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
+    # injectedAnnotations:
+    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
+    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
+    injectedAnnotations: {}
+
+    # This enables injection of sidecar in all namespaces,
+    # with the exception of namespaces with "istio-injection:disabled" annotation
+    # Only one environment should have this enabled.
+    enableNamespacesByDefault: false
+
+    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
+    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
+    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
+    reinvocationPolicy: Never
+
+    rewriteAppHTTPProbe: true
+
+    # Templates defines a set of custom injection templates that can be used. For example, defining:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
+    # being injected with the hello=world labels.
+    # This is intended for advanced configuration only; most users should use the built in template
+    templates: {}
+
+    # Default templates specifies a set of default templates that are used in sidecar injection.
+    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
+    # To inject other additional templates, define it using the `templates` option, and add it to
+    # the default templates list.
+    # For example:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # defaultTemplates: ["sidecar", "hello"]
+    defaultTemplates: []
+  istiodRemote:
+    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
+    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
+    # to utilize a remote instance.
+    enabled: false
+
+    # If `true`, indicates that this cluster/install should consume a "local istiod" installation,
+    # local istiod inject sidecars
+    enabledLocalInjectorIstiod: false
+
+    # Sidecar injector mutating webhook configuration clientConfig.url value.
+    # For example: https://$remotePilotAddress:15017/inject
+    # The host should not refer to a service running in the cluster; use a service reference by specifying
+    # the clientConfig.service field instead.
+    injectionURL: ""
+
+    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
+    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
+    injectionPath: "/inject"
+
+    injectionCABundle: ""
+  telemetry:
+    enabled: true
+    v2:
+      # For Null VM case now.
+      # This also enables metadata exchange.
+      enabled: true
+      # Indicate if prometheus stats filter is enabled or not
+      prometheus:
+        enabled: true
+      # stackdriver filter settings.
+      stackdriver:
+        enabled: false
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # Revision tags are aliases to Istio control plane revisions
+  revisionTags: []
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
+  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
+  meshConfig:
+    enablePrometheusMerge: true
+
+  experimental:
+    stableValidationPolicy: false
+
+  global:
+    # Used to locate istiod.
+    istioNamespace: istio-system
+    # List of cert-signers to allow "approve" action in the istio cluster role
+    #
+    # certSigners:
+    #   - clusterissuers.cert-manager.io/istio-ca
+    certSigners: []
+    # enable pod disruption budget for the control plane, which is used to
+    # ensure Istio control plane components are gradually upgraded or recovered.
+    defaultPodDisruptionBudget:
+      enabled: true
+      # The values aren't mutable due to a current PodDisruptionBudget limitation
+      # minAvailable: 1
+
+    # A minimal set of requested resources to applied to all deployments so that
+    # Horizontal Pod Autoscaler will be able to function (if set).
+    # Each component can overwrite these default values by adding its own resources
+    # block in the relevant section below and setting the desired resources values.
+    defaultResources:
+      requests:
+        cpu: 10m
+      #   memory: 128Mi
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+    # Default tag for Istio images.
+    tag: 1.27.2
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Enabled by default in master for maximising testing.
+    istiod:
+      enableAnalysis: false
+
+    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
+    logAsJson: false
+
+    # In order to use native nftable rules instead of iptable rules, set this flag to true.
+    nativeNftables: false
+
+    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+    # The control plane has different scopes depending on component, but can configure default log level across all components
+    # If empty, default scope and level will be used as configured in code
+    logging:
+      level: "default:info"
+
+    omitSidecarInjectorConfigMap: false
+
+    # Configure whether Operator manages webhook configurations. The current behavior
+    # of Istiod is to manage its own webhook configurations.
+    # When this option is set as true, Istio Operator, instead of webhooks, manages the
+    # webhook configurations. When this option is set as false, webhooks manage their
+    # own webhook configurations.
+    operatorManageWebhooks: false
+
+    # Custom DNS config for the pod to resolve names of services in other
+    # clusters. Use this to add additional search domains, and other settings.
+    # see
+    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
+    # This does not apply to gateway pods as they typically need a different
+    # set of DNS settings than the normal application pods (e.g., in
+    # multicluster scenarios).
+    # NOTE: If using templates, follow the pattern in the commented example below.
+    #podDNSSearchNamespaces:
+    #- global
+    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
+
+    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
+    # system-node-critical, it is better to configure this in order to make sure your Istio pods
+    # will not be killed because of low priority class.
+    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+    # for more detail.
+    priorityClassName: ""
+
+    proxy:
+      image: proxyv2
+
+      # This controls the 'policy' in the sidecar injector.
+      autoInject: enabled
+
+      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
+      # cluster domain. Default value is "cluster.local".
+      clusterDomain: "cluster.local"
+
+      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
+      # not set, then the global "logLevel" will be used.
+      componentLogLevel: "misc:error"
+
+      # istio ingress capture allowlist
+      # examples:
+      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
+      excludeInboundPorts: ""
+      includeInboundPorts: "*"
+
+      # istio egress capture allowlist
+      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
+      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
+      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
+      # be allowed by the sidecar
+      includeIPRanges: "*"
+      excludeIPRanges: ""
+      includeOutboundPorts: ""
+      excludeOutboundPorts: ""
+
+      # Log level for proxy, applies to gateways and sidecars.
+      # Expected values are: trace|debug|info|warning|error|critical|off
+      logLevel: warning
+
+      # Specify the path to the outlier event log.
+      # Example: /dev/stdout
+      outlierLogPath: ""
+
+      #If set to true, istio-proxy container will have privileged securityContext
+      privileged: false
+
+      # The number of successive failed probes before indicating readiness failure.
+      readinessFailureThreshold: 4
+
+      # The initial delay for readiness probes in seconds.
+      readinessInitialDelaySeconds: 0
+
+      # The period between readiness probes.
+      readinessPeriodSeconds: 15
+
+      # Enables or disables a startup probe.
+      # For optimal startup times, changing this should be tied to the readiness probe values.
+      #
+      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
+      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
+      # and doesn't spam the readiness endpoint too much
+      #
+      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
+      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
+      startupProbe:
+        enabled: true
+        failureThreshold: 600 # 10 minutes
+
+      # Resources for the sidecar.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: 2000m
+          memory: 1024Mi
+
+      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
+      statusPort: 15020
+
+      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
+      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
+      tracer: "none"
+
+    proxy_init:
+      # Base name for the proxy_init container, used to configure iptables.
+      image: proxyv2
+      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
+      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
+      forceApplyIptables: false
+
+    # configure remote pilot and istiod service and endpoint
+    remotePilotAddress: ""
+
+    ##############################################################################################
+    # The following values are found in other charts. To effectively modify these values, make   #
+    # make sure they are consistent across your Istio helm charts                                #
+    ##############################################################################################
+
+    # The customized CA address to retrieve certificates for the pods in the cluster.
+    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+    # If not set explicitly, default to the Istio discovery address.
+    caAddress: ""
+
+    # Enable control of remote clusters.
+    externalIstiod: false
+
+    # Configure a remote cluster as the config cluster for an external istiod.
+    configCluster: false
+
+    # configValidation enables the validation webhook for Istio configuration.
+    configValidation: true
+
+    # Mesh ID means Mesh Identifier. It should be unique within the scope where
+    # meshes will interact with each other, but it is not required to be
+    # globally/universally unique. For example, if any of the following are true,
+    # then two meshes must have different Mesh IDs:
+    # - Meshes will have their telemetry aggregated in one place
+    # - Meshes will be federated together
+    # - Policy will be written referencing one mesh from the other
+    #
+    # If an administrator expects that any of these conditions may become true in
+    # the future, they should ensure their meshes have different Mesh IDs
+    # assigned.
+    #
+    # Within a multicluster mesh, each cluster must be (manually or auto)
+    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
+    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
+    # of migration TBD, and it may be a disruptive operation to change the Mesh
+    # ID post-install.
+    #
+    # If the mesh admin does not specify a value, Istio will use the value of the
+    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
+    # value.
+    meshID: ""
+
+    # Configure the mesh networks to be used by the Split Horizon EDS.
+    #
+    # The following example defines two networks with different endpoints association methods.
+    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
+    # mapped to network1. The gateway for this network example is specified by its public IP
+    # address and port.
+    # The second network, `network2`, in this example is defined differently with all endpoints
+    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
+    # gateway is also defined differently with the name of the gateway service on the remote
+    # cluster. The public IP for the gateway will be determined from that remote service (only
+    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
+    # it still need to be configured manually).
+    #
+    # meshNetworks:
+    #   network1:
+    #     endpoints:
+    #     - fromCidr: "192.168.0.1/24"
+    #     gateways:
+    #     - address: 1.1.1.1
+    #       port: 80
+    #   network2:
+    #     endpoints:
+    #     - fromRegistry: reg1
+    #     gateways:
+    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
+    #       port: 443
+    #
+    meshNetworks: {}
+
+    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
+    mountMtlsCerts: false
+
+    multiCluster:
+      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
+      # to properly label proxies
+      clusterName: ""
+
+    # Network defines the network this cluster belong to. This name
+    # corresponds to the networks in the map of mesh networks.
+    network: ""
+
+    # Configure the certificate provider for control plane communication.
+    # Currently, two providers are supported: "kubernetes" and "istiod".
+    # As some platforms may not have kubernetes signing APIs,
+    # Istiod is the default
+    pilotCertProvider: istiod
+
+    sds:
+      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
+      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
+      # JWT is intended for the CA.
+      token:
+        aud: istio-ca
+
+    sts:
+      # The service port used by Security Token Service (STS) server to handle token exchange requests.
+      # Setting this port to a non-zero value enables STS server.
+      servicePort: 0
+
+    # The name of the CA for workload certificates.
+    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
+    # will be used as the certificates for workloads.
+    # The default value is "" and when caName="", the CA will be configured by other
+    # mechanisms (e.g., environmental variable CA_PROVIDER).
+    caName: ""
+
+    waypoint:
+      # Resources for the waypoint proxy.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: "2"
+          memory: 1Gi
+
+      # If specified, affinity defines the scheduling constraints of waypoint pods.
+      affinity: {}
+
+      # Topology Spread Constraints for the waypoint proxy.
+      topologySpreadConstraints: []
+
+      # Node labels for the waypoint proxy.
+      nodeSelector: {}
+
+      # Tolerations for the waypoint proxy.
+      tolerations: []
+
+  base:
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  # Gateway Settings
+  gateways:
+    # Define the security context for the pod.
+    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+    securityContext: {}
+
+    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
+    seccompProfile: {}
+
+  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
+  # For example:
+  # gatewayClasses:
+  #   istio:
+  #     service:
+  #       spec:
+  #         type: ClusterIP
+  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
+  gatewayClasses: {}
+  
+  pdb:
+    # -- Minimum available pods set in PodDisruptionBudget.
+    # Define either 'minAvailable' or 'maxUnavailable', never both.
+    minAvailable: 1
+    # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
+    # maxUnavailable: 1
+    # -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.
+    # Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/
+    unhealthyPodEvictionPolicy: ""
diff --git a/resources/v1.27.2/charts/revisiontags/Chart.yaml b/resources/v1.27.2/charts/revisiontags/Chart.yaml
new file mode 100644
index 000000000..cf8f6ce14
--- /dev/null
+++ b/resources/v1.27.2/charts/revisiontags/Chart.yaml
@@ -0,0 +1,8 @@
+apiVersion: v2
+appVersion: 1.27.2
+description: Helm chart for istio revision tags
+name: revisiontags
+sources:
+- https://github.com/istio-ecosystem/sail-operator
+version: 0.1.0
+
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.27.2/charts/revisiontags/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-ambient.yaml
rename to resources/v1.27.2/charts/revisiontags/files/profile-ambient.yaml
diff --git a/resources/v1.27.2/charts/revisiontags/files/profile-compatibility-version-1.24.yaml b/resources/v1.27.2/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..4f3dbef7e
--- /dev/null
+++ b/resources/v1.27.2/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,15 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.2/charts/revisiontags/files/profile-compatibility-version-1.25.yaml b/resources/v1.27.2/charts/revisiontags/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..b2f45948c
--- /dev/null
+++ b/resources/v1.27.2/charts/revisiontags/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.2/charts/revisiontags/files/profile-compatibility-version-1.26.yaml b/resources/v1.27.2/charts/revisiontags/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..af1069732
--- /dev/null
+++ b/resources/v1.27.2/charts/revisiontags/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
\ No newline at end of file
diff --git a/resources/v1.25.4/charts/revisiontags/files/profile-demo.yaml b/resources/v1.27.2/charts/revisiontags/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.4/charts/revisiontags/files/profile-demo.yaml
rename to resources/v1.27.2/charts/revisiontags/files/profile-demo.yaml
diff --git a/resources/v1.27.2/charts/revisiontags/files/profile-platform-gke.yaml b/resources/v1.27.2/charts/revisiontags/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.27.2/charts/revisiontags/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.3/charts/revisiontags/files/profile-platform-k3d.yaml b/resources/v1.27.2/charts/revisiontags/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.3/charts/revisiontags/files/profile-platform-k3d.yaml
rename to resources/v1.27.2/charts/revisiontags/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.4/charts/revisiontags/files/profile-platform-k3s.yaml b/resources/v1.27.2/charts/revisiontags/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.4/charts/revisiontags/files/profile-platform-k3s.yaml
rename to resources/v1.27.2/charts/revisiontags/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.3/charts/revisiontags/files/profile-platform-microk8s.yaml b/resources/v1.27.2/charts/revisiontags/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.3/charts/revisiontags/files/profile-platform-microk8s.yaml
rename to resources/v1.27.2/charts/revisiontags/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.3/charts/revisiontags/files/profile-platform-minikube.yaml b/resources/v1.27.2/charts/revisiontags/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.3/charts/revisiontags/files/profile-platform-minikube.yaml
rename to resources/v1.27.2/charts/revisiontags/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.3/charts/revisiontags/files/profile-platform-openshift.yaml b/resources/v1.27.2/charts/revisiontags/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.3/charts/revisiontags/files/profile-platform-openshift.yaml
rename to resources/v1.27.2/charts/revisiontags/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.3/charts/revisiontags/files/profile-preview.yaml b/resources/v1.27.2/charts/revisiontags/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.3/charts/revisiontags/files/profile-preview.yaml
rename to resources/v1.27.2/charts/revisiontags/files/profile-preview.yaml
diff --git a/resources/v1.24.3/charts/revisiontags/files/profile-remote.yaml b/resources/v1.27.2/charts/revisiontags/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.3/charts/revisiontags/files/profile-remote.yaml
rename to resources/v1.27.2/charts/revisiontags/files/profile-remote.yaml
diff --git a/resources/v1.24.3/charts/revisiontags/files/profile-stable.yaml b/resources/v1.27.2/charts/revisiontags/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.3/charts/revisiontags/files/profile-stable.yaml
rename to resources/v1.27.2/charts/revisiontags/files/profile-stable.yaml
diff --git a/resources/v1.27.2/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.27.2/charts/revisiontags/templates/revision-tags.yaml
new file mode 100644
index 000000000..06764a826
--- /dev/null
+++ b/resources/v1.27.2/charts/revisiontags/templates/revision-tags.yaml
@@ -0,0 +1,149 @@
+# Adapted from istio-discovery/templates/mutatingwebhook.yaml
+# Removed paths for legacy and default selectors since a revision tag
+# is inherently created from a specific revision
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- $whv := dict
+"revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "caBundle" .Values.istiodRemote.injectionCABundle
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+{{- range $tagName := $.Values.revisionTags }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq $.Release.Namespace "istio-system"}}
+  name: istio-revision-tag-{{ $tagName }}
+{{- else }}
+  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/tag: {{ $tagName }}
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+
+{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
+{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
+{{- if (eq $tagName "default") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+---
+{{- end }}
diff --git a/resources/v1.27.2/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.27.2/charts/revisiontags/templates/zzz_profile.yaml
new file mode 100644
index 000000000..3d8495648
--- /dev/null
+++ b/resources/v1.27.2/charts/revisiontags/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if false }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.27.2/charts/revisiontags/values.yaml b/resources/v1.27.2/charts/revisiontags/values.yaml
new file mode 100644
index 000000000..89d86fdb8
--- /dev/null
+++ b/resources/v1.27.2/charts/revisiontags/values.yaml
@@ -0,0 +1,569 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  autoscaleBehavior: {}
+  replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+
+  hub: ""
+  tag: ""
+  variant: ""
+
+  # Can be a full hub/image:tag
+  image: pilot
+  traceSampling: 1.0
+
+  # Resources for a small pilot install
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2048Mi
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # Whether to use an existing CNI installation
+  cni:
+    enabled: false
+    provider: default
+
+  # Additional container arguments
+  extraContainerArgs: []
+
+  env: {}
+
+  envVarFrom: []
+
+  # Settings related to the untaint controller
+  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
+  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
+  taint:
+    # Controls whether or not the untaint controller is active
+    enabled: false
+    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
+    namespace: ""
+
+  affinity: {}
+
+  tolerations: []
+
+  cpu:
+    targetAverageUtilization: 80
+  memory: {}
+    # targetAverageUtilization: 80
+
+  # Additional volumeMounts to the istiod container
+  volumeMounts: []
+
+  # Additional volumes to the istiod pod
+  volumes: []
+
+  # Inject initContainers into the istiod pod
+  initContainers: []
+
+  nodeSelector: {}
+  podAnnotations: {}
+  serviceAnnotations: {}
+  serviceAccountAnnotations: {}
+  sidecarInjectorWebhookAnnotations: {}
+
+  topologySpreadConstraints: []
+
+  # You can use jwksResolverExtraRootCA to provide a root certificate
+  # in PEM format. This will then be trusted by pilot when resolving
+  # JWKS URIs.
+  jwksResolverExtraRootCA: ""
+
+  # The following is used to limit how long a sidecar can be connected
+  # to a pilot. It balances out load across pilot instances at the cost of
+  # increasing system churn.
+  keepaliveMaxServerConnectionAge: 30m
+
+  # Additional labels to apply to the deployment.
+  deploymentLabels: {}
+
+  # Annotations to apply to the istiod deployment.
+  deploymentAnnotations: {}
+
+  ## Mesh config settings
+
+  # Install the mesh config map, generated from values.yaml.
+  # If false, pilot wil use default values (by default) or user-supplied values.
+  configMap: true
+
+  # Additional labels to apply on the pod level for monitoring and logging configuration.
+  podLabels: {}
+
+  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
+  ipFamilyPolicy: ""
+  ipFamilies: []
+
+  # Ambient mode only.
+  # Set this if you install ztunnel to a different namespace from `istiod`.
+  # If set, `istiod` will allow connections from trusted node proxy ztunnels
+  # in the provided namespace.
+  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
+  # in the same namespace as itself.
+  trustedZtunnelNamespace: ""
+  # Set this if you install ztunnel with a name different from the default.
+  trustedZtunnelName: ""
+
+  sidecarInjectorWebhook:
+    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
+    # always skip the injection on pods that match that label selector, regardless of the global policy.
+    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
+    neverInjectSelector: []
+    alwaysInjectSelector: []
+
+    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
+    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
+    #
+    # annotations:
+    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+    #
+    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
+    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
+    # injectedAnnotations:
+    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
+    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
+    injectedAnnotations: {}
+
+    # This enables injection of sidecar in all namespaces,
+    # with the exception of namespaces with "istio-injection:disabled" annotation
+    # Only one environment should have this enabled.
+    enableNamespacesByDefault: false
+
+    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
+    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
+    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
+    reinvocationPolicy: Never
+
+    rewriteAppHTTPProbe: true
+
+    # Templates defines a set of custom injection templates that can be used. For example, defining:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
+    # being injected with the hello=world labels.
+    # This is intended for advanced configuration only; most users should use the built in template
+    templates: {}
+
+    # Default templates specifies a set of default templates that are used in sidecar injection.
+    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
+    # To inject other additional templates, define it using the `templates` option, and add it to
+    # the default templates list.
+    # For example:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # defaultTemplates: ["sidecar", "hello"]
+    defaultTemplates: []
+  istiodRemote:
+    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
+    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
+    # to utilize a remote instance.
+    enabled: false
+
+    # If `true`, indicates that this cluster/install should consume a "local istiod" installation,
+    # local istiod inject sidecars
+    enabledLocalInjectorIstiod: false
+
+    # Sidecar injector mutating webhook configuration clientConfig.url value.
+    # For example: https://$remotePilotAddress:15017/inject
+    # The host should not refer to a service running in the cluster; use a service reference by specifying
+    # the clientConfig.service field instead.
+    injectionURL: ""
+
+    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
+    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
+    injectionPath: "/inject"
+
+    injectionCABundle: ""
+  telemetry:
+    enabled: true
+    v2:
+      # For Null VM case now.
+      # This also enables metadata exchange.
+      enabled: true
+      # Indicate if prometheus stats filter is enabled or not
+      prometheus:
+        enabled: true
+      # stackdriver filter settings.
+      stackdriver:
+        enabled: false
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # Revision tags are aliases to Istio control plane revisions
+  revisionTags: []
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
+  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
+  meshConfig:
+    enablePrometheusMerge: true
+
+  experimental:
+    stableValidationPolicy: false
+
+  global:
+    # Used to locate istiod.
+    istioNamespace: istio-system
+    # List of cert-signers to allow "approve" action in the istio cluster role
+    #
+    # certSigners:
+    #   - clusterissuers.cert-manager.io/istio-ca
+    certSigners: []
+    # enable pod disruption budget for the control plane, which is used to
+    # ensure Istio control plane components are gradually upgraded or recovered.
+    defaultPodDisruptionBudget:
+      enabled: true
+      # The values aren't mutable due to a current PodDisruptionBudget limitation
+      # minAvailable: 1
+
+    # A minimal set of requested resources to applied to all deployments so that
+    # Horizontal Pod Autoscaler will be able to function (if set).
+    # Each component can overwrite these default values by adding its own resources
+    # block in the relevant section below and setting the desired resources values.
+    defaultResources:
+      requests:
+        cpu: 10m
+      #   memory: 128Mi
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+    # Default tag for Istio images.
+    tag: 1.27.2
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Enabled by default in master for maximising testing.
+    istiod:
+      enableAnalysis: false
+
+    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
+    logAsJson: false
+
+    # In order to use native nftable rules instead of iptable rules, set this flag to true.
+    nativeNftables: false
+
+    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+    # The control plane has different scopes depending on component, but can configure default log level across all components
+    # If empty, default scope and level will be used as configured in code
+    logging:
+      level: "default:info"
+
+    omitSidecarInjectorConfigMap: false
+
+    # Configure whether Operator manages webhook configurations. The current behavior
+    # of Istiod is to manage its own webhook configurations.
+    # When this option is set as true, Istio Operator, instead of webhooks, manages the
+    # webhook configurations. When this option is set as false, webhooks manage their
+    # own webhook configurations.
+    operatorManageWebhooks: false
+
+    # Custom DNS config for the pod to resolve names of services in other
+    # clusters. Use this to add additional search domains, and other settings.
+    # see
+    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
+    # This does not apply to gateway pods as they typically need a different
+    # set of DNS settings than the normal application pods (e.g., in
+    # multicluster scenarios).
+    # NOTE: If using templates, follow the pattern in the commented example below.
+    #podDNSSearchNamespaces:
+    #- global
+    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
+
+    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
+    # system-node-critical, it is better to configure this in order to make sure your Istio pods
+    # will not be killed because of low priority class.
+    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+    # for more detail.
+    priorityClassName: ""
+
+    proxy:
+      image: proxyv2
+
+      # This controls the 'policy' in the sidecar injector.
+      autoInject: enabled
+
+      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
+      # cluster domain. Default value is "cluster.local".
+      clusterDomain: "cluster.local"
+
+      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
+      # not set, then the global "logLevel" will be used.
+      componentLogLevel: "misc:error"
+
+      # istio ingress capture allowlist
+      # examples:
+      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
+      excludeInboundPorts: ""
+      includeInboundPorts: "*"
+
+      # istio egress capture allowlist
+      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
+      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
+      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
+      # be allowed by the sidecar
+      includeIPRanges: "*"
+      excludeIPRanges: ""
+      includeOutboundPorts: ""
+      excludeOutboundPorts: ""
+
+      # Log level for proxy, applies to gateways and sidecars.
+      # Expected values are: trace|debug|info|warning|error|critical|off
+      logLevel: warning
+
+      # Specify the path to the outlier event log.
+      # Example: /dev/stdout
+      outlierLogPath: ""
+
+      #If set to true, istio-proxy container will have privileged securityContext
+      privileged: false
+
+      # The number of successive failed probes before indicating readiness failure.
+      readinessFailureThreshold: 4
+
+      # The initial delay for readiness probes in seconds.
+      readinessInitialDelaySeconds: 0
+
+      # The period between readiness probes.
+      readinessPeriodSeconds: 15
+
+      # Enables or disables a startup probe.
+      # For optimal startup times, changing this should be tied to the readiness probe values.
+      #
+      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
+      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
+      # and doesn't spam the readiness endpoint too much
+      #
+      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
+      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
+      startupProbe:
+        enabled: true
+        failureThreshold: 600 # 10 minutes
+
+      # Resources for the sidecar.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: 2000m
+          memory: 1024Mi
+
+      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
+      statusPort: 15020
+
+      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
+      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
+      tracer: "none"
+
+    proxy_init:
+      # Base name for the proxy_init container, used to configure iptables.
+      image: proxyv2
+      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
+      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
+      forceApplyIptables: false
+
+    # configure remote pilot and istiod service and endpoint
+    remotePilotAddress: ""
+
+    ##############################################################################################
+    # The following values are found in other charts. To effectively modify these values, make   #
+    # make sure they are consistent across your Istio helm charts                                #
+    ##############################################################################################
+
+    # The customized CA address to retrieve certificates for the pods in the cluster.
+    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+    # If not set explicitly, default to the Istio discovery address.
+    caAddress: ""
+
+    # Enable control of remote clusters.
+    externalIstiod: false
+
+    # Configure a remote cluster as the config cluster for an external istiod.
+    configCluster: false
+
+    # configValidation enables the validation webhook for Istio configuration.
+    configValidation: true
+
+    # Mesh ID means Mesh Identifier. It should be unique within the scope where
+    # meshes will interact with each other, but it is not required to be
+    # globally/universally unique. For example, if any of the following are true,
+    # then two meshes must have different Mesh IDs:
+    # - Meshes will have their telemetry aggregated in one place
+    # - Meshes will be federated together
+    # - Policy will be written referencing one mesh from the other
+    #
+    # If an administrator expects that any of these conditions may become true in
+    # the future, they should ensure their meshes have different Mesh IDs
+    # assigned.
+    #
+    # Within a multicluster mesh, each cluster must be (manually or auto)
+    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
+    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
+    # of migration TBD, and it may be a disruptive operation to change the Mesh
+    # ID post-install.
+    #
+    # If the mesh admin does not specify a value, Istio will use the value of the
+    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
+    # value.
+    meshID: ""
+
+    # Configure the mesh networks to be used by the Split Horizon EDS.
+    #
+    # The following example defines two networks with different endpoints association methods.
+    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
+    # mapped to network1. The gateway for this network example is specified by its public IP
+    # address and port.
+    # The second network, `network2`, in this example is defined differently with all endpoints
+    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
+    # gateway is also defined differently with the name of the gateway service on the remote
+    # cluster. The public IP for the gateway will be determined from that remote service (only
+    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
+    # it still need to be configured manually).
+    #
+    # meshNetworks:
+    #   network1:
+    #     endpoints:
+    #     - fromCidr: "192.168.0.1/24"
+    #     gateways:
+    #     - address: 1.1.1.1
+    #       port: 80
+    #   network2:
+    #     endpoints:
+    #     - fromRegistry: reg1
+    #     gateways:
+    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
+    #       port: 443
+    #
+    meshNetworks: {}
+
+    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
+    mountMtlsCerts: false
+
+    multiCluster:
+      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
+      # to properly label proxies
+      clusterName: ""
+
+    # Network defines the network this cluster belong to. This name
+    # corresponds to the networks in the map of mesh networks.
+    network: ""
+
+    # Configure the certificate provider for control plane communication.
+    # Currently, two providers are supported: "kubernetes" and "istiod".
+    # As some platforms may not have kubernetes signing APIs,
+    # Istiod is the default
+    pilotCertProvider: istiod
+
+    sds:
+      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
+      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
+      # JWT is intended for the CA.
+      token:
+        aud: istio-ca
+
+    sts:
+      # The service port used by Security Token Service (STS) server to handle token exchange requests.
+      # Setting this port to a non-zero value enables STS server.
+      servicePort: 0
+
+    # The name of the CA for workload certificates.
+    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
+    # will be used as the certificates for workloads.
+    # The default value is "" and when caName="", the CA will be configured by other
+    # mechanisms (e.g., environmental variable CA_PROVIDER).
+    caName: ""
+
+    waypoint:
+      # Resources for the waypoint proxy.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: "2"
+          memory: 1Gi
+
+      # If specified, affinity defines the scheduling constraints of waypoint pods.
+      affinity: {}
+
+      # Topology Spread Constraints for the waypoint proxy.
+      topologySpreadConstraints: []
+
+      # Node labels for the waypoint proxy.
+      nodeSelector: {}
+
+      # Tolerations for the waypoint proxy.
+      tolerations: []
+
+  base:
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  # Gateway Settings
+  gateways:
+    # Define the security context for the pod.
+    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+    securityContext: {}
+
+    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
+    seccompProfile: {}
+
+  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
+  # For example:
+  # gatewayClasses:
+  #   istio:
+  #     service:
+  #       spec:
+  #         type: ClusterIP
+  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
+  gatewayClasses: {}
+  
+  pdb:
+    # -- Minimum available pods set in PodDisruptionBudget.
+    # Define either 'minAvailable' or 'maxUnavailable', never both.
+    minAvailable: 1
+    # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
+    # maxUnavailable: 1
+    # -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.
+    # Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/
+    unhealthyPodEvictionPolicy: ""
diff --git a/resources/v1.27.2/charts/ztunnel/Chart.yaml b/resources/v1.27.2/charts/ztunnel/Chart.yaml
new file mode 100644
index 000000000..0ef197b82
--- /dev/null
+++ b/resources/v1.27.2/charts/ztunnel/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+appVersion: 1.27.2
+description: Helm chart for istio ztunnel components
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio-ztunnel
+- istio
+name: ztunnel
+sources:
+- https://github.com/istio/istio
+version: 1.27.2
diff --git a/resources/v1.24.3/charts/ztunnel/README.md b/resources/v1.27.2/charts/ztunnel/README.md
similarity index 100%
rename from resources/v1.24.3/charts/ztunnel/README.md
rename to resources/v1.27.2/charts/ztunnel/README.md
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.27.2/charts/ztunnel/files/profile-ambient.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-ambient.yaml
rename to resources/v1.27.2/charts/ztunnel/files/profile-ambient.yaml
diff --git a/resources/v1.27.2/charts/ztunnel/files/profile-compatibility-version-1.24.yaml b/resources/v1.27.2/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..4f3dbef7e
--- /dev/null
+++ b/resources/v1.27.2/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,15 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.2/charts/ztunnel/files/profile-compatibility-version-1.25.yaml b/resources/v1.27.2/charts/ztunnel/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..b2f45948c
--- /dev/null
+++ b/resources/v1.27.2/charts/ztunnel/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.2/charts/ztunnel/files/profile-compatibility-version-1.26.yaml b/resources/v1.27.2/charts/ztunnel/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..af1069732
--- /dev/null
+++ b/resources/v1.27.2/charts/ztunnel/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
\ No newline at end of file
diff --git a/resources/v1.25.4/charts/ztunnel/files/profile-demo.yaml b/resources/v1.27.2/charts/ztunnel/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.4/charts/ztunnel/files/profile-demo.yaml
rename to resources/v1.27.2/charts/ztunnel/files/profile-demo.yaml
diff --git a/resources/v1.27.2/charts/ztunnel/files/profile-platform-gke.yaml b/resources/v1.27.2/charts/ztunnel/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.27.2/charts/ztunnel/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.3/charts/ztunnel/files/profile-platform-k3d.yaml b/resources/v1.27.2/charts/ztunnel/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.3/charts/ztunnel/files/profile-platform-k3d.yaml
rename to resources/v1.27.2/charts/ztunnel/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.4/charts/ztunnel/files/profile-platform-k3s.yaml b/resources/v1.27.2/charts/ztunnel/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.4/charts/ztunnel/files/profile-platform-k3s.yaml
rename to resources/v1.27.2/charts/ztunnel/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.3/charts/ztunnel/files/profile-platform-microk8s.yaml b/resources/v1.27.2/charts/ztunnel/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.3/charts/ztunnel/files/profile-platform-microk8s.yaml
rename to resources/v1.27.2/charts/ztunnel/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.3/charts/ztunnel/files/profile-platform-minikube.yaml b/resources/v1.27.2/charts/ztunnel/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.3/charts/ztunnel/files/profile-platform-minikube.yaml
rename to resources/v1.27.2/charts/ztunnel/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.3/charts/ztunnel/files/profile-platform-openshift.yaml b/resources/v1.27.2/charts/ztunnel/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.3/charts/ztunnel/files/profile-platform-openshift.yaml
rename to resources/v1.27.2/charts/ztunnel/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.3/charts/ztunnel/files/profile-preview.yaml b/resources/v1.27.2/charts/ztunnel/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.3/charts/ztunnel/files/profile-preview.yaml
rename to resources/v1.27.2/charts/ztunnel/files/profile-preview.yaml
diff --git a/resources/v1.24.3/charts/ztunnel/files/profile-remote.yaml b/resources/v1.27.2/charts/ztunnel/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.3/charts/ztunnel/files/profile-remote.yaml
rename to resources/v1.27.2/charts/ztunnel/files/profile-remote.yaml
diff --git a/resources/v1.24.3/charts/ztunnel/files/profile-stable.yaml b/resources/v1.27.2/charts/ztunnel/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.3/charts/ztunnel/files/profile-stable.yaml
rename to resources/v1.27.2/charts/ztunnel/files/profile-stable.yaml
diff --git a/resources/v1.24.3/charts/ztunnel/templates/NOTES.txt b/resources/v1.27.2/charts/ztunnel/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.3/charts/ztunnel/templates/NOTES.txt
rename to resources/v1.27.2/charts/ztunnel/templates/NOTES.txt
diff --git a/resources/v1.27.2/charts/ztunnel/templates/_helpers.tpl b/resources/v1.27.2/charts/ztunnel/templates/_helpers.tpl
new file mode 100644
index 000000000..46a7a0b79
--- /dev/null
+++ b/resources/v1.27.2/charts/ztunnel/templates/_helpers.tpl
@@ -0,0 +1 @@
+{{ define "ztunnel.release-name" }}{{ .Values.resourceName| default "ztunnel" }}{{ end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/templates/daemonset.yaml b/resources/v1.27.2/charts/ztunnel/templates/daemonset.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/ztunnel/templates/daemonset.yaml
rename to resources/v1.27.2/charts/ztunnel/templates/daemonset.yaml
diff --git a/resources/v1.25.4/charts/ztunnel/templates/rbac.yaml b/resources/v1.27.2/charts/ztunnel/templates/rbac.yaml
similarity index 100%
rename from resources/v1.25.4/charts/ztunnel/templates/rbac.yaml
rename to resources/v1.27.2/charts/ztunnel/templates/rbac.yaml
diff --git a/resources/v1.27.2/charts/ztunnel/templates/resourcequota.yaml b/resources/v1.27.2/charts/ztunnel/templates/resourcequota.yaml
new file mode 100644
index 000000000..a1c0e5496
--- /dev/null
+++ b/resources/v1.27.2/charts/ztunnel/templates/resourcequota.yaml
@@ -0,0 +1,20 @@
+{{- if .Values.resourceQuotas.enabled }}
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
+spec:
+  hard:
+    pods: {{ .Values.resourceQuotas.pods | quote }}
+  scopeSelector:
+    matchExpressions:
+    - operator: In
+      scopeName: PriorityClass
+      values:
+      - system-node-critical
+{{- end }}
diff --git a/resources/v1.27.2/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.27.2/charts/ztunnel/templates/zzz_profile.yaml
new file mode 100644
index 000000000..606c55669
--- /dev/null
+++ b/resources/v1.27.2/charts/ztunnel/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if true }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.27.2/charts/ztunnel/values.yaml b/resources/v1.27.2/charts/ztunnel/values.yaml
new file mode 100644
index 000000000..2b44dda27
--- /dev/null
+++ b/resources/v1.27.2/charts/ztunnel/values.yaml
@@ -0,0 +1,128 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
+  hub: gcr.io/istio-release
+  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
+  tag: 1.27.2
+  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
+  variant: ""
+
+  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
+  # If Image contains a "/", it will replace the entire `image` in the pod.
+  image: ztunnel
+
+  # Same as `global.network`, but will override it if set.
+  # Network defines the network this cluster belong to. This name
+  # corresponds to the networks in the map of mesh networks.
+  network: ""
+
+  # resourceName, if set, will override the naming of resources. If not set, will default to 'ztunnel'.
+  # If you set this, you MUST also set `trustedZtunnelName` in the `istiod` chart.
+  resourceName: ""
+
+  # Labels to apply to all top level resources
+  labels: {}
+  # Annotations to apply to all top level resources
+  annotations: {}
+
+  # Additional volumeMounts to the ztunnel container
+  volumeMounts: []
+
+  # Additional volumes to the ztunnel pod
+  volumes: []
+  
+  # Tolerations for the ztunnel pod
+  tolerations:
+    - effect: NoSchedule
+      operator: Exists
+    - key: CriticalAddonsOnly
+      operator: Exists
+    - effect: NoExecute
+      operator: Exists
+
+  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
+  podAnnotations:
+    prometheus.io/port: "15020"
+    prometheus.io/scrape: "true"
+
+  # Additional labels to apply on the pod level
+  podLabels: {}
+
+  # Pod resource configuration
+  resources:
+    requests:
+      cpu: 200m
+      # Ztunnel memory scales with the size of the cluster and traffic load
+      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
+      memory: 512Mi
+
+  resourceQuotas:
+    enabled: false
+    pods: 5000
+
+  # List of secret names to add to the service account as image pull secrets
+  imagePullSecrets: []
+
+  # A `key: value` mapping of environment variables to add to the pod
+  env: {}
+
+  # Override for the pod imagePullPolicy
+  imagePullPolicy: ""
+
+  # Settings for multicluster
+  multiCluster:
+    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
+    # with Istiod configuration.
+    clusterName: ""
+
+  # meshConfig defines runtime configuration of components.
+  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
+  # components.
+  # TODO: https://github.com/istio/istio/issues/43248
+  meshConfig:
+    defaultConfig:
+      proxyMetadata: {}
+
+  # This value defines:
+  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
+  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
+  # Default K8S value is 30 seconds
+  terminationGracePeriodSeconds: 30
+
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
+  revision: ""
+
+  # The customized CA address to retrieve certificates for the pods in the cluster.
+  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+  caAddress: ""
+
+  # The customized XDS address to retrieve configuration.
+  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
+  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
+  xdsAddress: ""
+
+  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
+  istioNamespace: istio-system
+
+  # Configuration log level of ztunnel binary, default is info.
+  # Valid values are: trace, debug, info, warn, error
+  logLevel: info
+
+  # To output all logs in json format
+  logAsJson: false
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seLinuxOptions: {}
+  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
+  #seLinuxOptions:
+  #  type: spc_t
+
+  # K8s DaemonSet update strategy.
+  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
diff --git a/resources/v1.27.2/cni-1.27.2.tgz.etag b/resources/v1.27.2/cni-1.27.2.tgz.etag
new file mode 100644
index 000000000..02228775e
--- /dev/null
+++ b/resources/v1.27.2/cni-1.27.2.tgz.etag
@@ -0,0 +1 @@
+472746bd7177d6917f231a5477bb42c0
diff --git a/resources/v1.27.2/commit b/resources/v1.27.2/commit
new file mode 100644
index 000000000..457f03854
--- /dev/null
+++ b/resources/v1.27.2/commit
@@ -0,0 +1 @@
+1.27.2
diff --git a/resources/v1.27.2/gateway-1.27.2.tgz.etag b/resources/v1.27.2/gateway-1.27.2.tgz.etag
new file mode 100644
index 000000000..400c21e39
--- /dev/null
+++ b/resources/v1.27.2/gateway-1.27.2.tgz.etag
@@ -0,0 +1 @@
+f41b30a1ecd3f8eb5e98a3836bc278c0
diff --git a/resources/v1.27.2/istiod-1.27.2.tgz.etag b/resources/v1.27.2/istiod-1.27.2.tgz.etag
new file mode 100644
index 000000000..ce1391c25
--- /dev/null
+++ b/resources/v1.27.2/istiod-1.27.2.tgz.etag
@@ -0,0 +1 @@
+78abcde440e50316bdc1423cfc191c7b
diff --git a/resources/v1.24.3/profiles/ambient.yaml b/resources/v1.27.2/profiles/ambient.yaml
similarity index 100%
rename from resources/v1.24.3/profiles/ambient.yaml
rename to resources/v1.27.2/profiles/ambient.yaml
diff --git a/resources/v1.25.4/profiles/default.yaml b/resources/v1.27.2/profiles/default.yaml
similarity index 100%
rename from resources/v1.25.4/profiles/default.yaml
rename to resources/v1.27.2/profiles/default.yaml
diff --git a/resources/v1.24.3/profiles/demo.yaml b/resources/v1.27.2/profiles/demo.yaml
similarity index 100%
rename from resources/v1.24.3/profiles/demo.yaml
rename to resources/v1.27.2/profiles/demo.yaml
diff --git a/resources/v1.24.3/profiles/empty.yaml b/resources/v1.27.2/profiles/empty.yaml
similarity index 100%
rename from resources/v1.24.3/profiles/empty.yaml
rename to resources/v1.27.2/profiles/empty.yaml
diff --git a/resources/v1.24.3/profiles/openshift-ambient.yaml b/resources/v1.27.2/profiles/openshift-ambient.yaml
similarity index 100%
rename from resources/v1.24.3/profiles/openshift-ambient.yaml
rename to resources/v1.27.2/profiles/openshift-ambient.yaml
diff --git a/resources/v1.24.3/profiles/openshift.yaml b/resources/v1.27.2/profiles/openshift.yaml
similarity index 100%
rename from resources/v1.24.3/profiles/openshift.yaml
rename to resources/v1.27.2/profiles/openshift.yaml
diff --git a/resources/v1.24.3/profiles/preview.yaml b/resources/v1.27.2/profiles/preview.yaml
similarity index 100%
rename from resources/v1.24.3/profiles/preview.yaml
rename to resources/v1.27.2/profiles/preview.yaml
diff --git a/resources/v1.24.3/profiles/remote.yaml b/resources/v1.27.2/profiles/remote.yaml
similarity index 100%
rename from resources/v1.24.3/profiles/remote.yaml
rename to resources/v1.27.2/profiles/remote.yaml
diff --git a/resources/v1.24.3/profiles/stable.yaml b/resources/v1.27.2/profiles/stable.yaml
similarity index 100%
rename from resources/v1.24.3/profiles/stable.yaml
rename to resources/v1.27.2/profiles/stable.yaml
diff --git a/resources/v1.27.2/ztunnel-1.27.2.tgz.etag b/resources/v1.27.2/ztunnel-1.27.2.tgz.etag
new file mode 100644
index 000000000..b6a19afbe
--- /dev/null
+++ b/resources/v1.27.2/ztunnel-1.27.2.tgz.etag
@@ -0,0 +1 @@
+8c791fe726f190936c1d071b0d4f82f7
diff --git a/resources/v1.27.3/base-1.27.3.tgz.etag b/resources/v1.27.3/base-1.27.3.tgz.etag
new file mode 100644
index 000000000..1677b7998
--- /dev/null
+++ b/resources/v1.27.3/base-1.27.3.tgz.etag
@@ -0,0 +1 @@
+cce45283947bb5ef9df93c274ccf452e
diff --git a/resources/v1.27.3/charts/base/Chart.yaml b/resources/v1.27.3/charts/base/Chart.yaml
new file mode 100644
index 000000000..c5daa7c07
--- /dev/null
+++ b/resources/v1.27.3/charts/base/Chart.yaml
@@ -0,0 +1,10 @@
+apiVersion: v2
+appVersion: 1.27.3
+description: Helm chart for deploying Istio cluster resources and CRDs
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+name: base
+sources:
+- https://github.com/istio/istio
+version: 1.27.3
diff --git a/resources/v1.24.4/charts/base/README.md b/resources/v1.27.3/charts/base/README.md
similarity index 100%
rename from resources/v1.24.4/charts/base/README.md
rename to resources/v1.27.3/charts/base/README.md
diff --git a/resources/v1.27.3/charts/base/files/profile-ambient.yaml b/resources/v1.27.3/charts/base/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.27.3/charts/base/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.27.3/charts/base/files/profile-compatibility-version-1.24.yaml b/resources/v1.27.3/charts/base/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..4f3dbef7e
--- /dev/null
+++ b/resources/v1.27.3/charts/base/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,15 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.3/charts/base/files/profile-compatibility-version-1.25.yaml b/resources/v1.27.3/charts/base/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..b2f45948c
--- /dev/null
+++ b/resources/v1.27.3/charts/base/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.3/charts/base/files/profile-compatibility-version-1.26.yaml b/resources/v1.27.3/charts/base/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..af1069732
--- /dev/null
+++ b/resources/v1.27.3/charts/base/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
\ No newline at end of file
diff --git a/resources/v1.25.5/charts/base/files/profile-demo.yaml b/resources/v1.27.3/charts/base/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.5/charts/base/files/profile-demo.yaml
rename to resources/v1.27.3/charts/base/files/profile-demo.yaml
diff --git a/resources/v1.27.3/charts/base/files/profile-platform-gke.yaml b/resources/v1.27.3/charts/base/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.27.3/charts/base/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.4/charts/base/files/profile-platform-k3d.yaml b/resources/v1.27.3/charts/base/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.4/charts/base/files/profile-platform-k3d.yaml
rename to resources/v1.27.3/charts/base/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.5/charts/base/files/profile-platform-k3s.yaml b/resources/v1.27.3/charts/base/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.5/charts/base/files/profile-platform-k3s.yaml
rename to resources/v1.27.3/charts/base/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.4/charts/base/files/profile-platform-microk8s.yaml b/resources/v1.27.3/charts/base/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.4/charts/base/files/profile-platform-microk8s.yaml
rename to resources/v1.27.3/charts/base/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.4/charts/base/files/profile-platform-minikube.yaml b/resources/v1.27.3/charts/base/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.4/charts/base/files/profile-platform-minikube.yaml
rename to resources/v1.27.3/charts/base/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.4/charts/base/files/profile-platform-openshift.yaml b/resources/v1.27.3/charts/base/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.4/charts/base/files/profile-platform-openshift.yaml
rename to resources/v1.27.3/charts/base/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.4/charts/base/files/profile-preview.yaml b/resources/v1.27.3/charts/base/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.4/charts/base/files/profile-preview.yaml
rename to resources/v1.27.3/charts/base/files/profile-preview.yaml
diff --git a/resources/v1.24.4/charts/base/files/profile-remote.yaml b/resources/v1.27.3/charts/base/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.4/charts/base/files/profile-remote.yaml
rename to resources/v1.27.3/charts/base/files/profile-remote.yaml
diff --git a/resources/v1.24.4/charts/base/files/profile-stable.yaml b/resources/v1.27.3/charts/base/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.4/charts/base/files/profile-stable.yaml
rename to resources/v1.27.3/charts/base/files/profile-stable.yaml
diff --git a/resources/v1.24.4/charts/base/templates/NOTES.txt b/resources/v1.27.3/charts/base/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.4/charts/base/templates/NOTES.txt
rename to resources/v1.27.3/charts/base/templates/NOTES.txt
diff --git a/resources/v1.24.4/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml b/resources/v1.27.3/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
similarity index 100%
rename from resources/v1.24.4/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
rename to resources/v1.27.3/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
diff --git a/resources/v1.24.4/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml b/resources/v1.27.3/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
similarity index 100%
rename from resources/v1.24.4/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
rename to resources/v1.27.3/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
diff --git a/resources/v1.24.4/charts/base/templates/reader-serviceaccount.yaml b/resources/v1.27.3/charts/base/templates/reader-serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.4/charts/base/templates/reader-serviceaccount.yaml
rename to resources/v1.27.3/charts/base/templates/reader-serviceaccount.yaml
diff --git a/resources/v1.27.3/charts/base/templates/zzz_profile.yaml b/resources/v1.27.3/charts/base/templates/zzz_profile.yaml
new file mode 100644
index 000000000..3d8495648
--- /dev/null
+++ b/resources/v1.27.3/charts/base/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if false }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.25.5/charts/base/values.yaml b/resources/v1.27.3/charts/base/values.yaml
similarity index 100%
rename from resources/v1.25.5/charts/base/values.yaml
rename to resources/v1.27.3/charts/base/values.yaml
diff --git a/resources/v1.27.3/charts/cni/Chart.yaml b/resources/v1.27.3/charts/cni/Chart.yaml
new file mode 100644
index 000000000..73fcf4c7b
--- /dev/null
+++ b/resources/v1.27.3/charts/cni/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+appVersion: 1.27.3
+description: Helm chart for istio-cni components
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio-cni
+- istio
+name: cni
+sources:
+- https://github.com/istio/istio
+version: 1.27.3
diff --git a/resources/v1.24.4/charts/cni/README.md b/resources/v1.27.3/charts/cni/README.md
similarity index 100%
rename from resources/v1.24.4/charts/cni/README.md
rename to resources/v1.27.3/charts/cni/README.md
diff --git a/resources/v1.27.3/charts/cni/files/profile-ambient.yaml b/resources/v1.27.3/charts/cni/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.27.3/charts/cni/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.27.3/charts/cni/files/profile-compatibility-version-1.24.yaml b/resources/v1.27.3/charts/cni/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..4f3dbef7e
--- /dev/null
+++ b/resources/v1.27.3/charts/cni/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,15 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.3/charts/cni/files/profile-compatibility-version-1.25.yaml b/resources/v1.27.3/charts/cni/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..b2f45948c
--- /dev/null
+++ b/resources/v1.27.3/charts/cni/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.3/charts/cni/files/profile-compatibility-version-1.26.yaml b/resources/v1.27.3/charts/cni/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..af1069732
--- /dev/null
+++ b/resources/v1.27.3/charts/cni/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
\ No newline at end of file
diff --git a/resources/v1.25.5/charts/cni/files/profile-demo.yaml b/resources/v1.27.3/charts/cni/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.5/charts/cni/files/profile-demo.yaml
rename to resources/v1.27.3/charts/cni/files/profile-demo.yaml
diff --git a/resources/v1.27.3/charts/cni/files/profile-platform-gke.yaml b/resources/v1.27.3/charts/cni/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.27.3/charts/cni/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.4/charts/cni/files/profile-platform-k3d.yaml b/resources/v1.27.3/charts/cni/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.4/charts/cni/files/profile-platform-k3d.yaml
rename to resources/v1.27.3/charts/cni/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.5/charts/cni/files/profile-platform-k3s.yaml b/resources/v1.27.3/charts/cni/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.5/charts/cni/files/profile-platform-k3s.yaml
rename to resources/v1.27.3/charts/cni/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.4/charts/cni/files/profile-platform-microk8s.yaml b/resources/v1.27.3/charts/cni/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.4/charts/cni/files/profile-platform-microk8s.yaml
rename to resources/v1.27.3/charts/cni/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.4/charts/cni/files/profile-platform-minikube.yaml b/resources/v1.27.3/charts/cni/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.4/charts/cni/files/profile-platform-minikube.yaml
rename to resources/v1.27.3/charts/cni/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.4/charts/cni/files/profile-platform-openshift.yaml b/resources/v1.27.3/charts/cni/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.4/charts/cni/files/profile-platform-openshift.yaml
rename to resources/v1.27.3/charts/cni/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.4/charts/cni/files/profile-preview.yaml b/resources/v1.27.3/charts/cni/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.4/charts/cni/files/profile-preview.yaml
rename to resources/v1.27.3/charts/cni/files/profile-preview.yaml
diff --git a/resources/v1.24.4/charts/cni/files/profile-remote.yaml b/resources/v1.27.3/charts/cni/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.4/charts/cni/files/profile-remote.yaml
rename to resources/v1.27.3/charts/cni/files/profile-remote.yaml
diff --git a/resources/v1.24.4/charts/cni/files/profile-stable.yaml b/resources/v1.27.3/charts/cni/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.4/charts/cni/files/profile-stable.yaml
rename to resources/v1.27.3/charts/cni/files/profile-stable.yaml
diff --git a/resources/v1.24.4/charts/cni/templates/NOTES.txt b/resources/v1.27.3/charts/cni/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.4/charts/cni/templates/NOTES.txt
rename to resources/v1.27.3/charts/cni/templates/NOTES.txt
diff --git a/resources/v1.24.4/charts/cni/templates/_helpers.tpl b/resources/v1.27.3/charts/cni/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.4/charts/cni/templates/_helpers.tpl
rename to resources/v1.27.3/charts/cni/templates/_helpers.tpl
diff --git a/resources/v1.25.5/charts/cni/templates/clusterrole.yaml b/resources/v1.27.3/charts/cni/templates/clusterrole.yaml
similarity index 100%
rename from resources/v1.25.5/charts/cni/templates/clusterrole.yaml
rename to resources/v1.27.3/charts/cni/templates/clusterrole.yaml
diff --git a/resources/v1.24.4/charts/cni/templates/clusterrolebinding.yaml b/resources/v1.27.3/charts/cni/templates/clusterrolebinding.yaml
similarity index 100%
rename from resources/v1.24.4/charts/cni/templates/clusterrolebinding.yaml
rename to resources/v1.27.3/charts/cni/templates/clusterrolebinding.yaml
diff --git a/resources/v1.27.3/charts/cni/templates/configmap-cni.yaml b/resources/v1.27.3/charts/cni/templates/configmap-cni.yaml
new file mode 100644
index 000000000..6f6ef329a
--- /dev/null
+++ b/resources/v1.27.3/charts/cni/templates/configmap-cni.yaml
@@ -0,0 +1,41 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: {{ template "name" . }}-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "name" . }}
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+  CURRENT_AGENT_VERSION: {{ .Values.tag | default .Values.global.tag | quote }}
+  AMBIENT_ENABLED: {{ .Values.ambient.enabled | quote }}
+  AMBIENT_ENABLEMENT_SELECTOR: {{ .Values.ambient.enablementSelectors | toYaml | quote }}
+  AMBIENT_DNS_CAPTURE: {{ .Values.ambient.dnsCapture | quote  }}
+  AMBIENT_IPV6: {{ .Values.ambient.ipv6 | quote }}
+  AMBIENT_RECONCILE_POD_RULES_ON_STARTUP: {{ .Values.ambient.reconcileIptablesOnStartup | quote }}
+  {{- if .Values.cniConfFileName }} # K8S < 1.24 doesn't like empty values
+  CNI_CONF_NAME: {{ .Values.cniConfFileName }} # Name of the CNI config file to create. Only override if you know the exact path your CNI requires..
+  {{- end }}
+  ISTIO_OWNED_CNI_CONFIG: {{ .Values.istioOwnedCNIConfig | quote }}
+  {{- if .Values.istioOwnedCNIConfig }}
+  ISTIO_OWNED_CNI_CONF_FILENAME: {{ .Values.istioOwnedCNIConfigFileName | quote }}
+  {{- end }}
+  CHAINED_CNI_PLUGIN: {{ .Values.chained | quote }}
+  EXCLUDE_NAMESPACES: "{{ range $idx, $ns := .Values.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
+  REPAIR_ENABLED: {{ .Values.repair.enabled | quote }}
+  REPAIR_LABEL_PODS: {{ .Values.repair.labelPods | quote }}
+  REPAIR_DELETE_PODS: {{ .Values.repair.deletePods | quote }}
+  REPAIR_REPAIR_PODS: {{ .Values.repair.repairPods | quote }}
+  REPAIR_INIT_CONTAINER_NAME: {{ .Values.repair.initContainerName | quote }}
+  REPAIR_BROKEN_POD_LABEL_KEY: {{ .Values.repair.brokenPodLabelKey | quote }}
+  REPAIR_BROKEN_POD_LABEL_VALUE: {{ .Values.repair.brokenPodLabelValue | quote }}
+  NATIVE_NFTABLES: {{ .Values.global.nativeNftables | quote }}
+  {{- with .Values.env }}
+  {{- range $key, $val := . }}
+  {{ $key }}: "{{ $val }}"
+  {{- end }}
+  {{- end }}
diff --git a/resources/v1.27.3/charts/cni/templates/daemonset.yaml b/resources/v1.27.3/charts/cni/templates/daemonset.yaml
new file mode 100644
index 000000000..896de3d03
--- /dev/null
+++ b/resources/v1.27.3/charts/cni/templates/daemonset.yaml
@@ -0,0 +1,248 @@
+# This manifest installs the Istio install-cni container, as well
+# as the Istio CNI plugin and config on
+# each master and worker node in a Kubernetes cluster.
+#
+# $detectedBinDir exists to support a GKE-specific platform override,
+# and is deprecated in favor of using the explicit `gke` platform profile.
+{{- $detectedBinDir := (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
+    "/home/kubernetes/bin"
+    "/opt/cni/bin"
+}}
+{{- if .Values.cniBinDir }}
+{{ $detectedBinDir = .Values.cniBinDir }}
+{{- end }}
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  # Note that this is templated but evaluates to a fixed name
+  # which the CNI plugin may fall back onto in some failsafe scenarios.
+  # if this name is changed, CNI plugin logic that checks for this name
+  # format should also be updated.
+  name: {{ template "name" . }}-node
+  namespace: {{ .Release.Namespace }}
+  labels:
+    k8s-app: {{ template "name" . }}-node
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      k8s-app: {{ template "name" . }}-node
+  {{- with .Values.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  template:
+    metadata:
+      labels:
+        k8s-app: {{ template "name" . }}-node
+        sidecar.istio.io/inject: "false"
+        istio.io/dataplane-mode: none
+        app.kubernetes.io/name: {{ template "name" . }}
+        {{- include "istio.labels" . | nindent 8 }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+        # Add Prometheus Scrape annotations
+        prometheus.io/scrape: 'true'
+        prometheus.io/port: "15014"
+        prometheus.io/path: '/metrics'
+        # Add AppArmor annotation
+        # This is required to avoid conflicts with AppArmor profiles which block certain
+        # privileged pod capabilities.
+        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
+        # securityContext which is otherwise preferred.
+        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
+        # Custom annotations
+        {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+        {{- end }}
+    spec:
+{{- if and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace }}
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+{{- end }}
+      nodeSelector:
+        kubernetes.io/os: linux
+      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      priorityClassName: system-node-critical
+      serviceAccountName: {{ template "name" . }}
+      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
+      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
+      terminationGracePeriodSeconds: 5
+      containers:
+        # This container installs the Istio CNI binaries
+        # and CNI network config file on each node.
+        - name: install-cni
+{{- if contains "/" .Values.image }}
+          image: "{{ .Values.image }}"
+{{- else }}
+          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
+{{- end }}
+{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
+          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
+{{- end }}
+          ports:
+          - containerPort: 15014
+            name: metrics
+            protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8000
+          securityContext:
+            privileged: false
+            runAsGroup: 0
+            runAsUser: 0
+            runAsNonRoot: false
+            # Both ambient and sidecar repair mode require elevated node privileges to function.
+            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
+            # add capabilities based on feature.
+            capabilities:
+              drop:
+              - ALL
+              add:
+              # CAP_NET_ADMIN is required to allow ipset and route table access
+              - NET_ADMIN
+              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
+              - NET_RAW
+              # CAP_SYS_PTRACE is required for repair and ambient mode to describe
+              # the pod's network namespace.
+              - SYS_PTRACE
+              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
+              # network namespaces in `/proc` to obtain descriptors for entering pod network
+              # namespaces. There does not appear to be a more granular capability for this.
+              - SYS_ADMIN
+              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
+              # the typical ability to read/write to folders owned by others.
+              # This can cause problems if the hostPath mounts we use, which we require write access into,
+              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
+              - DAC_OVERRIDE
+{{- if .Values.seLinuxOptions }}
+{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
+            seLinuxOptions:
+{{ toYaml . | trim | indent 14 }}
+{{- end }}
+{{- end }}
+{{- if .Values.seccompProfile }}
+            seccompProfile:
+{{ toYaml .Values.seccompProfile | trim | indent 14 }}
+{{- end }}
+          command: ["install-cni"]
+          args:
+            {{- if or .Values.logging.level .Values.global.logging.level }}
+            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
+            {{- end}}
+            {{- if .Values.global.logAsJson }}
+            - --log_as_json
+            {{- end}}
+          envFrom:
+            - configMapRef:
+                name: {{ template "name" . }}-config
+          env:
+            - name: REPAIR_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: REPAIR_RUN_AS_DAEMON
+              value: "true"
+            - name: REPAIR_SIDECAR_ANNOTATION
+              value: "sidecar.istio.io/status"
+            {{- if not (and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace) }}
+            - name: ALLOW_SWITCH_TO_HOST_NS
+              value: "true"
+            {{- end }}
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+            - name: GOMEMLIMIT
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.memory
+                  divisor: '1'
+            - name: GOMAXPROCS
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.cpu
+                  divisor: '1'
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            {{- if .Values.env }}
+            {{- range $key, $val := .Values.env }}
+            - name: {{ $key }}
+              value: "{{ $val }}"
+            {{- end }}
+            {{- end }}
+          volumeMounts:
+            - mountPath: /host/opt/cni/bin
+              name: cni-bin-dir
+            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
+            - mountPath: /host/proc
+              name: cni-host-procfs
+              readOnly: true
+            {{- end }}
+            - mountPath: /host/etc/cni/net.d
+              name: cni-net-dir
+            - mountPath: /var/run/istio-cni
+              name: cni-socket-dir
+            {{- if .Values.ambient.enabled }}
+            - mountPath: /host/var/run/netns
+              mountPropagation: HostToContainer
+              name: cni-netns-dir
+            - mountPath: /var/run/ztunnel
+              name: cni-ztunnel-sock-dir
+            {{ end }}
+          resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 12 }}
+{{- else }}
+{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
+{{- end }}
+      volumes:
+        # Used to install CNI.
+        - name: cni-bin-dir
+          hostPath:
+            path: {{ $detectedBinDir }}
+        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
+        - name: cni-host-procfs
+          hostPath:
+            path: /proc
+            type: Directory
+        {{- end }}
+        {{- if .Values.ambient.enabled }}
+        - name: cni-ztunnel-sock-dir
+          hostPath:
+            path: /var/run/ztunnel
+            type: DirectoryOrCreate
+        {{- end }}
+        - name: cni-net-dir
+          hostPath:
+            path: {{ .Values.cniConfDir }}
+        # Used for UDS sockets for logging, ambient eventing
+        - name: cni-socket-dir
+          hostPath:
+            path: /var/run/istio-cni
+        - name: cni-netns-dir
+          hostPath:
+            path: {{ .Values.cniNetnsDir }}
+            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
+            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
+            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.24.4/charts/cni/templates/network-attachment-definition.yaml b/resources/v1.27.3/charts/cni/templates/network-attachment-definition.yaml
similarity index 100%
rename from resources/v1.24.4/charts/cni/templates/network-attachment-definition.yaml
rename to resources/v1.27.3/charts/cni/templates/network-attachment-definition.yaml
diff --git a/resources/v1.24.4/charts/cni/templates/resourcequota.yaml b/resources/v1.27.3/charts/cni/templates/resourcequota.yaml
similarity index 100%
rename from resources/v1.24.4/charts/cni/templates/resourcequota.yaml
rename to resources/v1.27.3/charts/cni/templates/resourcequota.yaml
diff --git a/resources/v1.24.4/charts/cni/templates/serviceaccount.yaml b/resources/v1.27.3/charts/cni/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.4/charts/cni/templates/serviceaccount.yaml
rename to resources/v1.27.3/charts/cni/templates/serviceaccount.yaml
diff --git a/resources/v1.24.4/charts/cni/templates/zzy_descope_legacy.yaml b/resources/v1.27.3/charts/cni/templates/zzy_descope_legacy.yaml
similarity index 100%
rename from resources/v1.24.4/charts/cni/templates/zzy_descope_legacy.yaml
rename to resources/v1.27.3/charts/cni/templates/zzy_descope_legacy.yaml
diff --git a/resources/v1.27.3/charts/cni/templates/zzz_profile.yaml b/resources/v1.27.3/charts/cni/templates/zzz_profile.yaml
new file mode 100644
index 000000000..3d8495648
--- /dev/null
+++ b/resources/v1.27.3/charts/cni/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if false }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.27.3/charts/cni/values.yaml b/resources/v1.27.3/charts/cni/values.yaml
new file mode 100644
index 000000000..05415625c
--- /dev/null
+++ b/resources/v1.27.3/charts/cni/values.yaml
@@ -0,0 +1,178 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  hub: ""
+  tag: ""
+  variant: ""
+  image: install-cni
+  pullPolicy: ""
+
+  # Same as `global.logging.level`, but will override it if set
+  logging:
+    level: ""
+
+  # Configuration file to insert istio-cni plugin configuration
+  # by default this will be the first file found in the cni-conf-dir
+  # Example
+  # cniConfFileName: 10-calico.conflist
+
+  # CNI-and-platform specific path defaults.
+  # These may need to be set to platform-specific values, consult
+  # overrides for your platform in `manifests/helm-profiles/platform-*.yaml`
+  cniBinDir: /opt/cni/bin
+  cniConfDir: /etc/cni/net.d
+  cniConfFileName: ""
+  cniNetnsDir: "/var/run/netns"
+
+  # If Istio owned CNI config is enabled, defaults to 02-istio-cni.conflist
+  istioOwnedCNIConfigFileName: "" 
+  istioOwnedCNIConfig: false
+
+  excludeNamespaces:
+    - kube-system
+
+  # Allows user to set custom affinity for the DaemonSet
+  affinity: {}
+
+  # Custom annotations on pod level, if you need them
+  podAnnotations: {}
+
+  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
+  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
+  chained: true
+
+  # Custom configuration happens based on the CNI provider.
+  # Possible values: "default", "multus"
+  provider: "default"
+
+  # Configure ambient settings
+  ambient:
+    # If enabled, ambient redirection will be enabled
+    enabled: false
+    # If ambient is enabled, this selector will be used to identify the ambient-enabled pods
+    enablementSelectors: 
+    - podSelector:
+        matchLabels: {istio.io/dataplane-mode: ambient}
+    - podSelector:
+        matchExpressions:
+        - { key: istio.io/dataplane-mode, operator: NotIn, values: [none] }
+      namespaceSelector:
+        matchLabels: {istio.io/dataplane-mode: ambient}
+    # Set ambient config dir path: defaults to /etc/ambient-config
+    configDir: ""
+    # If enabled, and ambient is enabled, DNS redirection will be enabled
+    dnsCapture: true
+    # If enabled, and ambient is enabled, enables ipv6 support
+    ipv6: true
+    # If enabled, and ambient is enabled, the CNI agent will reconcile incompatible iptables rules and chains at startup.
+    # This will eventually be enabled by default
+    reconcileIptablesOnStartup: false
+    # If enabled, and ambient is enabled, the CNI agent will always share the network namespace of the host node it is running on
+    shareHostNetworkNamespace: false
+
+
+  repair:
+    enabled: true
+    hub: ""
+    tag: ""
+
+    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
+    # This defines the action the controller will take when a pod is detected as broken.
+
+    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
+    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
+    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
+    labelPods: false
+    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
+    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
+    deletePods: false
+    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
+    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
+    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
+    repairPods: true
+
+    initContainerName: "istio-validation"
+
+    brokenPodLabelKey: "cni.istio.io/uninitialized"
+    brokenPodLabelValue: "true"
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
+  seLinuxOptions: {}
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 100Mi
+
+  resourceQuotas:
+    enabled: false
+    pods: 5000
+
+  tolerations:
+    # Make sure istio-cni-node gets scheduled on all nodes.
+    - effect: NoSchedule
+      operator: Exists
+    # Mark the pod as a critical add-on for rescheduling.
+    - key: CriticalAddonsOnly
+      operator: Exists
+    - effect: NoExecute
+      operator: Exists
+
+  # K8s DaemonSet update strategy.
+  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  global:
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+
+    # Default tag for Istio images.
+    tag: 1.27.3
+
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # change cni scope level to control logging out of istio-cni-node DaemonSet
+    logging:
+      level: info
+
+    logAsJson: false
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Default resources allocated
+    defaultResources:
+      requests:
+        cpu: 100m
+        memory: 100Mi
+
+    # In order to use native nftable rules instead of iptable rules, set this flag to true.
+    nativeNftables: false
+
+  # A `key: value` mapping of environment variables to add to the pod
+  env: {}
diff --git a/resources/v1.27.3/charts/gateway/Chart.yaml b/resources/v1.27.3/charts/gateway/Chart.yaml
new file mode 100644
index 000000000..b806d5017
--- /dev/null
+++ b/resources/v1.27.3/charts/gateway/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+appVersion: 1.27.3
+description: Helm chart for deploying Istio gateways
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+- gateways
+name: gateway
+sources:
+- https://github.com/istio/istio
+type: application
+version: 1.27.3
diff --git a/resources/v1.24.4/charts/gateway/README.md b/resources/v1.27.3/charts/gateway/README.md
similarity index 100%
rename from resources/v1.24.4/charts/gateway/README.md
rename to resources/v1.27.3/charts/gateway/README.md
diff --git a/resources/v1.27.3/charts/gateway/files/profile-ambient.yaml b/resources/v1.27.3/charts/gateway/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.27.3/charts/gateway/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.27.3/charts/gateway/files/profile-compatibility-version-1.24.yaml b/resources/v1.27.3/charts/gateway/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..4f3dbef7e
--- /dev/null
+++ b/resources/v1.27.3/charts/gateway/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,15 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.3/charts/gateway/files/profile-compatibility-version-1.25.yaml b/resources/v1.27.3/charts/gateway/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..b2f45948c
--- /dev/null
+++ b/resources/v1.27.3/charts/gateway/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.3/charts/gateway/files/profile-compatibility-version-1.26.yaml b/resources/v1.27.3/charts/gateway/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..af1069732
--- /dev/null
+++ b/resources/v1.27.3/charts/gateway/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
\ No newline at end of file
diff --git a/resources/v1.25.5/charts/gateway/files/profile-demo.yaml b/resources/v1.27.3/charts/gateway/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.5/charts/gateway/files/profile-demo.yaml
rename to resources/v1.27.3/charts/gateway/files/profile-demo.yaml
diff --git a/resources/v1.27.3/charts/gateway/files/profile-platform-gke.yaml b/resources/v1.27.3/charts/gateway/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.27.3/charts/gateway/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.4/charts/gateway/files/profile-platform-k3d.yaml b/resources/v1.27.3/charts/gateway/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.4/charts/gateway/files/profile-platform-k3d.yaml
rename to resources/v1.27.3/charts/gateway/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.5/charts/gateway/files/profile-platform-k3s.yaml b/resources/v1.27.3/charts/gateway/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.5/charts/gateway/files/profile-platform-k3s.yaml
rename to resources/v1.27.3/charts/gateway/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.4/charts/gateway/files/profile-platform-microk8s.yaml b/resources/v1.27.3/charts/gateway/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.4/charts/gateway/files/profile-platform-microk8s.yaml
rename to resources/v1.27.3/charts/gateway/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.4/charts/gateway/files/profile-platform-minikube.yaml b/resources/v1.27.3/charts/gateway/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.4/charts/gateway/files/profile-platform-minikube.yaml
rename to resources/v1.27.3/charts/gateway/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.4/charts/gateway/files/profile-platform-openshift.yaml b/resources/v1.27.3/charts/gateway/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.4/charts/gateway/files/profile-platform-openshift.yaml
rename to resources/v1.27.3/charts/gateway/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.4/charts/gateway/files/profile-preview.yaml b/resources/v1.27.3/charts/gateway/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.4/charts/gateway/files/profile-preview.yaml
rename to resources/v1.27.3/charts/gateway/files/profile-preview.yaml
diff --git a/resources/v1.24.4/charts/gateway/files/profile-remote.yaml b/resources/v1.27.3/charts/gateway/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.4/charts/gateway/files/profile-remote.yaml
rename to resources/v1.27.3/charts/gateway/files/profile-remote.yaml
diff --git a/resources/v1.24.4/charts/gateway/files/profile-stable.yaml b/resources/v1.27.3/charts/gateway/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.4/charts/gateway/files/profile-stable.yaml
rename to resources/v1.27.3/charts/gateway/files/profile-stable.yaml
diff --git a/resources/v1.24.4/charts/gateway/templates/NOTES.txt b/resources/v1.27.3/charts/gateway/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.4/charts/gateway/templates/NOTES.txt
rename to resources/v1.27.3/charts/gateway/templates/NOTES.txt
diff --git a/resources/v1.24.4/charts/gateway/templates/_helpers.tpl b/resources/v1.27.3/charts/gateway/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.4/charts/gateway/templates/_helpers.tpl
rename to resources/v1.27.3/charts/gateway/templates/_helpers.tpl
diff --git a/resources/v1.27.3/charts/gateway/templates/deployment.yaml b/resources/v1.27.3/charts/gateway/templates/deployment.yaml
new file mode 100644
index 000000000..1d8f93a47
--- /dev/null
+++ b/resources/v1.27.3/charts/gateway/templates/deployment.yaml
@@ -0,0 +1,145 @@
+apiVersion: apps/v1
+kind: {{ .Values.kind | default "Deployment" }}
+metadata:
+  name: {{ include "gateway.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "gateway.name" . }}
+    {{- include "istio.labels" . | nindent 4}}
+    {{- include "gateway.labels" . | nindent 4}}
+  annotations:
+    {{- .Values.annotations | toYaml | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  {{- if and (hasKey .Values "replicaCount") (ne .Values.replicaCount nil) }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  {{- end }}
+  {{- with .Values.strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.minReadySeconds }}
+  minReadySeconds: {{ . }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "gateway.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
+        {{- include "gateway.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/name: {{ include "gateway.name" . }}
+        {{- include "istio.labels" .  | nindent 8}}
+        {{- range $key, $val := .Values.labels }}
+        {{- if and (ne $key "app") (ne $key "istio") }}
+        {{ $key | quote }}: {{ $val | quote }}
+        {{- end }}
+        {{- end }}
+        {{- with .Values.networkGateway }}
+        topology.istio.io/network: "{{.}}"
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
+      securityContext:
+      {{- if .Values.securityContext }}
+        {{- toYaml .Values.securityContext | nindent 8 }}
+      {{- else }}
+        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
+        sysctls:
+        - name: net.ipv4.ip_unprivileged_port_start
+          value: "0"
+      {{- end }}
+      {{- with .Values.volumes }}
+      volumes:
+        {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.initContainers }}
+      initContainers:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: istio-proxy
+          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
+          image: auto
+          {{- with .Values.imagePullPolicy }}
+          imagePullPolicy: {{ . }}
+          {{- end }}
+          securityContext:
+          {{- if .Values.containerSecurityContext }}
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          {{- else }}
+            capabilities:
+              drop:
+              - ALL
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: true
+            {{- if not (eq (.Values.platform | default "") "openshift") }}
+            runAsUser: 1337
+            runAsGroup: 1337
+            {{- end }}
+            runAsNonRoot: true
+          {{- end }}
+          env:
+          {{- with .Values.networkGateway }}
+          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
+            value: "{{.}}"
+          {{- end }}
+          {{- range $key, $val := .Values.env }}
+          - name: {{ $key }}
+            value: {{ $val | quote }}
+          {{- end }}
+          {{- with .Values.envVarFrom }}
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+          ports:
+          - containerPort: 15090
+            protocol: TCP
+            name: http-envoy-prom
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          {{- with .Values.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.lifecycle }}
+          lifecycle:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.additionalContainers }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
+      {{- with .Values.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
diff --git a/resources/v1.24.4/charts/gateway/templates/hpa.yaml b/resources/v1.27.3/charts/gateway/templates/hpa.yaml
similarity index 100%
rename from resources/v1.24.4/charts/gateway/templates/hpa.yaml
rename to resources/v1.27.3/charts/gateway/templates/hpa.yaml
diff --git a/resources/v1.24.4/charts/gateway/templates/poddisruptionbudget.yaml b/resources/v1.27.3/charts/gateway/templates/poddisruptionbudget.yaml
similarity index 100%
rename from resources/v1.24.4/charts/gateway/templates/poddisruptionbudget.yaml
rename to resources/v1.27.3/charts/gateway/templates/poddisruptionbudget.yaml
diff --git a/resources/v1.24.4/charts/gateway/templates/role.yaml b/resources/v1.27.3/charts/gateway/templates/role.yaml
similarity index 100%
rename from resources/v1.24.4/charts/gateway/templates/role.yaml
rename to resources/v1.27.3/charts/gateway/templates/role.yaml
diff --git a/resources/v1.27.3/charts/gateway/templates/service.yaml b/resources/v1.27.3/charts/gateway/templates/service.yaml
new file mode 100644
index 000000000..3e28418f7
--- /dev/null
+++ b/resources/v1.27.3/charts/gateway/templates/service.yaml
@@ -0,0 +1,69 @@
+{{- if not (eq .Values.service.type "None") }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "gateway.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "gateway.name" . }}
+    {{- include "istio.labels" . | nindent 4}}
+    {{- include "gateway.labels" . | nindent 4 }}
+    {{- with .Values.networkGateway }}
+    topology.istio.io/network: "{{.}}"
+    {{- end }}
+  annotations:
+    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
+spec:
+{{- with .Values.service.loadBalancerIP }}
+  loadBalancerIP: "{{ . }}"
+{{- end }}
+{{- if eq .Values.service.type "LoadBalancer" }}
+  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
+  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
+  {{- end }}
+  {{- if hasKey .Values.service "loadBalancerClass" }}
+  loadBalancerClass: {{ .Values.service.loadBalancerClass }}
+  {{- end }}
+{{- end }}
+{{- if .Values.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
+{{- end }}
+{{- if .Values.service.ipFamilies }}
+  ipFamilies:
+{{- range .Values.service.ipFamilies }}
+  - {{ . }}
+{{- end }}
+{{- end }}
+{{- with .Values.service.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+{{ toYaml . | indent 4 }}
+{{- end }}
+{{- with .Values.service.externalTrafficPolicy }}
+  externalTrafficPolicy: "{{ . }}"
+{{- end }}
+  type: {{ .Values.service.type }}
+  ports:
+{{- if .Values.networkGateway }}
+  - name: status-port
+    port: 15021
+    targetPort: 15021
+  - name: tls
+    port: 15443
+    targetPort: 15443
+  - name: tls-istiod
+    port: 15012
+    targetPort: 15012
+  - name: tls-webhook
+    port: 15017
+    targetPort: 15017
+{{- else }}
+{{ .Values.service.ports | toYaml | indent 4 }}
+{{- end }}
+{{- if .Values.service.externalIPs }}
+  externalIPs: {{- range .Values.service.externalIPs }}
+    - {{.}}
+  {{- end }}
+{{- end }}
+  selector:
+    {{- include "gateway.selectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/resources/v1.24.4/charts/gateway/templates/serviceaccount.yaml b/resources/v1.27.3/charts/gateway/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.4/charts/gateway/templates/serviceaccount.yaml
rename to resources/v1.27.3/charts/gateway/templates/serviceaccount.yaml
diff --git a/resources/v1.27.3/charts/gateway/templates/zzz_profile.yaml b/resources/v1.27.3/charts/gateway/templates/zzz_profile.yaml
new file mode 100644
index 000000000..606c55669
--- /dev/null
+++ b/resources/v1.27.3/charts/gateway/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if true }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.27.3/charts/gateway/values.schema.json b/resources/v1.27.3/charts/gateway/values.schema.json
new file mode 100644
index 000000000..bcbb30ccc
--- /dev/null
+++ b/resources/v1.27.3/charts/gateway/values.schema.json
@@ -0,0 +1,353 @@
+{
+  "$schema": "http://json-schema.org/schema#",
+  "$defs": {
+    "values": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "_internal_defaults_do_not_set": {
+          "type": "object"
+        },
+        "global": {
+          "type": "object"
+        },
+        "affinity": {
+          "type": "object"
+        },
+        "securityContext": {
+          "type": [
+            "object",
+            "null"
+          ]
+        },
+        "containerSecurityContext": {
+          "type": [
+            "object",
+            "null"
+          ]
+        },
+        "kind": {
+          "type": "string",
+          "enum": [
+            "Deployment",
+            "DaemonSet"
+          ]
+        },
+        "annotations": {
+          "additionalProperties": {
+            "type": [
+              "string",
+              "integer"
+            ]
+          },
+          "type": "object"
+        },
+        "autoscaling": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            },
+            "maxReplicas": {
+              "type": "integer"
+            },
+            "minReplicas": {
+              "type": "integer"
+            },
+            "targetCPUUtilizationPercentage": {
+              "type": "integer"
+            }
+          }
+        },
+        "env": {
+          "type": "object"
+        },
+        "envVarFrom": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": { "type": "string" },
+              "valueFrom": { "type": "object" }
+            }
+          }
+        },
+        "strategy": {
+          "type": "object"
+        },
+        "minReadySeconds": {
+          "type": [ "null", "integer" ]
+        },
+        "readinessProbe": {
+          "type": [ "null", "object" ]
+        },
+        "labels": {
+          "type": "object"
+        },
+        "name": {
+          "type": "string"
+        },
+        "nodeSelector": {
+          "type": "object"
+        },
+        "podAnnotations": {
+          "type": "object",
+          "properties": {
+            "inject.istio.io/templates": {
+              "type": "string"
+            },
+            "prometheus.io/path": {
+              "type": "string"
+            },
+            "prometheus.io/port": {
+              "type": "string"
+            },
+            "prometheus.io/scrape": {
+              "type": "string"
+            }
+          }
+        },
+        "replicaCount": {
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "resources": {
+          "type": "object",
+          "properties": {
+            "limits": {
+              "type": "object",
+              "properties": {
+                "cpu": {
+                  "type": ["string", "null"]
+                },
+                "memory": {
+                  "type": ["string", "null"]
+                }
+              }
+            },
+            "requests": {
+              "type": "object",
+              "properties": {
+                "cpu": {
+                  "type": ["string", "null"]
+                },
+                "memory": {
+                  "type": ["string", "null"]
+                }
+              }
+            }
+          }
+        },
+        "revision": {
+          "type": "string"
+        },
+        "defaultRevision": {
+          "type": "string"
+        },
+        "compatibilityVersion": {
+          "type": "string"
+        },
+        "profile": {
+          "type": "string"
+        },
+        "platform": {
+          "type": "string"
+        },
+        "pilot": {
+          "type": "object"
+        },
+        "runAsRoot": {
+          "type": "boolean"
+        },
+        "unprivilegedPort": {
+          "type": [
+            "string",
+            "boolean"
+          ],
+          "enum": [
+            true,
+            false,
+            "auto"
+          ]
+        },
+        "service": {
+          "type": "object",
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "externalTrafficPolicy": {
+              "type": "string"
+            },
+            "loadBalancerIP": {
+              "type": "string"
+            },
+            "loadBalancerSourceRanges": {
+              "type": "array"
+            },
+            "ipFamilies": {
+              "items": {
+                "type": "string",
+                "enum": [
+                  "IPv4",
+                  "IPv6"
+                ]
+              }
+            },
+            "ipFamilyPolicy": {
+              "type": "string",
+              "enum": [
+                "",
+                "SingleStack",
+                "PreferDualStack",
+                "RequireDualStack"
+              ]
+            },
+            "ports": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string"
+                  },
+                  "port": {
+                    "type": "integer"
+                  },
+                  "protocol": {
+                    "type": "string"
+                  },
+                  "targetPort": {
+                    "type": "integer"
+                  }
+                }
+              }
+            },
+            "type": {
+              "type": "string"
+            }
+          }
+        },
+        "serviceAccount": {
+          "type": "object",
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "name": {
+              "type": "string"
+            },
+            "create": {
+              "type": "boolean"
+            }
+          }
+        },
+        "rbac": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            }
+          }
+        },
+        "tolerations": {
+          "type": "array"
+        },
+        "topologySpreadConstraints": {
+          "type": "array"
+        },
+        "networkGateway": {
+          "type": "string"
+        },
+        "imagePullPolicy": {
+          "type": "string",
+          "enum": [
+            "",
+            "Always",
+            "IfNotPresent",
+            "Never"
+          ]
+        },
+        "imagePullSecrets": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "podDisruptionBudget": {
+          "type": "object",
+          "properties": {
+            "minAvailable": {
+              "type": [
+                "integer",
+                "string"
+              ]
+            },
+            "maxUnavailable": {
+              "type": [
+                "integer",
+                "string"
+              ]
+            },
+            "unhealthyPodEvictionPolicy": {
+              "type": "string",
+              "enum": [
+                "",
+                "IfHealthyBudget",
+                "AlwaysAllow"
+              ]
+            }
+          }
+        },
+        "terminationGracePeriodSeconds": {
+          "type": "number"
+        },
+        "volumes": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "volumeMounts": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "initContainers": {
+          "type": "array",
+          "items": { "type": "object" }
+        },
+        "additionalContainers": {
+          "type": "array",
+          "items": { "type": "object" }
+        },
+        "priorityClassName": {
+          "type": "string"
+        },
+        "lifecycle": {
+          "type": "object",
+          "properties": {
+            "postStart": {
+              "type": "object"
+            },
+            "preStop": {
+              "type": "object"
+            }
+          }
+        }
+      }
+    }
+  },
+  "defaults": {
+    "$ref": "#/$defs/values"
+  },
+  "$ref": "#/$defs/values"
+}
diff --git a/resources/v1.27.3/charts/gateway/values.yaml b/resources/v1.27.3/charts/gateway/values.yaml
new file mode 100644
index 000000000..c0147ce21
--- /dev/null
+++ b/resources/v1.27.3/charts/gateway/values.yaml
@@ -0,0 +1,192 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  # Name allows overriding the release name. Generally this should not be set
+  name: ""
+  # revision declares which revision this gateway is a part of
+  revision: ""
+
+  # Controls the spec.replicas setting for the Gateway deployment if set.
+  # Otherwise defaults to Kubernetes Deployment default (1).
+  replicaCount:
+
+  kind: Deployment
+
+  rbac:
+    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
+    # when using http://gateway-api.org/.
+    enabled: true
+
+  serviceAccount:
+    # If set, a service account will be created. Otherwise, the default is used
+    create: true
+    # Annotations to add to the service account
+    annotations: {}
+    # The name of the service account to use.
+    # If not set, the release name is used
+    name: ""
+
+  podAnnotations:
+    prometheus.io/port: "15020"
+    prometheus.io/scrape: "true"
+    prometheus.io/path: "/stats/prometheus"
+    inject.istio.io/templates: "gateway"
+    sidecar.istio.io/inject: "true"
+
+  # Define the security context for the pod.
+  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+  securityContext: {}
+  containerSecurityContext: {}
+
+  service:
+    # Type of service. Set to "None" to disable the service entirely
+    type: LoadBalancer
+    ports:
+    - name: status-port
+      port: 15021
+      protocol: TCP
+      targetPort: 15021
+    - name: http2
+      port: 80
+      protocol: TCP
+      targetPort: 80
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 443
+    annotations: {}
+    loadBalancerIP: ""
+    loadBalancerSourceRanges: []
+    externalTrafficPolicy: ""
+    externalIPs: []
+    ipFamilyPolicy: ""
+    ipFamilies: []
+    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
+    # allocateLoadBalancerNodePorts: false
+    ## Set LoadBalancer class (only for LoadBalancers).
+    # loadBalancerClass: ""
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 2000m
+      memory: 1024Mi
+
+  autoscaling:
+    enabled: true
+    minReplicas: 1
+    maxReplicas: 5
+    targetCPUUtilizationPercentage: 80
+    targetMemoryUtilizationPercentage: {}
+    autoscaleBehavior: {}
+
+  # Pod environment variables
+  env: {}
+
+  # Use envVarFrom to define full environment variable entries with complex sources,
+  # such as valueFrom.secretKeyRef, valueFrom.configMapKeyRef. Each item must include a `name` and `valueFrom`.
+  #
+  # Example:
+  # envVarFrom:
+  #   - name: EXAMPLE_SECRET
+  #     valueFrom:
+  #       secretKeyRef:
+  #         name: example-name
+  #         key: example-key
+  envVarFrom: []
+
+  # Deployment Update strategy
+  strategy: {}
+  
+  # Sets the Deployment minReadySeconds value
+  minReadySeconds:
+  
+  # Optionally configure a custom readinessProbe. By default the control plane
+  # automatically injects the readinessProbe. If you wish to override that
+  # behavior, you may define your own readinessProbe here.
+  readinessProbe: {}
+
+  # Labels to apply to all resources
+  labels:
+    # By default, don't enroll gateways into the ambient dataplane
+    "istio.io/dataplane-mode": none
+
+  # Annotations to apply to all resources
+  annotations: {}
+
+  nodeSelector: {}
+
+  tolerations: []
+
+  topologySpreadConstraints: []
+
+  affinity: {}
+
+  # If specified, the gateway will act as a network gateway for the given network.
+  networkGateway: ""
+
+  # Specify image pull policy if default behavior isn't desired.
+  # Default behavior: latest images will be Always else IfNotPresent
+  imagePullPolicy: ""
+
+  imagePullSecrets: []
+
+  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
+  #
+  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
+  # which means that no PodDisruptionBudget resource will be created.
+  #
+  # To enable the PodDisruptionBudget, configure it by specifying the
+  # `minAvailable` or `maxUnavailable`. For example, to set the
+  # minimum number of available replicas to 1, you can update this value as follows:
+  #
+  # podDisruptionBudget:
+  #   minAvailable: 1
+  #
+  # Or, to allow a maximum of 1 unavailable replica, you can set:
+  #
+  # podDisruptionBudget:
+  #   maxUnavailable: 1
+  #
+  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
+  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
+  #
+  # podDisruptionBudget:
+  #   minAvailable: 1
+  #   unhealthyPodEvictionPolicy: AlwaysAllow
+  #
+  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
+  #
+  # podDisruptionBudget: {}
+  #
+  podDisruptionBudget: {}
+
+  # Sets the per-pod terminationGracePeriodSeconds setting.
+  terminationGracePeriodSeconds: 30
+
+  # A list of `Volumes` added into the Gateway Pods. See
+  # https://kubernetes.io/docs/concepts/storage/volumes/.
+  volumes: []
+
+  # A list of `VolumeMounts` added into the Gateway Pods. See
+  # https://kubernetes.io/docs/concepts/storage/volumes/.
+  volumeMounts: []
+
+  # Inject initContainers into the Gateway Pods.
+  initContainers: []
+
+  # Inject additional containers into the Gateway Pods.
+  additionalContainers: []
+
+  # Configure this to a higher priority class in order to make sure your Istio gateway pods
+  # will not be killed because of low priority class.
+  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+  # for more detail.
+  priorityClassName: ""
+
+  # Configure the lifecycle hooks for the gateway. See
+  # https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/.
+  lifecycle: {}
diff --git a/resources/v1.27.3/charts/istiod/Chart.yaml b/resources/v1.27.3/charts/istiod/Chart.yaml
new file mode 100644
index 000000000..937648f12
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+appVersion: 1.27.3
+description: Helm chart for istio control plane
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+- istiod
+- istio-discovery
+name: istiod
+sources:
+- https://github.com/istio/istio
+version: 1.27.3
diff --git a/resources/v1.24.4/charts/istiod/README.md b/resources/v1.27.3/charts/istiod/README.md
similarity index 100%
rename from resources/v1.24.4/charts/istiod/README.md
rename to resources/v1.27.3/charts/istiod/README.md
diff --git a/resources/v1.27.3/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.27.3/charts/istiod/files/gateway-injection-template.yaml
new file mode 100644
index 000000000..bc15ee3c3
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/files/gateway-injection-template.yaml
@@ -0,0 +1,274 @@
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations:
+    istio.io/rev: {{ .Revision | default "default" | quote }}
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}"
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}"
+    {{- end }}
+    {{- end }}
+spec:
+  securityContext:
+  {{- if .Values.gateways.securityContext }}
+    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
+  {{- else }}
+    sysctls:
+    - name: net.ipv4.ip_unprivileged_port_start
+      value: "0"
+  {{- end }}
+  containers:
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    ports:
+    - containerPort: 15090
+      protocol: TCP
+      name: http-envoy-prom
+    args:
+    - proxy
+    - router
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+  {{- if .Values.global.proxy.lifecycle }}
+    lifecycle:
+      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
+  {{- end }}
+    securityContext:
+      runAsUser: {{ .ProxyUID | default "1337" }}
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+    env:
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: ISTIO_CPU_LIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: GOMEMLIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.memory
+    - name: GOMAXPROCS
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    {{- if .CompliancePolicy }}
+    - name: COMPLIANCE_POLICY
+      value: "{{ .CompliancePolicy }}"
+    {{- end }}
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    - name: ISTIO_META_INTERCEPTION_MODE
+      value: "{{ .ProxyConfig.InterceptionMode.String }}"
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- if .DeploymentMeta.Name }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ .DeploymentMeta.Name }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - name: ISTIO_BOOTSTRAP_OVERRIDE
+      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
+    {{- end }}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    - name: credential-socket
+      mountPath: /var/run/secrets/credential-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - mountPath: /etc/istio/custom-bootstrap
+      name: custom-bootstrap-volume
+    {{- end }}
+    # SDS channel between istioagent and Envoy
+    - mountPath: /etc/istio/proxy
+      name: istio-envoy
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+  volumes:
+  - emptyDir:
+    name: workload-socket
+  - emptyDir: {}
+    name: credential-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else}}
+  - emptyDir: {}
+    name: workload-certs
+  {{- end }}
+  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+  - name: custom-bootstrap-volume
+    configMap:
+      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-envoy
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+          name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+          path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.27.3/charts/istiod/files/grpc-agent.yaml b/resources/v1.27.3/charts/istiod/files/grpc-agent.yaml
new file mode 100644
index 000000000..6e3102e4c
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/files/grpc-agent.yaml
@@ -0,0 +1,318 @@
+{{- define "resources"  }}
+  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
+      requests:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
+        {{ end }}
+    {{- end }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+      limits:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
+        {{ end }}
+    {{- end }}
+  {{- else }}
+    {{- if .Values.global.proxy.resources }}
+      {{ toYaml .Values.global.proxy.resources | indent 6 }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations: {
+    istio.io/rev: {{ .Revision | default "default" | quote }},
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- end }}
+    sidecar.istio.io/rewriteAppHTTPProbers: "false",
+  }
+spec:
+  containers:
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    ports:
+    - containerPort: 15020
+      protocol: TCP
+      name: mesh-metrics
+    args:
+    - proxy
+    - sidecar
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+    lifecycle:
+      postStart:
+        exec:
+          command:
+          - pilot-agent
+          - wait
+          - --url=http://localhost:15020/healthz/ready
+    env:
+    - name: ISTIO_META_GENERATOR
+      value: grpc
+    - name: OUTPUT_CERTS
+      value: /var/lib/istio/data
+    {{- if eq .InboundTrafficPolicyMode "localhost" }}
+    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
+      value: "true"
+    {{- end }}
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- if .DeploymentMeta.Name }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ .DeploymentMeta.Name }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    # grpc uses xds:/// to resolve – no need to resolve VIP
+    - name: ISTIO_META_DNS_CAPTURE
+      value: "false"
+    - name: DISABLE_ENVOY
+      value: "true"
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15020
+      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
+    resources:
+  {{ template "resources" . }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    # UDS channel between istioagent and gRPC client for XDS/SDS
+    - mountPath: /etc/istio/proxy
+      name: istio-xds
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+    {{- end }}
+      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
+      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
+    - name: "{{  $index }}"
+      {{ toYaml $value | indent 6 }}
+      {{ end }}
+      {{- end }}
+{{- range $index, $container := .Spec.Containers  }}
+{{ if not (eq $container.Name "istio-proxy") }}
+  - name: {{ $container.Name }}
+    env:
+      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
+        value: "true"
+      - name: "GRPC_XDS_BOOTSTRAP"
+        value: "/etc/istio/proxy/grpc-bootstrap.json"
+    volumeMounts:
+      - mountPath: /var/lib/istio/data
+        name: istio-data
+      # UDS channel between istioagent and gRPC client for XDS/SDS
+      - mountPath: /etc/istio/proxy
+        name: istio-xds
+      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
+      - name: gke-workload-certificate
+        mountPath: /var/run/secrets/workload-spiffe-credentials
+        readOnly: true
+      {{- else }}
+      - name: workload-certs
+        mountPath: /var/run/secrets/workload-spiffe-credentials
+      {{- end }}
+{{- end }}
+{{- end }}
+  volumes:
+  - emptyDir:
+    name: workload-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else }}
+  - emptyDir:
+    name: workload-certs
+  {{- end }}
+  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+  - name: custom-bootstrap-volume
+    configMap:
+      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-xds
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+          name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+          path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
+    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
+  - name: "{{ $index }}"
+    {{ toYaml $value | indent 4 }}
+    {{ end }}
+    {{ end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.24.4/charts/istiod/files/grpc-simple.yaml b/resources/v1.27.3/charts/istiod/files/grpc-simple.yaml
similarity index 100%
rename from resources/v1.24.4/charts/istiod/files/grpc-simple.yaml
rename to resources/v1.27.3/charts/istiod/files/grpc-simple.yaml
diff --git a/resources/v1.27.3/charts/istiod/files/injection-template.yaml b/resources/v1.27.3/charts/istiod/files/injection-template.yaml
new file mode 100644
index 000000000..df04baf84
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/files/injection-template.yaml
@@ -0,0 +1,541 @@
+{{- define "resources"  }}
+  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
+      requests:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
+        {{ end }}
+    {{- end }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+      limits:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
+        {{ end }}
+    {{- end }}
+  {{- else }}
+    {{- if .Values.global.proxy.resources }}
+      {{ toYaml .Values.global.proxy.resources | indent 6 }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{ $tproxy := (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) }}
+{{ $capNetBindService := (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) }}
+{{ $nativeSidecar := ne (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar` | default (printf "%t" .NativeSidecars)) "false" }}
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
+    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
+    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
+    {{- end }}
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations: {
+    istio.io/rev: {{ .Revision | default "default" | quote }},
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- end }}
+{{- if .Values.pilot.cni.enabled }}
+    {{- if eq .Values.pilot.cni.provider "multus" }}
+    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
+    {{- end }}
+    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
+    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
+    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
+    traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}",
+    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
+    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
+    {{- end }}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
+    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
+    {{- end }}
+    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
+    {{ with index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}istio.io/reroute-virtual-interfaces: "{{.}}",{{ end }}
+    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
+{{- end }}
+  }
+spec:
+  {{- $holdProxy := and
+      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
+      (not $nativeSidecar) }}
+  {{- $noInitContainer := and
+      (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE`)
+      (not $nativeSidecar) }}
+  {{ if $noInitContainer }}
+  initContainers: []
+  {{ else -}}
+  initContainers:
+  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
+  {{ if .Values.pilot.cni.enabled -}}
+  - name: istio-validation
+  {{ else -}}
+  - name: istio-init
+  {{ end -}}
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    args:
+    - istio-iptables
+    - "-p"
+    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
+    - "-z"
+    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
+    - "-u"
+    - {{ if $tproxy }} "1337" {{ else }} {{ .ProxyUID | default "1337" | quote }} {{ end }}
+    - "-m"
+    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
+    - "-i"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
+    - "-x"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
+    - "-b"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
+    - "-d"
+  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
+    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
+  {{- else }}
+    - "15090,15021"
+  {{- end }}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
+    - "-q"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
+    {{ end -}}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
+    - "-o"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
+    {{ end -}}
+    {{ if (isset .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces`) -}}
+    - "-k"
+    - "{{ index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}"
+    {{ else if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
+    - "-k"
+    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
+    {{ end -}}
+     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
+    - "-c"
+    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
+    {{ end -}}
+    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
+    {{ if .Values.global.logAsJson -}}
+    - "--log_as_json"
+    {{ end -}}
+    {{ if .Values.pilot.cni.enabled -}}
+    - "--run-validation"
+    - "--skip-rule-apply"
+    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
+    - "--force-apply"
+    {{ end -}}
+    {{ if .Values.global.nativeNftables -}}
+    - "--native-nftables"
+    {{ end -}}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+  {{- if .ProxyConfig.ProxyMetadata }}
+    env:
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+  {{- end }}
+    resources:
+  {{ template "resources" . }}
+    securityContext:
+      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
+      privileged: {{ .Values.global.proxy.privileged }}
+      capabilities:
+    {{- if not .Values.pilot.cni.enabled }}
+        add:
+        - NET_ADMIN
+        - NET_RAW
+    {{- end }}
+        drop:
+        - ALL
+    {{- if not .Values.pilot.cni.enabled }}
+      readOnlyRootFilesystem: false
+      runAsGroup: 0
+      runAsNonRoot: false
+      runAsUser: 0
+    {{- else }}
+      readOnlyRootFilesystem: true
+      runAsGroup: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyGID | default "1337" }} {{ end }}
+      runAsUser: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyUID | default "1337" }} {{ end }}
+      runAsNonRoot: true
+    {{- end }}
+  {{ end -}}
+  {{ end -}}
+  {{ if not $nativeSidecar }}
+  containers:
+  {{ end }}
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
+    ports:
+    - containerPort: 15090
+      protocol: TCP
+      name: http-envoy-prom
+    args:
+    - proxy
+    - sidecar
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+  {{- if .Values.global.proxy.outlierLogPath }}
+    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
+  {{- end}}
+  {{- if .Values.global.proxy.lifecycle }}
+    lifecycle:
+      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
+  {{- else if $holdProxy }}
+    lifecycle:
+      postStart:
+        exec:
+          command:
+          - pilot-agent
+          - wait
+  {{- else if $nativeSidecar }}
+    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
+    lifecycle:
+      preStop:
+        exec:
+          command:
+          - pilot-agent
+          - request
+          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
+          - POST
+          - drain
+  {{- end }}
+    env:
+    {{- if eq .InboundTrafficPolicyMode "localhost" }}
+    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
+      value: "true"
+    {{- end }}
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: ISTIO_CPU_LIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: GOMEMLIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.memory
+    - name: GOMAXPROCS
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    {{- if .CompliancePolicy }}
+    - name: COMPLIANCE_POLICY
+      value: "{{ .CompliancePolicy }}"
+    {{- end }}
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    - name: ISTIO_META_INTERCEPTION_MODE
+      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- with (index .ObjectMeta.Labels `service.istio.io/workload-name` | default .DeploymentMeta.Name) }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ . }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - name: ISTIO_BOOTSTRAP_OVERRIDE
+      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
+    {{- end }}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
+    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
+  {{ if .Values.global.proxy.startupProbe.enabled }}
+    startupProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: 0
+      periodSeconds: 1
+      timeoutSeconds: 3
+      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
+  {{ end }}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
+    {{ end -}}
+    securityContext:
+      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
+      allowPrivilegeEscalation: true
+      capabilities:
+        add:
+        - NET_ADMIN
+        drop:
+        - ALL
+      privileged: true
+      readOnlyRootFilesystem: true
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+      runAsNonRoot: false
+      runAsUser: 0
+      {{- else }}
+      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
+      capabilities:
+        {{ if or $tproxy $capNetBindService -}}
+        add:
+        {{ if $tproxy -}}
+        - NET_ADMIN
+        {{- end }}
+        {{ if $capNetBindService -}}
+        - NET_BIND_SERVICE
+        {{- end }}
+        {{- end }}
+        drop:
+        - ALL
+      privileged: {{ .Values.global.proxy.privileged }}
+      readOnlyRootFilesystem: true
+      {{ if or $tproxy $capNetBindService -}}
+      runAsNonRoot: false
+      runAsUser: 0
+      runAsGroup: 1337
+      {{- else -}}
+      runAsNonRoot: true
+      runAsUser: {{ .ProxyUID | default "1337" }}
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+      {{- end }}
+      {{- end }}
+    resources:
+  {{ template "resources" . }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    - name: credential-socket
+      mountPath: /var/run/secrets/credential-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    - mountPath: /var/run/secrets/istio/crl
+      name: istio-ca-crl
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - mountPath: /etc/istio/custom-bootstrap
+      name: custom-bootstrap-volume
+    {{- end }}
+    # SDS channel between istioagent and Envoy
+    - mountPath: /etc/istio/proxy
+      name: istio-envoy
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
+    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
+      name: lightstep-certs
+      readOnly: true
+    {{- end }}
+      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
+      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
+    - name: "{{  $index }}"
+      {{ toYaml $value | indent 6 }}
+      {{ end }}
+      {{- end }}
+  volumes:
+  - emptyDir:
+    name: workload-socket
+  - emptyDir:
+    name: credential-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else }}
+  - emptyDir:
+    name: workload-certs
+  {{- end }}
+  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+  - name: custom-bootstrap-volume
+    configMap:
+      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-envoy
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+          name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+          path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+  {{- end }}
+  {{- end }}
+  - name: istio-ca-crl
+    configMap:
+      name: istio-ca-crl
+      optional: true
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
+    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
+  - name: "{{ $index }}"
+    {{ toYaml $value | indent 4 }}
+    {{ end }}
+    {{ end }}
+  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
+  - name: lightstep-certs
+    secret:
+      optional: true
+      secretName: lightstep.cacert
+  {{- end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.27.3/charts/istiod/files/kube-gateway.yaml b/resources/v1.27.3/charts/istiod/files/kube-gateway.yaml
new file mode 100644
index 000000000..616fb42c7
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/files/kube-gateway.yaml
@@ -0,0 +1,401 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{.ServiceAccount | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  {{- if ge .KubeVersion 128 }}
+  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+  {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.istio.io/managed" "istio.io-gateway-controller"
+      ) | nindent 4 }}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: {{.Name}}
+    uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      "{{.GatewayNameLabel}}": {{.Name}}
+  template:
+    metadata:
+      annotations:
+        {{- toJsonMap
+          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
+          (strdict "istio.io/rev" (.Revision | default "default"))
+          (strdict
+            "prometheus.io/path" "/stats/prometheus"
+            "prometheus.io/port" "15020"
+            "prometheus.io/scrape" "true"
+          ) | nindent 8 }}
+      labels:
+        {{- toJsonMap
+          (strdict
+            "sidecar.istio.io/inject" "false"
+            "service.istio.io/canonical-name" .DeploymentName
+            "service.istio.io/canonical-revision" "latest"
+           )
+          .InfrastructureLabels
+          (strdict
+            "gateway.networking.k8s.io/gateway-name" .Name
+            "gateway.istio.io/managed" "istio.io-gateway-controller"
+          ) | nindent 8 }}
+    spec:
+      securityContext:
+      {{- if .Values.gateways.securityContext }}
+        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
+      {{- else }}
+        sysctls:
+        - name: net.ipv4.ip_unprivileged_port_start
+          value: "0"
+      {{- if .Values.gateways.seccompProfile }}
+        seccompProfile:
+      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
+      {{- end }}
+      {{- end }}
+      serviceAccountName: {{.ServiceAccount | quote}}
+      containers:
+      - name: istio-proxy
+      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+      {{- else }}
+        image: "{{ .ProxyImage }}"
+      {{- end }}
+        {{- if .Values.global.proxy.resources }}
+        resources:
+          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
+        {{- end }}
+        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
+          allowPrivilegeEscalation: false
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsUser: {{ .ProxyUID | default "1337" }}
+          runAsGroup: {{ .ProxyGID | default "1337" }}
+          runAsNonRoot: true
+        ports:
+        - containerPort: 15020
+          name: metrics
+          protocol: TCP
+        - containerPort: 15021
+          name: status-port
+          protocol: TCP
+        - containerPort: 15090
+          protocol: TCP
+          name: http-envoy-prom
+        args:
+        - proxy
+        - router
+        - --domain
+        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+        - --proxyLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
+        - --proxyComponentLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
+        - --log_output_level
+        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
+      {{- if .Values.global.sts.servicePort }}
+        - --stsPort={{ .Values.global.sts.servicePort }}
+      {{- end }}
+      {{- if .Values.global.logAsJson }}
+        - --log_as_json
+      {{- end }}
+      {{- if .Values.global.proxy.lifecycle }}
+        lifecycle:
+          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
+      {{- end }}
+        env:
+        - name: PILOT_CERT_PROVIDER
+          value: {{ .Values.global.pilotCertProvider }}
+        - name: CA_ADDR
+        {{- if .Values.global.caAddress }}
+          value: {{ .Values.global.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        - name: ISTIO_CPU_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: PROXY_CONFIG
+          value: |
+                 {{ protoToJSON .ProxyConfig }}
+        - name: ISTIO_META_POD_PORTS
+          value: "[]"
+        - name: ISTIO_META_APP_CONTAINERS
+          value: ""
+        - name: GOMEMLIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.memory
+        - name: GOMAXPROCS
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: ISTIO_META_CLUSTER_ID
+          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
+        - name: ISTIO_META_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: ISTIO_META_INTERCEPTION_MODE
+          value: "{{ .ProxyConfig.InterceptionMode.String }}"
+        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
+        - name: ISTIO_META_NETWORK
+          value: {{.|quote}}
+        {{- end }}
+        - name: ISTIO_META_WORKLOAD_NAME
+          value: {{.DeploymentName|quote}}
+        - name: ISTIO_META_OWNER
+          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
+        {{- if .Values.global.meshID }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ .Values.global.meshID }}"
+        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+        {{- end }}
+        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+        - name: TRUST_DOMAIN
+          value: "{{ . }}"
+        {{- end }}
+        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
+        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
+          value: {{.|quote}}
+        {{- end }}
+        startupProbe:
+          failureThreshold: 30
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 1
+          periodSeconds: 1
+          successThreshold: 1
+          timeoutSeconds: 1
+        readinessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 0
+          periodSeconds: 15
+          successThreshold: 1
+          timeoutSeconds: 1
+        volumeMounts:
+        - name: workload-socket
+          mountPath: /var/run/secrets/workload-spiffe-uds
+        - name: credential-socket
+          mountPath: /var/run/secrets/credential-uds
+        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+        - name: gke-workload-certificate
+          mountPath: /var/run/secrets/workload-spiffe-credentials
+          readOnly: true
+        {{- else }}
+        - name: workload-certs
+          mountPath: /var/run/secrets/workload-spiffe-credentials
+        {{- end }}
+        {{- if eq .Values.global.pilotCertProvider "istiod" }}
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        {{- end }}
+        - mountPath: /var/lib/istio/data
+          name: istio-data
+        # SDS channel between istioagent and Envoy
+        - mountPath: /etc/istio/proxy
+          name: istio-envoy
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - name: istio-podinfo
+          mountPath: /etc/istio/pod
+      volumes:
+      - emptyDir: {}
+        name: workload-socket
+      - emptyDir: {}
+        name: credential-socket
+      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+      - name: gke-workload-certificate
+        csi:
+          driver: workloadcertificates.security.cloud.google.com
+      {{- else}}
+      - emptyDir: {}
+        name: workload-certs
+      {{- end }}
+      # SDS channel between istioagent and Envoy
+      - emptyDir:
+          medium: Memory
+        name: istio-envoy
+      - name: istio-data
+        emptyDir: {}
+      - name: istio-podinfo
+        downwardAPI:
+          items:
+            - path: "labels"
+              fieldRef:
+                fieldPath: metadata.labels
+            - path: "annotations"
+              fieldRef:
+                fieldPath: metadata.annotations
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: istio-token
+              expirationSeconds: 43200
+              audience: {{ .Values.global.sds.token.aud }}
+      {{- if eq .Values.global.pilotCertProvider "istiod" }}
+      - name: istiod-ca-cert
+      {{- if eq ((.Values.pilot).env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+              path: root-cert.pem
+      {{- else }}
+        configMap:
+          name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+      {{- end }}
+      {{- end }}
+      {{- if .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: {{.Name}}
+    uid: {{.UID}}
+spec:
+  ipFamilyPolicy: PreferDualStack
+  ports:
+  {{- range $key, $val := .Ports }}
+  - name: {{ $val.Name | quote }}
+    port: {{ $val.Port }}
+    protocol: TCP
+    appProtocol: {{ $val.AppProtocol }}
+  {{- end }}
+  selector:
+    "{{.GatewayNameLabel}}": {{.Name}}
+  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
+  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
+  {{- end }}
+  type: {{ .ServiceType | quote }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name:  {{.DeploymentName | quote}}
+  maxReplicas: 1
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
+
diff --git a/resources/v1.27.3/charts/istiod/files/profile-ambient.yaml b/resources/v1.27.3/charts/istiod/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.27.3/charts/istiod/files/profile-compatibility-version-1.24.yaml b/resources/v1.27.3/charts/istiod/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..4f3dbef7e
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,15 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.3/charts/istiod/files/profile-compatibility-version-1.25.yaml b/resources/v1.27.3/charts/istiod/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..b2f45948c
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.3/charts/istiod/files/profile-compatibility-version-1.26.yaml b/resources/v1.27.3/charts/istiod/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..af1069732
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
\ No newline at end of file
diff --git a/resources/v1.25.5/charts/istiod/files/profile-demo.yaml b/resources/v1.27.3/charts/istiod/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.5/charts/istiod/files/profile-demo.yaml
rename to resources/v1.27.3/charts/istiod/files/profile-demo.yaml
diff --git a/resources/v1.27.3/charts/istiod/files/profile-platform-gke.yaml b/resources/v1.27.3/charts/istiod/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.4/charts/istiod/files/profile-platform-k3d.yaml b/resources/v1.27.3/charts/istiod/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.4/charts/istiod/files/profile-platform-k3d.yaml
rename to resources/v1.27.3/charts/istiod/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.5/charts/istiod/files/profile-platform-k3s.yaml b/resources/v1.27.3/charts/istiod/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.5/charts/istiod/files/profile-platform-k3s.yaml
rename to resources/v1.27.3/charts/istiod/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.4/charts/istiod/files/profile-platform-microk8s.yaml b/resources/v1.27.3/charts/istiod/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.4/charts/istiod/files/profile-platform-microk8s.yaml
rename to resources/v1.27.3/charts/istiod/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.4/charts/istiod/files/profile-platform-minikube.yaml b/resources/v1.27.3/charts/istiod/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.4/charts/istiod/files/profile-platform-minikube.yaml
rename to resources/v1.27.3/charts/istiod/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.4/charts/istiod/files/profile-platform-openshift.yaml b/resources/v1.27.3/charts/istiod/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.4/charts/istiod/files/profile-platform-openshift.yaml
rename to resources/v1.27.3/charts/istiod/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.4/charts/istiod/files/profile-preview.yaml b/resources/v1.27.3/charts/istiod/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.4/charts/istiod/files/profile-preview.yaml
rename to resources/v1.27.3/charts/istiod/files/profile-preview.yaml
diff --git a/resources/v1.24.4/charts/istiod/files/profile-remote.yaml b/resources/v1.27.3/charts/istiod/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.4/charts/istiod/files/profile-remote.yaml
rename to resources/v1.27.3/charts/istiod/files/profile-remote.yaml
diff --git a/resources/v1.24.4/charts/istiod/files/profile-stable.yaml b/resources/v1.27.3/charts/istiod/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.4/charts/istiod/files/profile-stable.yaml
rename to resources/v1.27.3/charts/istiod/files/profile-stable.yaml
diff --git a/resources/v1.27.3/charts/istiod/files/waypoint.yaml b/resources/v1.27.3/charts/istiod/files/waypoint.yaml
new file mode 100644
index 000000000..3e6a2f5dc
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/files/waypoint.yaml
@@ -0,0 +1,396 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{.ServiceAccount | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  {{- if ge .KubeVersion 128 }}
+  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+  {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.istio.io/managed" .ControllerLabel
+      ) | nindent 4 }}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      "{{.GatewayNameLabel}}": "{{.Name}}"
+  template:
+    metadata:
+      annotations:
+        {{- toJsonMap
+          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
+          (strdict "istio.io/rev" (.Revision | default "default"))
+          (strdict
+            "prometheus.io/path" "/stats/prometheus"
+            "prometheus.io/port" "15020"
+            "prometheus.io/scrape" "true"
+          ) | nindent 8 }}
+      labels:
+        {{- toJsonMap
+          (strdict
+            "sidecar.istio.io/inject" "false"
+            "istio.io/dataplane-mode" "none"
+            "service.istio.io/canonical-name" .DeploymentName
+            "service.istio.io/canonical-revision" "latest"
+           )
+          .InfrastructureLabels
+          (strdict
+            "gateway.networking.k8s.io/gateway-name" .Name
+            "gateway.istio.io/managed" .ControllerLabel
+          ) | nindent 8}}
+    spec:
+      {{- if .Values.global.waypoint.affinity }}
+      affinity:
+      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.topologySpreadConstraints }}
+      topologySpreadConstraints:
+      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.nodeSelector }}
+      nodeSelector:
+      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.tolerations }}
+      tolerations:
+      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: 2
+      serviceAccountName: {{.ServiceAccount | quote}}
+      containers:
+      - name: istio-proxy
+        ports:
+        - containerPort: 15020
+          name: metrics
+          protocol: TCP
+        - containerPort: 15021
+          name: status-port
+          protocol: TCP
+        - containerPort: 15090
+          protocol: TCP
+          name: http-envoy-prom
+        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+        {{- else }}
+        image: "{{ .ProxyImage }}"
+        {{- end }}
+        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+        args:
+        - proxy
+        - waypoint
+        - --domain
+        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+        - --serviceCluster
+        - {{.ServiceAccount}}.$(POD_NAMESPACE)
+        - --proxyLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
+        - --proxyComponentLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
+        - --log_output_level
+        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
+        {{- if .Values.global.logAsJson }}
+        - --log_as_json
+        {{- end }}
+        {{- if .Values.global.proxy.outlierLogPath }}
+        - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
+        {{- end}}
+        env:
+        - name: ISTIO_META_SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: ISTIO_META_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: PILOT_CERT_PROVIDER
+          value: {{ .Values.global.pilotCertProvider }}
+        - name: CA_ADDR
+        {{- if .Values.global.caAddress }}
+          value: {{ .Values.global.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        - name: ISTIO_CPU_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: PROXY_CONFIG
+          value: |
+                 {{ protoToJSON .ProxyConfig }}
+        {{- if .ProxyConfig.ProxyMetadata }}
+        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- end }}
+        - name: GOMEMLIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.memory
+        - name: GOMAXPROCS
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        - name: ISTIO_META_CLUSTER_ID
+          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
+        {{- if $network }}
+        - name: ISTIO_META_NETWORK
+          value: "{{ $network }}"
+        {{- end }}
+        - name: ISTIO_META_INTERCEPTION_MODE
+          value: REDIRECT
+        - name: ISTIO_META_WORKLOAD_NAME
+          value: {{.DeploymentName}}
+        - name: ISTIO_META_OWNER
+          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
+        {{- if .Values.global.meshID }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ .Values.global.meshID }}"
+        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+        {{- end }}
+        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: TRUST_DOMAIN
+          value: "{{ . }}"
+        {{- end }}
+        {{- if .Values.global.waypoint.resources }}
+        resources:
+        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
+        {{- end }}
+        startupProbe:
+          failureThreshold: 30
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 1
+          periodSeconds: 1
+          successThreshold: 1
+          timeoutSeconds: 1
+        readinessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 0
+          periodSeconds: 15
+          successThreshold: 1
+          timeoutSeconds: 1
+        securityContext:
+          privileged: false
+        {{- if not (eq .Values.global.platform "openshift") }}
+          runAsGroup: 1337
+          runAsUser: 1337
+        {{- end }}
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          capabilities:
+            drop:
+            - ALL
+{{- if .Values.gateways.seccompProfile }}
+          seccompProfile:
+{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
+{{- end }}
+        volumeMounts:
+        - mountPath: /var/run/secrets/workload-spiffe-uds
+          name: workload-socket
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        - mountPath: /var/lib/istio/data
+          name: istio-data
+        - mountPath: /etc/istio/proxy
+          name: istio-envoy
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - mountPath: /etc/istio/pod
+          name: istio-podinfo
+      volumes:
+      - emptyDir: {}
+        name: workload-socket
+      - emptyDir:
+          medium: Memory
+        name: istio-envoy
+      - emptyDir:
+          medium: Memory
+        name: go-proxy-envoy
+      - emptyDir: {}
+        name: istio-data
+      - emptyDir: {}
+        name: go-proxy-data
+      - downwardAPI:
+          items:
+          - fieldRef:
+              fieldPath: metadata.labels
+            path: labels
+          - fieldRef:
+              fieldPath: metadata.annotations
+            path: annotations
+        name: istio-podinfo
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              audience: istio-ca
+              expirationSeconds: 43200
+              path: istio-token
+      - name: istiod-ca-cert
+      {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+              path: root-cert.pem
+      {{- else }}
+        configMap:
+          name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+      {{- end }}
+      {{- if .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    {{ toJsonMap
+      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
+      (omit .InfrastructureAnnotations
+        "kubectl.kubernetes.io/last-applied-configuration"
+        "gateway.istio.io/name-override"
+        "gateway.istio.io/service-account"
+        "gateway.istio.io/controller-version"
+      ) | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+      ) | nindent 4 }}
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+spec:
+  ipFamilyPolicy: PreferDualStack
+  ports:
+  {{- range $key, $val := .Ports }}
+  - name: {{ $val.Name | quote }}
+    port: {{ $val.Port }}
+    protocol: TCP
+    appProtocol: {{ $val.AppProtocol }}
+  {{- end }}
+  selector:
+    "{{.GatewayNameLabel}}": "{{.Name}}"
+  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
+  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
+  {{- end }}
+  type: {{ .ServiceType | quote }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name:  {{.DeploymentName | quote}}
+  maxReplicas: 1
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
+
diff --git a/resources/v1.24.4/charts/istiod/templates/NOTES.txt b/resources/v1.27.3/charts/istiod/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.4/charts/istiod/templates/NOTES.txt
rename to resources/v1.27.3/charts/istiod/templates/NOTES.txt
diff --git a/resources/v1.24.4/charts/istiod/templates/_helpers.tpl b/resources/v1.27.3/charts/istiod/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.4/charts/istiod/templates/_helpers.tpl
rename to resources/v1.27.3/charts/istiod/templates/_helpers.tpl
diff --git a/resources/v1.27.3/charts/istiod/templates/autoscale.yaml b/resources/v1.27.3/charts/istiod/templates/autoscale.yaml
new file mode 100644
index 000000000..9b952ba85
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/autoscale.yaml
@@ -0,0 +1,43 @@
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+{{- if and .Values.autoscaleEnabled .Values.autoscaleMin .Values.autoscaleMax }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  maxReplicas: {{ .Values.autoscaleMax }}
+  minReplicas: {{ .Values.autoscaleMin }}
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: {{ .Values.cpu.targetAverageUtilization }}
+  {{- if .Values.memory.targetAverageUtilization }}
+  - type: Resource
+    resource:
+      name: memory
+      target:
+        type: Utilization
+        averageUtilization: {{ .Values.memory.targetAverageUtilization }}
+  {{- end }}
+  {{- if .Values.autoscaleBehavior }}
+  behavior: {{ toYaml .Values.autoscaleBehavior | nindent 4 }}
+  {{- end }}
+---
+{{- end }}
+{{- end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/clusterrole.yaml b/resources/v1.27.3/charts/istiod/templates/clusterrole.yaml
new file mode 100644
index 000000000..d9c86f43f
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/clusterrole.yaml
@@ -0,0 +1,213 @@
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  # sidecar injection controller
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+
+  # configuration validation webhook controller
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update"]
+
+  # istio configuration
+  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
+  # please proceed with caution
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["get", "watch", "list"]
+    resources: ["*"]
+{{- if .Values.global.istiod.enableAnalysis }}
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["update", "patch"]
+    resources:
+    - authorizationpolicies/status
+    - destinationrules/status
+    - envoyfilters/status
+    - gateways/status
+    - peerauthentications/status
+    - proxyconfigs/status
+    - requestauthentications/status
+    - serviceentries/status
+    - sidecars/status
+    - telemetries/status
+    - virtualservices/status
+    - wasmplugins/status
+    - workloadentries/status
+    - workloadgroups/status
+{{- end }}
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "workloadentries" ]
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "workloadentries/status",  "serviceentries/status" ]
+  - apiGroups: ["security.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "authorizationpolicies/status" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "services/status" ]
+
+  # auto-detect installed CRD definitions
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+
+  # discovery and routing
+  - apiGroups: [""]
+    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+
+{{- if .Values.taint.enabled }}
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["patch"]
+{{- end }}
+
+  # ingress controller
+{{- if .Values.global.istiod.enableAnalysis }}
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["*"]
+{{- end}}
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses", "ingressclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["*"]
+
+  # required for CA's namespace controller
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create", "get", "list", "watch", "update"]
+
+  # Istiod and bootstrap.
+{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
+{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
+  - apiGroups: ["certificates.k8s.io"]
+    resources:
+      - "certificatesigningrequests"
+      - "certificatesigningrequests/approval"
+      - "certificatesigningrequests/status"
+    verbs: ["update", "create", "get", "delete", "watch"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources:
+      - "signers"
+    resourceNames:
+{{- range .Values.global.certSigners }}
+    - {{ . | quote }}
+{{- end }}
+    verbs: ["approve"]
+{{- end}}
+{{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["clustertrustbundles"]
+    verbs: ["update", "create", "delete", "list", "watch", "get"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["signers"]
+    resourceNames: ["istio.io/istiod-ca"]
+    verbs: ["attest"]
+{{- end }}
+
+  # Used by Istiod to verify the JWT tokens
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]
+
+  # Used by Istiod to verify gateway SDS
+  - apiGroups: ["authorization.k8s.io"]
+    resources: ["subjectaccessreviews"]
+    verbs: ["create"]
+
+  # Use for Kubernetes Service APIs
+  - apiGroups: ["gateway.networking.k8s.io", "gateway.networking.x-k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["gateway.networking.x-k8s.io"]
+    resources:
+    - xbackendtrafficpolicies/status
+    - xlistenersets/status
+    verbs: ["update", "patch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources:
+    - backendtlspolicies/status
+    - gatewayclasses/status
+    - gateways/status
+    - grpcroutes/status
+    - httproutes/status
+    - referencegrants/status
+    - tcproutes/status
+    - tlsroutes/status
+    - udproutes/status
+    verbs: ["update", "patch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources: ["gatewayclasses"]
+    verbs: ["create", "update", "patch", "delete"]
+  - apiGroups: ["inference.networking.x-k8s.io"]
+    resources: ["inferencepools"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["inference.networking.x-k8s.io"]
+    resources: ["inferencepools/status"]
+    verbs: ["update", "patch"]
+
+  # Needed for multicluster secret reading, possibly ingress certs in the future
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "watch", "list"]
+
+  # Used for MCS serviceexport management
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceexports"]
+    verbs: [ "get", "watch", "list", "create", "delete"]
+
+  # Used for MCS serviceimport management
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceimports"]
+    verbs: ["get", "watch", "list"]
+---
+{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["apps"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "deployments" ]
+  - apiGroups: ["autoscaling"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "horizontalpodautoscalers" ]
+  - apiGroups: ["policy"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "poddisruptionbudgets" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "services" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "serviceaccounts"]
+{{- end }}
+{{- end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.27.3/charts/istiod/templates/clusterrolebinding.yaml
new file mode 100644
index 000000000..1b8fa4d07
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/clusterrolebinding.yaml
@@ -0,0 +1,40 @@
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
+    namespace: {{ .Values.global.istioNamespace }}
+---
+{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+subjects:
+- kind: ServiceAccount
+  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Values.global.istioNamespace }}
+{{- end }}
+{{- end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.27.3/charts/istiod/templates/configmap-jwks.yaml
new file mode 100644
index 000000000..9d931c406
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/configmap-jwks.yaml
@@ -0,0 +1,18 @@
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+{{- if .Values.jwksResolverExtraRootCA }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+  extra.pem: {{ .Values.jwksResolverExtraRootCA | quote }}
+{{- end }}
+{{- end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/configmap-values.yaml b/resources/v1.27.3/charts/istiod/templates/configmap-values.yaml
new file mode 100644
index 000000000..75e6e0bcc
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/configmap-values.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+  original-values: |-
+{{ .Values._original | toPrettyJson | indent 4 }}
+{{- $_ := unset $.Values "_original" }}
+  merged-values: |-
+{{ .Values | toPrettyJson | indent 4 }}
diff --git a/resources/v1.27.3/charts/istiod/templates/configmap.yaml b/resources/v1.27.3/charts/istiod/templates/configmap.yaml
new file mode 100644
index 000000000..a8446a6fc
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/configmap.yaml
@@ -0,0 +1,111 @@
+{{- define "mesh" }}
+    # The trust domain corresponds to the trust root of a system.
+    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
+    trustDomain: "cluster.local"
+
+    # The namespace to treat as the administrative root namespace for Istio configuration.
+    # When processing a leaf namespace Istio will search for declarations in that namespace first
+    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
+    # is processed as if it were declared in the leaf namespace.
+    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
+
+  {{ $prom := include "default-prometheus" . | eq "true" }}
+  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
+  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
+  {{- if or $prom $sdMetrics $sdLogs }}
+    defaultProviders:
+    {{- if or $prom $sdMetrics }}
+      metrics:
+      {{ if $prom }}- prometheus{{ end }}
+      {{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
+    {{- end }}
+    {{- if and $sdMetrics $sdLogs }}
+      accessLogging:
+      - stackdriver
+    {{- end }}
+  {{- end }}
+
+    defaultConfig:
+      {{- if .Values.global.meshID }}
+      meshId: "{{ .Values.global.meshID }}"
+      {{- end }}
+      {{- with (.Values.global.proxy.variant | default .Values.global.variant) }}
+      image:
+        imageType: {{. | quote}}
+      {{- end }}
+      {{- if not (eq .Values.global.proxy.tracer "none") }}
+      tracing:
+      {{- if eq .Values.global.proxy.tracer "lightstep" }}
+        lightstep:
+          # Address of the LightStep Satellite pool
+          address: {{ .Values.global.tracer.lightstep.address }}
+          # Access Token used to communicate with the Satellite pool
+          accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
+      {{- else if eq .Values.global.proxy.tracer "zipkin" }}
+        zipkin:
+          # Address of the Zipkin collector
+          address: {{ ((.Values.global.tracer).zipkin).address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
+      {{- else if eq .Values.global.proxy.tracer "datadog" }}
+        datadog:
+          # Address of the Datadog Agent
+          address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
+      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
+        stackdriver:
+          # enables trace output to stdout.
+          debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}
+          # The global default max number of attributes per span.
+          maxNumberOfAttributes: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAttributes | default "200" }}
+          # The global default max number of annotation events per span.
+          maxNumberOfAnnotations: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAnnotations | default "200" }}
+          # The global default max number of message events per span.
+          maxNumberOfMessageEvents: {{ (($.Values.global.tracer).stackdriver).maxNumberOfMessageEvents | default "200" }}
+      {{- end }}
+      {{- end }}
+      {{- if .Values.global.remotePilotAddress }}
+      {{- if and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod }}
+      #  only primary `istiod` to xds and local `istiod` injection installs.
+      discoveryAddress: {{ printf "istiod-remote.%s.svc" .Release.Namespace }}:15012
+      {{- else }}
+      discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
+      {{- end }}
+      {{- else }}
+      discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
+      {{- end }}
+{{- end }}
+
+{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
+{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
+{{- $originalMesh := include "mesh" . | fromYaml }}
+{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
+
+{{- if .Values.configMap }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+
+  # Configuration file for the mesh networks to be used by the Split Horizon EDS.
+  meshNetworks: |-
+  {{- if .Values.global.meshNetworks }}
+    networks:
+{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
+  {{- else }}
+    networks: {}
+  {{- end }}
+
+  mesh: |-
+{{- if .Values.meshConfig }}
+{{ $mesh | toYaml | indent 4 }}
+{{- else }}
+{{- include "mesh" . }}
+{{- end }}
+---
+{{- end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/deployment.yaml b/resources/v1.27.3/charts/istiod/templates/deployment.yaml
new file mode 100644
index 000000000..1b769c6ec
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/deployment.yaml
@@ -0,0 +1,312 @@
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istiod
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    istio: pilot
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+{{- range $key, $val := .Values.deploymentLabels }}
+    {{ $key }}: "{{ $val }}"
+{{- end }}
+  {{- if .Values.deploymentAnnotations }}
+  annotations:
+{{ toYaml .Values.deploymentAnnotations | indent 4 }}
+  {{- end }}
+spec:
+{{- if not .Values.autoscaleEnabled }}
+{{- if .Values.replicaCount }}
+  replicas: {{ .Values.replicaCount }}
+{{- end }}
+{{- end }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingMaxSurge }}
+      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
+  selector:
+    matchLabels:
+      {{- if ne .Values.revision "" }}
+      app: istiod
+      istio.io/rev: {{ .Values.revision | default "default" | quote }}
+      {{- else }}
+      istio: pilot
+      {{- end }}
+  template:
+    metadata:
+      labels:
+        app: istiod
+        istio.io/rev: {{ .Values.revision | default "default" | quote }}
+        sidecar.istio.io/inject: "false"
+        operator.istio.io/component: "Pilot"
+        {{- if ne .Values.revision "" }}
+        istio: istiod
+        {{- else }}
+        istio: pilot
+        {{- end }}
+        {{- range $key, $val := .Values.podLabels }}
+        {{ $key }}: "{{ $val }}"
+        {{- end }}
+        istio.io/dataplane-mode: none
+        app.kubernetes.io/name: "istiod"
+        {{- include "istio.labels" . | nindent 8 }}
+      annotations:
+        prometheus.io/port: "15014"
+        prometheus.io/scrape: "true"
+        sidecar.istio.io/inject: "false"
+        {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+        {{- end }}
+    spec:
+{{- if .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 8 }}
+{{- end }}
+{{- with .Values.affinity }}
+      affinity:
+{{- toYaml . | nindent 8 }}
+{{- end }}
+      tolerations:
+        - key: cni.istio.io/not-ready
+          operator: "Exists"
+{{- with .Values.tolerations }}
+{{- toYaml . | nindent 8 }}
+{{- end }}
+{{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+{{- toYaml . | nindent 8 }}
+{{- end }}
+      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+{{- if .Values.global.priorityClassName }}
+      priorityClassName: "{{ .Values.global.priorityClassName }}"
+{{- end }}
+{{- with .Values.initContainers }}
+      initContainers:
+        {{- tpl (toYaml .) $ | nindent 8 }}
+{{- end }}
+      containers:
+        - name: discovery
+{{- if contains "/" .Values.image }}
+          image: "{{ .Values.image }}"
+{{- else }}
+          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
+{{- end }}
+{{- if .Values.global.imagePullPolicy }}
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+{{- end }}
+          args:
+          - "discovery"
+          - --monitoringAddr=:15014
+{{- if .Values.global.logging.level }}
+          - --log_output_level={{ .Values.global.logging.level }}
+{{- end}}
+{{- if .Values.global.logAsJson }}
+          - --log_as_json
+{{- end }}
+          - --domain
+          - {{ .Values.global.proxy.clusterDomain }}
+{{- if .Values.taint.namespace }}
+          - --cniNamespace={{ .Values.taint.namespace }}
+{{- end }}
+          - --keepaliveMaxServerConnectionAge
+          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
+{{- if .Values.extraContainerArgs }}
+          {{- with .Values.extraContainerArgs }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+{{- end }}
+          ports:
+          - containerPort: 8080
+            protocol: TCP
+            name: http-debug
+          - containerPort: 15010
+            protocol: TCP
+            name: grpc-xds
+          - containerPort: 15012
+            protocol: TCP
+            name: tls-xds
+          - containerPort: 15017
+            protocol: TCP
+            name: https-webhooks
+          - containerPort: 15014
+            protocol: TCP
+            name: http-monitoring
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8080
+            initialDelaySeconds: 1
+            periodSeconds: 3
+            timeoutSeconds: 5
+          env:
+          - name: REVISION
+            value: "{{ .Values.revision | default `default` }}"
+          - name: PILOT_CERT_PROVIDER
+            value: {{ .Values.global.pilotCertProvider }}
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.name
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+          - name: SERVICE_ACCOUNT
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: spec.serviceAccountName
+          - name: KUBECONFIG
+            value: /var/run/secrets/remote/config
+          # If you explicitly told us where ztunnel lives, use that.
+          # Otherwise, assume it lives in our namespace
+          # Also, check for an explicit ENV override (legacy approach) and prefer that
+          # if present
+          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
+          {{ $ztTrustedName := or .Values.trustedZtunnelName "ztunnel" }}
+          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
+          - name: CA_TRUSTED_NODE_ACCOUNTS
+            value: "{{ $ztTrustedNS }}/{{ $ztTrustedName }}"
+          {{- end }}
+          {{- if .Values.env }}
+          {{- range $key, $val := .Values.env }}
+          - name: {{ $key }}
+            value: "{{ $val }}"
+          {{- end }}
+          {{- end }}
+          {{- with .Values.envVarFrom }}
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+{{- if .Values.traceSampling }}
+          - name: PILOT_TRACE_SAMPLING
+            value: "{{ .Values.traceSampling }}"
+{{- end }}
+# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
+# don't set it here to avoid duplication.
+# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
+{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
+          - name: EXTERNAL_ISTIOD
+            value: "{{ .Values.global.externalIstiod }}"
+{{- end }}
+{{- if .Values.global.trustBundleName }}
+          - name: PILOT_CA_CERT_CONFIGMAP
+            value: "{{ .Values.global.trustBundleName }}"
+{{- end }}
+          - name: PILOT_ENABLE_ANALYSIS
+            value: "{{ .Values.global.istiod.enableAnalysis }}"
+          - name: CLUSTER_ID
+            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
+          - name: GOMEMLIMIT
+            valueFrom:
+              resourceFieldRef:
+                resource: limits.memory
+                divisor: "1"
+          - name: GOMAXPROCS
+            valueFrom:
+              resourceFieldRef:
+                resource: limits.cpu
+                divisor: "1"
+          - name: PLATFORM
+            value: "{{ coalesce .Values.global.platform .Values.platform }}"
+          resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 12 }}
+{{- else }}
+{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
+{{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+              - ALL
+{{- if .Values.seccompProfile }}
+            seccompProfile:
+{{ toYaml .Values.seccompProfile | trim | indent 14 }}
+{{- end }}
+          volumeMounts:
+          - name: istio-token
+            mountPath: /var/run/secrets/tokens
+            readOnly: true
+          - name: local-certs
+            mountPath: /var/run/secrets/istio-dns
+          - name: cacerts
+            mountPath: /etc/cacerts
+            readOnly: true
+          - name: istio-kubeconfig
+            mountPath: /var/run/secrets/remote
+            readOnly: true
+          {{- if .Values.jwksResolverExtraRootCA }}
+          - name: extracacerts
+            mountPath: /cacerts
+          {{- end }}
+          - name: istio-csr-dns-cert
+            mountPath: /var/run/secrets/istiod/tls
+            readOnly: true
+          - name: istio-csr-ca-configmap
+            mountPath: /var/run/secrets/istiod/ca
+            readOnly: true
+          {{- with .Values.volumeMounts }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+      volumes:
+      # Technically not needed on this pod - but it helps debugging/testing SDS
+      # Should be removed after everything works.
+      - emptyDir:
+          medium: Memory
+        name: local-certs
+      - name: istio-token
+        projected:
+          sources:
+            - serviceAccountToken:
+                audience: {{ .Values.global.sds.token.aud }}
+                expirationSeconds: 43200
+                path: istio-token
+      # Optional: user-generated root
+      - name: cacerts
+        secret:
+          secretName: cacerts
+          optional: true
+      - name: istio-kubeconfig
+        secret:
+          secretName: istio-kubeconfig
+          optional: true
+      # Optional: istio-csr dns pilot certs
+      - name: istio-csr-dns-cert
+        secret:
+          secretName: istiod-tls
+          optional: true
+      - name: istio-csr-ca-configmap
+  {{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+              path: root-cert.pem
+              optional: true
+  {{- else }}
+        configMap:
+          name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+          defaultMode: 420
+          optional: true
+  {{- end }}
+  {{- if .Values.jwksResolverExtraRootCA }}
+      - name: extracacerts
+        configMap:
+          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  {{- end }}
+      {{- with .Values.volumes }}
+        {{- toYaml . | nindent 6}}
+      {{- end }}
+
+---
+{{- end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/gateway-class-configmap.yaml b/resources/v1.27.3/charts/istiod/templates/gateway-class-configmap.yaml
new file mode 100644
index 000000000..6b23d716a
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/gateway-class-configmap.yaml
@@ -0,0 +1,20 @@
+{{ range $key, $value := .Values.gatewayClasses }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-{{ $.Values.revision | default "default"  }}-gatewayclass-{{$key}}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    gateway.istio.io/defaults-for-class: {{$key|quote}}
+    {{- include "istio.labels" $ | nindent 4 }}
+data:
+{{ range $kind, $overlay := $value }}
+  {{$kind}}: |
+{{$overlay|toYaml|trim|indent 4}}
+{{ end }}
+---
+{{ end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.27.3/charts/istiod/templates/istiod-injector-configmap.yaml
new file mode 100644
index 000000000..171aff886
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/istiod-injector-configmap.yaml
@@ -0,0 +1,81 @@
+{{- if not .Values.global.omitSidecarInjectorConfigMap }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
+  values: |-
+{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
+{{ $pilotVals := pick .Values "cni" "env" -}}
+{{ $vals = set $vals "pilot" $pilotVals -}}
+{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
+{{ $vals = set $vals "gateways" $gatewayVals -}}
+{{ $vals | toPrettyJson | indent 4 }}
+
+  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
+  # and istiod webhook functionality.
+  #
+  # New fields should not use Values - it is a 'primary' config object, users should be able
+  # to fine tune it or use it with kube-inject.
+  config: |-
+    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
+    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
+    defaultTemplates:
+{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
+    - {{ . }}
+{{- end }}
+    {{- else }}
+    defaultTemplates: [sidecar]
+    {{- end }}
+    policy: {{ .Values.global.proxy.autoInject }}
+    alwaysInjectSelector:
+{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
+    neverInjectSelector:
+{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
+    injectedAnnotations:
+      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
+      "{{ $key }}": {{ $val | quote }}
+      {{- end }}
+    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
+         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
+         This should make it obvious that their installation is broken.
+     */}}
+    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
+    templates:
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
+      sidecar: |
+{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
+      gateway: |
+{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
+      grpc-simple: |
+{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
+      grpc-agent: |
+{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
+      waypoint: |
+{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
+      kube-gateway: |
+{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
+{{- end }}
+{{- with .Values.sidecarInjectorWebhook.templates }}
+{{ toYaml . | trim | indent 6 }}
+{{- end }}
+
+{{- end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.27.3/charts/istiod/templates/mutatingwebhook.yaml
new file mode 100644
index 000000000..ca017194e
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/mutatingwebhook.yaml
@@ -0,0 +1,164 @@
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- /* Core defines the common configuration used by all webhook segments */}}
+{{/* Copy just what we need to avoid expensive deepCopy */}}
+{{- $whv := dict
+"revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "caBundle" .Values.istiodRemote.injectionCABundle
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+    {{- if .caBundle }}
+    caBundle: "{{ .caBundle }}"
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
+{{- if not .Values.global.operatorManageWebhooks }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq .Release.Namespace "istio-system"}}
+  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+{{- else }}
+  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
+
+{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
+{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      {{- if (eq .Values.revision "") }}
+      - "default"
+      {{- else }}
+      - "{{ .Values.revision }}"
+      {{- end }}
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      {{- if (eq .Values.revision "") }}
+      - "default"
+      {{- else }}
+      - "{{ .Values.revision }}"
+      {{- end }}
+
+
+{{- /* Webhooks for default revision */}}
+{{- if (eq .Values.revision "") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+{{- end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.27.3/charts/istiod/templates/poddisruptionbudget.yaml
new file mode 100644
index 000000000..d21cd919d
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/poddisruptionbudget.yaml
@@ -0,0 +1,36 @@
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istiod
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    istio: pilot
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  {{- if and .Values.pdb.minAvailable (not (hasKey .Values.pdb "maxUnavailable")) }}
+  minAvailable: {{ .Values.pdb.minAvailable }}
+  {{- else if .Values.pdb.maxUnavailable }}
+  maxUnavailable: {{ .Values.pdb.maxUnavailable }}
+  {{- end }}
+  {{- if .Values.pdb.unhealthyPodEvictionPolicy }}
+  unhealthyPodEvictionPolicy: {{ .Values.pdb.unhealthyPodEvictionPolicy }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app: istiod
+      {{- if ne .Values.revision "" }}
+      istio.io/rev: {{ .Values.revision | quote }}
+      {{- else }}
+      istio: pilot
+      {{- end }}
+---
+{{- end }}
+{{- end }}
diff --git a/resources/v1.24.1/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.27.3/charts/istiod/templates/reader-clusterrole.yaml
similarity index 100%
rename from resources/v1.24.1/charts/istiod/templates/reader-clusterrole.yaml
rename to resources/v1.27.3/charts/istiod/templates/reader-clusterrole.yaml
diff --git a/resources/v1.24.4/charts/istiod/templates/reader-clusterrolebinding.yaml b/resources/v1.27.3/charts/istiod/templates/reader-clusterrolebinding.yaml
similarity index 100%
rename from resources/v1.24.4/charts/istiod/templates/reader-clusterrolebinding.yaml
rename to resources/v1.27.3/charts/istiod/templates/reader-clusterrolebinding.yaml
diff --git a/resources/v1.27.3/charts/istiod/templates/remote-istiod-endpoints.yaml b/resources/v1.27.3/charts/istiod/templates/remote-istiod-endpoints.yaml
new file mode 100644
index 000000000..f13b8ce9a
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/remote-istiod-endpoints.yaml
@@ -0,0 +1,30 @@
+{{- if and .Values.global.remotePilotAddress .Values.istiodRemote.enabled }}
+# if the remotePilotAddress is an IP addr
+{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
+apiVersion: v1
+kind: Endpoints
+metadata:
+  {{- if .Values.istiodRemote.enabledLocalInjectorIstiod }}
+  # This file is only used for remote `istiod` installs.
+  # only primary `istiod` to xds and local `istiod` injection installs.
+  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
+  {{- else }}
+  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
+  {{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+subsets:
+- addresses:
+  - ip: {{ .Values.global.remotePilotAddress }}
+  ports:
+  - port: 15012
+    name: tcp-istiod
+    protocol: TCP
+  - port: 15017
+    name: tcp-webhook
+    protocol: TCP
+---
+{{- end }}
+{{- end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.27.3/charts/istiod/templates/remote-istiod-service.yaml
new file mode 100644
index 000000000..0a48b9918
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/remote-istiod-service.yaml
@@ -0,0 +1,41 @@
+# This file is only used for remote
+{{- if and .Values.global.remotePilotAddress .Values.istiodRemote.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  {{- if .Values.istiodRemote.enabledLocalInjectorIstiod }}
+  # only primary `istiod` to xds and local `istiod` injection installs.
+  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
+  {{- else }}
+  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
+  {{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    app.kubernetes.io/name: "istiod"
+    {{ include "istio.labels" . | nindent 4 }}
+spec:
+  ports:
+  - port: 15012
+    name: tcp-istiod
+    protocol: TCP
+  - port: 443
+    targetPort: 15017
+    name: tcp-webhook
+    protocol: TCP
+  {{- if and .Values.global.remotePilotAddress (not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress)) }}
+  # if the remotePilotAddress is not an IP addr, we use ExternalName
+  type: ExternalName
+  externalName: {{ .Values.global.remotePilotAddress }}
+  {{- end }}
+{{- if .Values.global.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
+{{- end }}
+{{- if .Values.global.ipFamilies }}
+  ipFamilies:
+{{- range .Values.global.ipFamilies }}
+  - {{ . }}
+{{- end }}
+{{- end }}
+---
+{{- end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/revision-tags.yaml b/resources/v1.27.3/charts/istiod/templates/revision-tags.yaml
new file mode 100644
index 000000000..06764a826
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/revision-tags.yaml
@@ -0,0 +1,149 @@
+# Adapted from istio-discovery/templates/mutatingwebhook.yaml
+# Removed paths for legacy and default selectors since a revision tag
+# is inherently created from a specific revision
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- $whv := dict
+"revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "caBundle" .Values.istiodRemote.injectionCABundle
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+{{- range $tagName := $.Values.revisionTags }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq $.Release.Namespace "istio-system"}}
+  name: istio-revision-tag-{{ $tagName }}
+{{- else }}
+  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/tag: {{ $tagName }}
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+
+{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
+{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
+{{- if (eq $tagName "default") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+---
+{{- end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/role.yaml b/resources/v1.27.3/charts/istiod/templates/role.yaml
new file mode 100644
index 000000000..bbcfbe435
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/role.yaml
@@ -0,0 +1,35 @@
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Values.global.istioNamespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+# permissions to verify the webhook is ready and rejecting
+# invalid config. We use --server-dry-run so no config is persisted.
+- apiGroups: ["networking.istio.io"]
+  verbs: ["create"]
+  resources: ["gateways"]
+
+# For storing CA secret
+- apiGroups: [""]
+  resources: ["secrets"]
+  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
+  verbs: ["create", "get", "watch", "list", "update", "delete"]
+
+# For status controller, so it can delete the distribution report configmap
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["delete"]
+
+# For gateway deployment controller
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  verbs: ["get", "update", "patch", "create"]
+{{- end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/rolebinding.yaml b/resources/v1.27.3/charts/istiod/templates/rolebinding.yaml
new file mode 100644
index 000000000..0c66b38a7
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/rolebinding.yaml
@@ -0,0 +1,21 @@
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Values.global.istioNamespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
+subjects:
+  - kind: ServiceAccount
+    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+    namespace: {{ .Values.global.istioNamespace }}
+{{- end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/service.yaml b/resources/v1.27.3/charts/istiod/templates/service.yaml
new file mode 100644
index 000000000..25bda4dfd
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/service.yaml
@@ -0,0 +1,57 @@
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  {{- if .Values.serviceAnnotations }}
+  annotations:
+{{ toYaml .Values.serviceAnnotations | indent 4 }}
+  {{- end }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: istiod
+    istio: pilot
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  ports:
+    - port: 15010
+      name: grpc-xds # plaintext
+      protocol: TCP
+    - port: 15012
+      name: https-dns # mTLS with k8s-signed cert
+      protocol: TCP
+    - port: 443
+      name: https-webhook # validation and injection
+      targetPort: 15017
+      protocol: TCP
+    - port: 15014
+      name: http-monitoring # prometheus stats
+      protocol: TCP
+  selector:
+    app: istiod
+    {{- if ne .Values.revision "" }}
+    istio.io/rev: {{ .Values.revision | quote }}
+    {{- else }}
+    # Label used by the 'default' service. For versioned deployments we match with app and version.
+    # This avoids default deployment picking the canary
+    istio: pilot
+    {{- end }}
+  {{- if .Values.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.ipFamilyPolicy }}
+  {{- end }}
+  {{- if .Values.ipFamilies }}
+  ipFamilies:
+  {{- range .Values.ipFamilies }}
+  - {{ . }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.trafficDistribution }}
+  trafficDistribution: {{ .Values.trafficDistribution }}
+  {{- end }}
+---
+{{- end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/serviceaccount.yaml b/resources/v1.27.3/charts/istiod/templates/serviceaccount.yaml
new file mode 100644
index 000000000..8b4a0c0fa
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/serviceaccount.yaml
@@ -0,0 +1,24 @@
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+apiVersion: v1
+kind: ServiceAccount
+  {{- if .Values.global.imagePullSecrets }}
+imagePullSecrets:
+  {{- range .Values.global.imagePullSecrets }}
+  - name: {{ . }}
+  {{- end }}
+  {{- end }}
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Values.global.istioNamespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+  {{- if .Values.serviceAccountAnnotations }}
+  annotations:
+{{- toYaml .Values.serviceAccountAnnotations | nindent 4 }}
+  {{- end }}
+{{- end }}
+---
diff --git a/resources/v1.27.3/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.27.3/charts/istiod/templates/validatingadmissionpolicy.yaml
new file mode 100644
index 000000000..8562a52d5
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/validatingadmissionpolicy.yaml
@@ -0,0 +1,63 @@
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+{{- if .Values.experimental.stableValidationPolicy }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
+  labels:
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+        - security.istio.io
+        - networking.istio.io
+        - telemetry.istio.io
+        - extensions.istio.io
+      apiVersions: ["*"]
+      operations:  ["CREATE", "UPDATE"]
+      resources:   ["*"]
+    objectSelector:
+      matchExpressions:
+        - key: istio.io/rev
+          operator: In
+          values:
+          {{- if (eq .Values.revision "") }}
+          - "default"
+          {{- else }}
+          - "{{ .Values.revision }}"
+          {{- end }}
+  variables:
+    - name: isEnvoyFilter
+      expression: "object.kind == 'EnvoyFilter'"
+    - name: isWasmPlugin
+      expression: "object.kind == 'WasmPlugin'"
+    - name: isProxyConfig
+      expression: "object.kind == 'ProxyConfig'"
+    - name: isTelemetry
+      expression: "object.kind == 'Telemetry'"
+  validations:
+    - expression: "!variables.isEnvoyFilter"
+    - expression: "!variables.isWasmPlugin"
+    - expression: "!variables.isProxyConfig"
+    - expression: |
+        !(
+          variables.isTelemetry && (
+            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
+            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
+            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
+          )
+        )
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: "stable-channel-policy-binding{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
+spec:
+  policyName: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
+  validationActions: [Deny]
+{{- end }}
+{{- end }}
diff --git a/resources/v1.27.3/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.27.3/charts/istiod/templates/validatingwebhookconfiguration.yaml
new file mode 100644
index 000000000..b49bf7faf
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/validatingwebhookconfiguration.yaml
@@ -0,0 +1,68 @@
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+{{- if .Values.global.configValidation }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    istio: istiod
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+webhooks:
+  # Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
+  # are rejecting invalid configs on a per-revision basis.
+  - name: rev.validation.istio.io
+    clientConfig:
+      # Should change from base but cannot for API compat
+      {{- if .Values.base.validationURL }}
+      url: {{ .Values.base.validationURL }}
+      {{- else }}
+      service:
+        name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+        namespace: {{ .Values.global.istioNamespace }}
+        path: "/validate"
+      {{- end }}
+      {{- if .Values.base.validationCABundle }}
+      caBundle: "{{ .Values.base.validationCABundle }}"
+      {{- end }}
+    rules:
+      - operations:
+          - CREATE
+          - UPDATE
+        apiGroups:
+          - security.istio.io
+          - networking.istio.io
+          - telemetry.istio.io
+          - extensions.istio.io
+        apiVersions:
+          - "*"
+        resources:
+          - "*"
+    {{- if .Values.base.validationCABundle }}
+    # Disable webhook controller in Pilot to stop patching it
+    failurePolicy: Fail
+    {{- else }}
+    # Fail open until the validation webhook is ready. The webhook controller
+    # will update this to `Fail` and patch in the `caBundle` when the webhook
+    # endpoint is ready.
+    failurePolicy: Ignore
+    {{- end }}
+    sideEffects: None
+    admissionReviewVersions: ["v1"]
+    objectSelector:
+      matchExpressions:
+        - key: istio.io/rev
+          operator: In
+          values:
+          {{- if (eq .Values.revision "") }}
+          - "default"
+          {{- else }}
+          - "{{ .Values.revision }}"
+          {{- end }}
+---
+{{- end }}
+{{- end }}
diff --git a/resources/v1.24.4/charts/istiod/templates/zzy_descope_legacy.yaml b/resources/v1.27.3/charts/istiod/templates/zzy_descope_legacy.yaml
similarity index 100%
rename from resources/v1.24.4/charts/istiod/templates/zzy_descope_legacy.yaml
rename to resources/v1.27.3/charts/istiod/templates/zzy_descope_legacy.yaml
diff --git a/resources/v1.27.3/charts/istiod/templates/zzz_profile.yaml b/resources/v1.27.3/charts/istiod/templates/zzz_profile.yaml
new file mode 100644
index 000000000..3d8495648
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if false }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.27.3/charts/istiod/values.yaml b/resources/v1.27.3/charts/istiod/values.yaml
new file mode 100644
index 000000000..4f0d23eaf
--- /dev/null
+++ b/resources/v1.27.3/charts/istiod/values.yaml
@@ -0,0 +1,569 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  autoscaleBehavior: {}
+  replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+
+  hub: ""
+  tag: ""
+  variant: ""
+
+  # Can be a full hub/image:tag
+  image: pilot
+  traceSampling: 1.0
+
+  # Resources for a small pilot install
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2048Mi
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # Whether to use an existing CNI installation
+  cni:
+    enabled: false
+    provider: default
+
+  # Additional container arguments
+  extraContainerArgs: []
+
+  env: {}
+
+  envVarFrom: []
+
+  # Settings related to the untaint controller
+  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
+  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
+  taint:
+    # Controls whether or not the untaint controller is active
+    enabled: false
+    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
+    namespace: ""
+
+  affinity: {}
+
+  tolerations: []
+
+  cpu:
+    targetAverageUtilization: 80
+  memory: {}
+    # targetAverageUtilization: 80
+
+  # Additional volumeMounts to the istiod container
+  volumeMounts: []
+
+  # Additional volumes to the istiod pod
+  volumes: []
+
+  # Inject initContainers into the istiod pod
+  initContainers: []
+
+  nodeSelector: {}
+  podAnnotations: {}
+  serviceAnnotations: {}
+  serviceAccountAnnotations: {}
+  sidecarInjectorWebhookAnnotations: {}
+
+  topologySpreadConstraints: []
+
+  # You can use jwksResolverExtraRootCA to provide a root certificate
+  # in PEM format. This will then be trusted by pilot when resolving
+  # JWKS URIs.
+  jwksResolverExtraRootCA: ""
+
+  # The following is used to limit how long a sidecar can be connected
+  # to a pilot. It balances out load across pilot instances at the cost of
+  # increasing system churn.
+  keepaliveMaxServerConnectionAge: 30m
+
+  # Additional labels to apply to the deployment.
+  deploymentLabels: {}
+
+  # Annotations to apply to the istiod deployment.
+  deploymentAnnotations: {}
+
+  ## Mesh config settings
+
+  # Install the mesh config map, generated from values.yaml.
+  # If false, pilot wil use default values (by default) or user-supplied values.
+  configMap: true
+
+  # Additional labels to apply on the pod level for monitoring and logging configuration.
+  podLabels: {}
+
+  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
+  ipFamilyPolicy: ""
+  ipFamilies: []
+
+  # Ambient mode only.
+  # Set this if you install ztunnel to a different namespace from `istiod`.
+  # If set, `istiod` will allow connections from trusted node proxy ztunnels
+  # in the provided namespace.
+  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
+  # in the same namespace as itself.
+  trustedZtunnelNamespace: ""
+  # Set this if you install ztunnel with a name different from the default.
+  trustedZtunnelName: ""
+
+  sidecarInjectorWebhook:
+    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
+    # always skip the injection on pods that match that label selector, regardless of the global policy.
+    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
+    neverInjectSelector: []
+    alwaysInjectSelector: []
+
+    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
+    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
+    #
+    # annotations:
+    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+    #
+    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
+    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
+    # injectedAnnotations:
+    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
+    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
+    injectedAnnotations: {}
+
+    # This enables injection of sidecar in all namespaces,
+    # with the exception of namespaces with "istio-injection:disabled" annotation
+    # Only one environment should have this enabled.
+    enableNamespacesByDefault: false
+
+    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
+    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
+    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
+    reinvocationPolicy: Never
+
+    rewriteAppHTTPProbe: true
+
+    # Templates defines a set of custom injection templates that can be used. For example, defining:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
+    # being injected with the hello=world labels.
+    # This is intended for advanced configuration only; most users should use the built in template
+    templates: {}
+
+    # Default templates specifies a set of default templates that are used in sidecar injection.
+    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
+    # To inject other additional templates, define it using the `templates` option, and add it to
+    # the default templates list.
+    # For example:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # defaultTemplates: ["sidecar", "hello"]
+    defaultTemplates: []
+  istiodRemote:
+    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
+    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
+    # to utilize a remote instance.
+    enabled: false
+
+    # If `true`, indicates that this cluster/install should consume a "local istiod" installation,
+    # local istiod inject sidecars
+    enabledLocalInjectorIstiod: false
+
+    # Sidecar injector mutating webhook configuration clientConfig.url value.
+    # For example: https://$remotePilotAddress:15017/inject
+    # The host should not refer to a service running in the cluster; use a service reference by specifying
+    # the clientConfig.service field instead.
+    injectionURL: ""
+
+    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
+    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
+    injectionPath: "/inject"
+
+    injectionCABundle: ""
+  telemetry:
+    enabled: true
+    v2:
+      # For Null VM case now.
+      # This also enables metadata exchange.
+      enabled: true
+      # Indicate if prometheus stats filter is enabled or not
+      prometheus:
+        enabled: true
+      # stackdriver filter settings.
+      stackdriver:
+        enabled: false
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # Revision tags are aliases to Istio control plane revisions
+  revisionTags: []
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
+  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
+  meshConfig:
+    enablePrometheusMerge: true
+
+  experimental:
+    stableValidationPolicy: false
+
+  global:
+    # Used to locate istiod.
+    istioNamespace: istio-system
+    # List of cert-signers to allow "approve" action in the istio cluster role
+    #
+    # certSigners:
+    #   - clusterissuers.cert-manager.io/istio-ca
+    certSigners: []
+    # enable pod disruption budget for the control plane, which is used to
+    # ensure Istio control plane components are gradually upgraded or recovered.
+    defaultPodDisruptionBudget:
+      enabled: true
+      # The values aren't mutable due to a current PodDisruptionBudget limitation
+      # minAvailable: 1
+
+    # A minimal set of requested resources to applied to all deployments so that
+    # Horizontal Pod Autoscaler will be able to function (if set).
+    # Each component can overwrite these default values by adding its own resources
+    # block in the relevant section below and setting the desired resources values.
+    defaultResources:
+      requests:
+        cpu: 10m
+      #   memory: 128Mi
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+    # Default tag for Istio images.
+    tag: 1.27.3
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Enabled by default in master for maximising testing.
+    istiod:
+      enableAnalysis: false
+
+    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
+    logAsJson: false
+
+    # In order to use native nftable rules instead of iptable rules, set this flag to true.
+    nativeNftables: false
+
+    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+    # The control plane has different scopes depending on component, but can configure default log level across all components
+    # If empty, default scope and level will be used as configured in code
+    logging:
+      level: "default:info"
+
+    omitSidecarInjectorConfigMap: false
+
+    # Configure whether Operator manages webhook configurations. The current behavior
+    # of Istiod is to manage its own webhook configurations.
+    # When this option is set as true, Istio Operator, instead of webhooks, manages the
+    # webhook configurations. When this option is set as false, webhooks manage their
+    # own webhook configurations.
+    operatorManageWebhooks: false
+
+    # Custom DNS config for the pod to resolve names of services in other
+    # clusters. Use this to add additional search domains, and other settings.
+    # see
+    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
+    # This does not apply to gateway pods as they typically need a different
+    # set of DNS settings than the normal application pods (e.g., in
+    # multicluster scenarios).
+    # NOTE: If using templates, follow the pattern in the commented example below.
+    #podDNSSearchNamespaces:
+    #- global
+    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
+
+    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
+    # system-node-critical, it is better to configure this in order to make sure your Istio pods
+    # will not be killed because of low priority class.
+    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+    # for more detail.
+    priorityClassName: ""
+
+    proxy:
+      image: proxyv2
+
+      # This controls the 'policy' in the sidecar injector.
+      autoInject: enabled
+
+      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
+      # cluster domain. Default value is "cluster.local".
+      clusterDomain: "cluster.local"
+
+      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
+      # not set, then the global "logLevel" will be used.
+      componentLogLevel: "misc:error"
+
+      # istio ingress capture allowlist
+      # examples:
+      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
+      excludeInboundPorts: ""
+      includeInboundPorts: "*"
+
+      # istio egress capture allowlist
+      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
+      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
+      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
+      # be allowed by the sidecar
+      includeIPRanges: "*"
+      excludeIPRanges: ""
+      includeOutboundPorts: ""
+      excludeOutboundPorts: ""
+
+      # Log level for proxy, applies to gateways and sidecars.
+      # Expected values are: trace|debug|info|warning|error|critical|off
+      logLevel: warning
+
+      # Specify the path to the outlier event log.
+      # Example: /dev/stdout
+      outlierLogPath: ""
+
+      #If set to true, istio-proxy container will have privileged securityContext
+      privileged: false
+
+      # The number of successive failed probes before indicating readiness failure.
+      readinessFailureThreshold: 4
+
+      # The initial delay for readiness probes in seconds.
+      readinessInitialDelaySeconds: 0
+
+      # The period between readiness probes.
+      readinessPeriodSeconds: 15
+
+      # Enables or disables a startup probe.
+      # For optimal startup times, changing this should be tied to the readiness probe values.
+      #
+      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
+      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
+      # and doesn't spam the readiness endpoint too much
+      #
+      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
+      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
+      startupProbe:
+        enabled: true
+        failureThreshold: 600 # 10 minutes
+
+      # Resources for the sidecar.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: 2000m
+          memory: 1024Mi
+
+      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
+      statusPort: 15020
+
+      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
+      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
+      tracer: "none"
+
+    proxy_init:
+      # Base name for the proxy_init container, used to configure iptables.
+      image: proxyv2
+      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
+      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
+      forceApplyIptables: false
+
+    # configure remote pilot and istiod service and endpoint
+    remotePilotAddress: ""
+
+    ##############################################################################################
+    # The following values are found in other charts. To effectively modify these values, make   #
+    # make sure they are consistent across your Istio helm charts                                #
+    ##############################################################################################
+
+    # The customized CA address to retrieve certificates for the pods in the cluster.
+    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+    # If not set explicitly, default to the Istio discovery address.
+    caAddress: ""
+
+    # Enable control of remote clusters.
+    externalIstiod: false
+
+    # Configure a remote cluster as the config cluster for an external istiod.
+    configCluster: false
+
+    # configValidation enables the validation webhook for Istio configuration.
+    configValidation: true
+
+    # Mesh ID means Mesh Identifier. It should be unique within the scope where
+    # meshes will interact with each other, but it is not required to be
+    # globally/universally unique. For example, if any of the following are true,
+    # then two meshes must have different Mesh IDs:
+    # - Meshes will have their telemetry aggregated in one place
+    # - Meshes will be federated together
+    # - Policy will be written referencing one mesh from the other
+    #
+    # If an administrator expects that any of these conditions may become true in
+    # the future, they should ensure their meshes have different Mesh IDs
+    # assigned.
+    #
+    # Within a multicluster mesh, each cluster must be (manually or auto)
+    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
+    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
+    # of migration TBD, and it may be a disruptive operation to change the Mesh
+    # ID post-install.
+    #
+    # If the mesh admin does not specify a value, Istio will use the value of the
+    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
+    # value.
+    meshID: ""
+
+    # Configure the mesh networks to be used by the Split Horizon EDS.
+    #
+    # The following example defines two networks with different endpoints association methods.
+    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
+    # mapped to network1. The gateway for this network example is specified by its public IP
+    # address and port.
+    # The second network, `network2`, in this example is defined differently with all endpoints
+    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
+    # gateway is also defined differently with the name of the gateway service on the remote
+    # cluster. The public IP for the gateway will be determined from that remote service (only
+    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
+    # it still need to be configured manually).
+    #
+    # meshNetworks:
+    #   network1:
+    #     endpoints:
+    #     - fromCidr: "192.168.0.1/24"
+    #     gateways:
+    #     - address: 1.1.1.1
+    #       port: 80
+    #   network2:
+    #     endpoints:
+    #     - fromRegistry: reg1
+    #     gateways:
+    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
+    #       port: 443
+    #
+    meshNetworks: {}
+
+    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
+    mountMtlsCerts: false
+
+    multiCluster:
+      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
+      # to properly label proxies
+      clusterName: ""
+
+    # Network defines the network this cluster belong to. This name
+    # corresponds to the networks in the map of mesh networks.
+    network: ""
+
+    # Configure the certificate provider for control plane communication.
+    # Currently, two providers are supported: "kubernetes" and "istiod".
+    # As some platforms may not have kubernetes signing APIs,
+    # Istiod is the default
+    pilotCertProvider: istiod
+
+    sds:
+      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
+      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
+      # JWT is intended for the CA.
+      token:
+        aud: istio-ca
+
+    sts:
+      # The service port used by Security Token Service (STS) server to handle token exchange requests.
+      # Setting this port to a non-zero value enables STS server.
+      servicePort: 0
+
+    # The name of the CA for workload certificates.
+    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
+    # will be used as the certificates for workloads.
+    # The default value is "" and when caName="", the CA will be configured by other
+    # mechanisms (e.g., environmental variable CA_PROVIDER).
+    caName: ""
+
+    waypoint:
+      # Resources for the waypoint proxy.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: "2"
+          memory: 1Gi
+
+      # If specified, affinity defines the scheduling constraints of waypoint pods.
+      affinity: {}
+
+      # Topology Spread Constraints for the waypoint proxy.
+      topologySpreadConstraints: []
+
+      # Node labels for the waypoint proxy.
+      nodeSelector: {}
+
+      # Tolerations for the waypoint proxy.
+      tolerations: []
+
+  base:
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  # Gateway Settings
+  gateways:
+    # Define the security context for the pod.
+    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+    securityContext: {}
+
+    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
+    seccompProfile: {}
+
+  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
+  # For example:
+  # gatewayClasses:
+  #   istio:
+  #     service:
+  #       spec:
+  #         type: ClusterIP
+  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
+  gatewayClasses: {}
+  
+  pdb:
+    # -- Minimum available pods set in PodDisruptionBudget.
+    # Define either 'minAvailable' or 'maxUnavailable', never both.
+    minAvailable: 1
+    # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
+    # maxUnavailable: 1
+    # -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.
+    # Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/
+    unhealthyPodEvictionPolicy: ""
diff --git a/resources/v1.27.3/charts/revisiontags/Chart.yaml b/resources/v1.27.3/charts/revisiontags/Chart.yaml
new file mode 100644
index 000000000..23bf542f1
--- /dev/null
+++ b/resources/v1.27.3/charts/revisiontags/Chart.yaml
@@ -0,0 +1,8 @@
+apiVersion: v2
+appVersion: 1.27.3
+description: Helm chart for istio revision tags
+name: revisiontags
+sources:
+- https://github.com/istio-ecosystem/sail-operator
+version: 0.1.0
+
diff --git a/resources/v1.27.3/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.27.3/charts/revisiontags/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.27.3/charts/revisiontags/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.27.3/charts/revisiontags/files/profile-compatibility-version-1.24.yaml b/resources/v1.27.3/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..4f3dbef7e
--- /dev/null
+++ b/resources/v1.27.3/charts/revisiontags/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,15 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.3/charts/revisiontags/files/profile-compatibility-version-1.25.yaml b/resources/v1.27.3/charts/revisiontags/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..b2f45948c
--- /dev/null
+++ b/resources/v1.27.3/charts/revisiontags/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.3/charts/revisiontags/files/profile-compatibility-version-1.26.yaml b/resources/v1.27.3/charts/revisiontags/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..af1069732
--- /dev/null
+++ b/resources/v1.27.3/charts/revisiontags/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
\ No newline at end of file
diff --git a/resources/v1.25.5/charts/revisiontags/files/profile-demo.yaml b/resources/v1.27.3/charts/revisiontags/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.5/charts/revisiontags/files/profile-demo.yaml
rename to resources/v1.27.3/charts/revisiontags/files/profile-demo.yaml
diff --git a/resources/v1.27.3/charts/revisiontags/files/profile-platform-gke.yaml b/resources/v1.27.3/charts/revisiontags/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.27.3/charts/revisiontags/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.4/charts/revisiontags/files/profile-platform-k3d.yaml b/resources/v1.27.3/charts/revisiontags/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.4/charts/revisiontags/files/profile-platform-k3d.yaml
rename to resources/v1.27.3/charts/revisiontags/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.5/charts/revisiontags/files/profile-platform-k3s.yaml b/resources/v1.27.3/charts/revisiontags/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.5/charts/revisiontags/files/profile-platform-k3s.yaml
rename to resources/v1.27.3/charts/revisiontags/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.4/charts/revisiontags/files/profile-platform-microk8s.yaml b/resources/v1.27.3/charts/revisiontags/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.4/charts/revisiontags/files/profile-platform-microk8s.yaml
rename to resources/v1.27.3/charts/revisiontags/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.4/charts/revisiontags/files/profile-platform-minikube.yaml b/resources/v1.27.3/charts/revisiontags/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.4/charts/revisiontags/files/profile-platform-minikube.yaml
rename to resources/v1.27.3/charts/revisiontags/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.4/charts/revisiontags/files/profile-platform-openshift.yaml b/resources/v1.27.3/charts/revisiontags/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.4/charts/revisiontags/files/profile-platform-openshift.yaml
rename to resources/v1.27.3/charts/revisiontags/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.4/charts/revisiontags/files/profile-preview.yaml b/resources/v1.27.3/charts/revisiontags/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.4/charts/revisiontags/files/profile-preview.yaml
rename to resources/v1.27.3/charts/revisiontags/files/profile-preview.yaml
diff --git a/resources/v1.24.4/charts/revisiontags/files/profile-remote.yaml b/resources/v1.27.3/charts/revisiontags/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.4/charts/revisiontags/files/profile-remote.yaml
rename to resources/v1.27.3/charts/revisiontags/files/profile-remote.yaml
diff --git a/resources/v1.24.4/charts/revisiontags/files/profile-stable.yaml b/resources/v1.27.3/charts/revisiontags/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.4/charts/revisiontags/files/profile-stable.yaml
rename to resources/v1.27.3/charts/revisiontags/files/profile-stable.yaml
diff --git a/resources/v1.27.3/charts/revisiontags/templates/revision-tags.yaml b/resources/v1.27.3/charts/revisiontags/templates/revision-tags.yaml
new file mode 100644
index 000000000..06764a826
--- /dev/null
+++ b/resources/v1.27.3/charts/revisiontags/templates/revision-tags.yaml
@@ -0,0 +1,149 @@
+# Adapted from istio-discovery/templates/mutatingwebhook.yaml
+# Removed paths for legacy and default selectors since a revision tag
+# is inherently created from a specific revision
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- $whv := dict
+"revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "caBundle" .Values.istiodRemote.injectionCABundle
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+{{- range $tagName := $.Values.revisionTags }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq $.Release.Namespace "istio-system"}}
+  name: istio-revision-tag-{{ $tagName }}
+{{- else }}
+  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/tag: {{ $tagName }}
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+
+{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
+{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
+{{- if (eq $tagName "default") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+---
+{{- end }}
diff --git a/resources/v1.27.3/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.27.3/charts/revisiontags/templates/zzz_profile.yaml
new file mode 100644
index 000000000..3d8495648
--- /dev/null
+++ b/resources/v1.27.3/charts/revisiontags/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if false }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.27.3/charts/revisiontags/values.yaml b/resources/v1.27.3/charts/revisiontags/values.yaml
new file mode 100644
index 000000000..4f0d23eaf
--- /dev/null
+++ b/resources/v1.27.3/charts/revisiontags/values.yaml
@@ -0,0 +1,569 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  autoscaleBehavior: {}
+  replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+
+  hub: ""
+  tag: ""
+  variant: ""
+
+  # Can be a full hub/image:tag
+  image: pilot
+  traceSampling: 1.0
+
+  # Resources for a small pilot install
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2048Mi
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # Whether to use an existing CNI installation
+  cni:
+    enabled: false
+    provider: default
+
+  # Additional container arguments
+  extraContainerArgs: []
+
+  env: {}
+
+  envVarFrom: []
+
+  # Settings related to the untaint controller
+  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
+  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
+  taint:
+    # Controls whether or not the untaint controller is active
+    enabled: false
+    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
+    namespace: ""
+
+  affinity: {}
+
+  tolerations: []
+
+  cpu:
+    targetAverageUtilization: 80
+  memory: {}
+    # targetAverageUtilization: 80
+
+  # Additional volumeMounts to the istiod container
+  volumeMounts: []
+
+  # Additional volumes to the istiod pod
+  volumes: []
+
+  # Inject initContainers into the istiod pod
+  initContainers: []
+
+  nodeSelector: {}
+  podAnnotations: {}
+  serviceAnnotations: {}
+  serviceAccountAnnotations: {}
+  sidecarInjectorWebhookAnnotations: {}
+
+  topologySpreadConstraints: []
+
+  # You can use jwksResolverExtraRootCA to provide a root certificate
+  # in PEM format. This will then be trusted by pilot when resolving
+  # JWKS URIs.
+  jwksResolverExtraRootCA: ""
+
+  # The following is used to limit how long a sidecar can be connected
+  # to a pilot. It balances out load across pilot instances at the cost of
+  # increasing system churn.
+  keepaliveMaxServerConnectionAge: 30m
+
+  # Additional labels to apply to the deployment.
+  deploymentLabels: {}
+
+  # Annotations to apply to the istiod deployment.
+  deploymentAnnotations: {}
+
+  ## Mesh config settings
+
+  # Install the mesh config map, generated from values.yaml.
+  # If false, pilot wil use default values (by default) or user-supplied values.
+  configMap: true
+
+  # Additional labels to apply on the pod level for monitoring and logging configuration.
+  podLabels: {}
+
+  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
+  ipFamilyPolicy: ""
+  ipFamilies: []
+
+  # Ambient mode only.
+  # Set this if you install ztunnel to a different namespace from `istiod`.
+  # If set, `istiod` will allow connections from trusted node proxy ztunnels
+  # in the provided namespace.
+  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
+  # in the same namespace as itself.
+  trustedZtunnelNamespace: ""
+  # Set this if you install ztunnel with a name different from the default.
+  trustedZtunnelName: ""
+
+  sidecarInjectorWebhook:
+    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
+    # always skip the injection on pods that match that label selector, regardless of the global policy.
+    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
+    neverInjectSelector: []
+    alwaysInjectSelector: []
+
+    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
+    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
+    #
+    # annotations:
+    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+    #
+    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
+    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
+    # injectedAnnotations:
+    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
+    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
+    injectedAnnotations: {}
+
+    # This enables injection of sidecar in all namespaces,
+    # with the exception of namespaces with "istio-injection:disabled" annotation
+    # Only one environment should have this enabled.
+    enableNamespacesByDefault: false
+
+    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
+    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
+    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
+    reinvocationPolicy: Never
+
+    rewriteAppHTTPProbe: true
+
+    # Templates defines a set of custom injection templates that can be used. For example, defining:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
+    # being injected with the hello=world labels.
+    # This is intended for advanced configuration only; most users should use the built in template
+    templates: {}
+
+    # Default templates specifies a set of default templates that are used in sidecar injection.
+    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
+    # To inject other additional templates, define it using the `templates` option, and add it to
+    # the default templates list.
+    # For example:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # defaultTemplates: ["sidecar", "hello"]
+    defaultTemplates: []
+  istiodRemote:
+    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
+    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
+    # to utilize a remote instance.
+    enabled: false
+
+    # If `true`, indicates that this cluster/install should consume a "local istiod" installation,
+    # local istiod inject sidecars
+    enabledLocalInjectorIstiod: false
+
+    # Sidecar injector mutating webhook configuration clientConfig.url value.
+    # For example: https://$remotePilotAddress:15017/inject
+    # The host should not refer to a service running in the cluster; use a service reference by specifying
+    # the clientConfig.service field instead.
+    injectionURL: ""
+
+    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
+    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
+    injectionPath: "/inject"
+
+    injectionCABundle: ""
+  telemetry:
+    enabled: true
+    v2:
+      # For Null VM case now.
+      # This also enables metadata exchange.
+      enabled: true
+      # Indicate if prometheus stats filter is enabled or not
+      prometheus:
+        enabled: true
+      # stackdriver filter settings.
+      stackdriver:
+        enabled: false
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # Revision tags are aliases to Istio control plane revisions
+  revisionTags: []
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
+  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
+  meshConfig:
+    enablePrometheusMerge: true
+
+  experimental:
+    stableValidationPolicy: false
+
+  global:
+    # Used to locate istiod.
+    istioNamespace: istio-system
+    # List of cert-signers to allow "approve" action in the istio cluster role
+    #
+    # certSigners:
+    #   - clusterissuers.cert-manager.io/istio-ca
+    certSigners: []
+    # enable pod disruption budget for the control plane, which is used to
+    # ensure Istio control plane components are gradually upgraded or recovered.
+    defaultPodDisruptionBudget:
+      enabled: true
+      # The values aren't mutable due to a current PodDisruptionBudget limitation
+      # minAvailable: 1
+
+    # A minimal set of requested resources to applied to all deployments so that
+    # Horizontal Pod Autoscaler will be able to function (if set).
+    # Each component can overwrite these default values by adding its own resources
+    # block in the relevant section below and setting the desired resources values.
+    defaultResources:
+      requests:
+        cpu: 10m
+      #   memory: 128Mi
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+    # Default tag for Istio images.
+    tag: 1.27.3
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Enabled by default in master for maximising testing.
+    istiod:
+      enableAnalysis: false
+
+    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
+    logAsJson: false
+
+    # In order to use native nftable rules instead of iptable rules, set this flag to true.
+    nativeNftables: false
+
+    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+    # The control plane has different scopes depending on component, but can configure default log level across all components
+    # If empty, default scope and level will be used as configured in code
+    logging:
+      level: "default:info"
+
+    omitSidecarInjectorConfigMap: false
+
+    # Configure whether Operator manages webhook configurations. The current behavior
+    # of Istiod is to manage its own webhook configurations.
+    # When this option is set as true, Istio Operator, instead of webhooks, manages the
+    # webhook configurations. When this option is set as false, webhooks manage their
+    # own webhook configurations.
+    operatorManageWebhooks: false
+
+    # Custom DNS config for the pod to resolve names of services in other
+    # clusters. Use this to add additional search domains, and other settings.
+    # see
+    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
+    # This does not apply to gateway pods as they typically need a different
+    # set of DNS settings than the normal application pods (e.g., in
+    # multicluster scenarios).
+    # NOTE: If using templates, follow the pattern in the commented example below.
+    #podDNSSearchNamespaces:
+    #- global
+    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
+
+    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
+    # system-node-critical, it is better to configure this in order to make sure your Istio pods
+    # will not be killed because of low priority class.
+    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+    # for more detail.
+    priorityClassName: ""
+
+    proxy:
+      image: proxyv2
+
+      # This controls the 'policy' in the sidecar injector.
+      autoInject: enabled
+
+      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
+      # cluster domain. Default value is "cluster.local".
+      clusterDomain: "cluster.local"
+
+      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
+      # not set, then the global "logLevel" will be used.
+      componentLogLevel: "misc:error"
+
+      # istio ingress capture allowlist
+      # examples:
+      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
+      excludeInboundPorts: ""
+      includeInboundPorts: "*"
+
+      # istio egress capture allowlist
+      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
+      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
+      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
+      # be allowed by the sidecar
+      includeIPRanges: "*"
+      excludeIPRanges: ""
+      includeOutboundPorts: ""
+      excludeOutboundPorts: ""
+
+      # Log level for proxy, applies to gateways and sidecars.
+      # Expected values are: trace|debug|info|warning|error|critical|off
+      logLevel: warning
+
+      # Specify the path to the outlier event log.
+      # Example: /dev/stdout
+      outlierLogPath: ""
+
+      #If set to true, istio-proxy container will have privileged securityContext
+      privileged: false
+
+      # The number of successive failed probes before indicating readiness failure.
+      readinessFailureThreshold: 4
+
+      # The initial delay for readiness probes in seconds.
+      readinessInitialDelaySeconds: 0
+
+      # The period between readiness probes.
+      readinessPeriodSeconds: 15
+
+      # Enables or disables a startup probe.
+      # For optimal startup times, changing this should be tied to the readiness probe values.
+      #
+      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
+      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
+      # and doesn't spam the readiness endpoint too much
+      #
+      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
+      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
+      startupProbe:
+        enabled: true
+        failureThreshold: 600 # 10 minutes
+
+      # Resources for the sidecar.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: 2000m
+          memory: 1024Mi
+
+      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
+      statusPort: 15020
+
+      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
+      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
+      tracer: "none"
+
+    proxy_init:
+      # Base name for the proxy_init container, used to configure iptables.
+      image: proxyv2
+      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
+      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
+      forceApplyIptables: false
+
+    # configure remote pilot and istiod service and endpoint
+    remotePilotAddress: ""
+
+    ##############################################################################################
+    # The following values are found in other charts. To effectively modify these values, make   #
+    # make sure they are consistent across your Istio helm charts                                #
+    ##############################################################################################
+
+    # The customized CA address to retrieve certificates for the pods in the cluster.
+    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+    # If not set explicitly, default to the Istio discovery address.
+    caAddress: ""
+
+    # Enable control of remote clusters.
+    externalIstiod: false
+
+    # Configure a remote cluster as the config cluster for an external istiod.
+    configCluster: false
+
+    # configValidation enables the validation webhook for Istio configuration.
+    configValidation: true
+
+    # Mesh ID means Mesh Identifier. It should be unique within the scope where
+    # meshes will interact with each other, but it is not required to be
+    # globally/universally unique. For example, if any of the following are true,
+    # then two meshes must have different Mesh IDs:
+    # - Meshes will have their telemetry aggregated in one place
+    # - Meshes will be federated together
+    # - Policy will be written referencing one mesh from the other
+    #
+    # If an administrator expects that any of these conditions may become true in
+    # the future, they should ensure their meshes have different Mesh IDs
+    # assigned.
+    #
+    # Within a multicluster mesh, each cluster must be (manually or auto)
+    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
+    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
+    # of migration TBD, and it may be a disruptive operation to change the Mesh
+    # ID post-install.
+    #
+    # If the mesh admin does not specify a value, Istio will use the value of the
+    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
+    # value.
+    meshID: ""
+
+    # Configure the mesh networks to be used by the Split Horizon EDS.
+    #
+    # The following example defines two networks with different endpoints association methods.
+    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
+    # mapped to network1. The gateway for this network example is specified by its public IP
+    # address and port.
+    # The second network, `network2`, in this example is defined differently with all endpoints
+    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
+    # gateway is also defined differently with the name of the gateway service on the remote
+    # cluster. The public IP for the gateway will be determined from that remote service (only
+    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
+    # it still need to be configured manually).
+    #
+    # meshNetworks:
+    #   network1:
+    #     endpoints:
+    #     - fromCidr: "192.168.0.1/24"
+    #     gateways:
+    #     - address: 1.1.1.1
+    #       port: 80
+    #   network2:
+    #     endpoints:
+    #     - fromRegistry: reg1
+    #     gateways:
+    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
+    #       port: 443
+    #
+    meshNetworks: {}
+
+    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
+    mountMtlsCerts: false
+
+    multiCluster:
+      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
+      # to properly label proxies
+      clusterName: ""
+
+    # Network defines the network this cluster belong to. This name
+    # corresponds to the networks in the map of mesh networks.
+    network: ""
+
+    # Configure the certificate provider for control plane communication.
+    # Currently, two providers are supported: "kubernetes" and "istiod".
+    # As some platforms may not have kubernetes signing APIs,
+    # Istiod is the default
+    pilotCertProvider: istiod
+
+    sds:
+      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
+      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
+      # JWT is intended for the CA.
+      token:
+        aud: istio-ca
+
+    sts:
+      # The service port used by Security Token Service (STS) server to handle token exchange requests.
+      # Setting this port to a non-zero value enables STS server.
+      servicePort: 0
+
+    # The name of the CA for workload certificates.
+    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
+    # will be used as the certificates for workloads.
+    # The default value is "" and when caName="", the CA will be configured by other
+    # mechanisms (e.g., environmental variable CA_PROVIDER).
+    caName: ""
+
+    waypoint:
+      # Resources for the waypoint proxy.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: "2"
+          memory: 1Gi
+
+      # If specified, affinity defines the scheduling constraints of waypoint pods.
+      affinity: {}
+
+      # Topology Spread Constraints for the waypoint proxy.
+      topologySpreadConstraints: []
+
+      # Node labels for the waypoint proxy.
+      nodeSelector: {}
+
+      # Tolerations for the waypoint proxy.
+      tolerations: []
+
+  base:
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  # Gateway Settings
+  gateways:
+    # Define the security context for the pod.
+    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+    securityContext: {}
+
+    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
+    seccompProfile: {}
+
+  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
+  # For example:
+  # gatewayClasses:
+  #   istio:
+  #     service:
+  #       spec:
+  #         type: ClusterIP
+  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
+  gatewayClasses: {}
+  
+  pdb:
+    # -- Minimum available pods set in PodDisruptionBudget.
+    # Define either 'minAvailable' or 'maxUnavailable', never both.
+    minAvailable: 1
+    # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
+    # maxUnavailable: 1
+    # -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.
+    # Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/
+    unhealthyPodEvictionPolicy: ""
diff --git a/resources/v1.27.3/charts/ztunnel/Chart.yaml b/resources/v1.27.3/charts/ztunnel/Chart.yaml
new file mode 100644
index 000000000..24ef047b4
--- /dev/null
+++ b/resources/v1.27.3/charts/ztunnel/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+appVersion: 1.27.3
+description: Helm chart for istio ztunnel components
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio-ztunnel
+- istio
+name: ztunnel
+sources:
+- https://github.com/istio/istio
+version: 1.27.3
diff --git a/resources/v1.24.4/charts/ztunnel/README.md b/resources/v1.27.3/charts/ztunnel/README.md
similarity index 100%
rename from resources/v1.24.4/charts/ztunnel/README.md
rename to resources/v1.27.3/charts/ztunnel/README.md
diff --git a/resources/v1.27.3/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.27.3/charts/ztunnel/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.27.3/charts/ztunnel/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.27.3/charts/ztunnel/files/profile-compatibility-version-1.24.yaml b/resources/v1.27.3/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
new file mode 100644
index 000000000..4f3dbef7e
--- /dev/null
+++ b/resources/v1.27.3/charts/ztunnel/files/profile-compatibility-version-1.24.yaml
@@ -0,0 +1,15 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.24 behavioral changes
+    PILOT_ENABLE_IP_AUTOALLOCATE: "false"
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  dnsCapture: false
+  reconcileIptablesOnStartup: false
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.3/charts/ztunnel/files/profile-compatibility-version-1.25.yaml b/resources/v1.27.3/charts/ztunnel/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..b2f45948c
--- /dev/null
+++ b/resources/v1.27.3/charts/ztunnel/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.27.3/charts/ztunnel/files/profile-compatibility-version-1.26.yaml b/resources/v1.27.3/charts/ztunnel/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..af1069732
--- /dev/null
+++ b/resources/v1.27.3/charts/ztunnel/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
\ No newline at end of file
diff --git a/resources/v1.25.5/charts/ztunnel/files/profile-demo.yaml b/resources/v1.27.3/charts/ztunnel/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.25.5/charts/ztunnel/files/profile-demo.yaml
rename to resources/v1.27.3/charts/ztunnel/files/profile-demo.yaml
diff --git a/resources/v1.27.3/charts/ztunnel/files/profile-platform-gke.yaml b/resources/v1.27.3/charts/ztunnel/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.27.3/charts/ztunnel/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.4/charts/ztunnel/files/profile-platform-k3d.yaml b/resources/v1.27.3/charts/ztunnel/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.4/charts/ztunnel/files/profile-platform-k3d.yaml
rename to resources/v1.27.3/charts/ztunnel/files/profile-platform-k3d.yaml
diff --git a/resources/v1.25.5/charts/ztunnel/files/profile-platform-k3s.yaml b/resources/v1.27.3/charts/ztunnel/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.25.5/charts/ztunnel/files/profile-platform-k3s.yaml
rename to resources/v1.27.3/charts/ztunnel/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.4/charts/ztunnel/files/profile-platform-microk8s.yaml b/resources/v1.27.3/charts/ztunnel/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.4/charts/ztunnel/files/profile-platform-microk8s.yaml
rename to resources/v1.27.3/charts/ztunnel/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.4/charts/ztunnel/files/profile-platform-minikube.yaml b/resources/v1.27.3/charts/ztunnel/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.4/charts/ztunnel/files/profile-platform-minikube.yaml
rename to resources/v1.27.3/charts/ztunnel/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.4/charts/ztunnel/files/profile-platform-openshift.yaml b/resources/v1.27.3/charts/ztunnel/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.4/charts/ztunnel/files/profile-platform-openshift.yaml
rename to resources/v1.27.3/charts/ztunnel/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.4/charts/ztunnel/files/profile-preview.yaml b/resources/v1.27.3/charts/ztunnel/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.4/charts/ztunnel/files/profile-preview.yaml
rename to resources/v1.27.3/charts/ztunnel/files/profile-preview.yaml
diff --git a/resources/v1.24.4/charts/ztunnel/files/profile-remote.yaml b/resources/v1.27.3/charts/ztunnel/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.4/charts/ztunnel/files/profile-remote.yaml
rename to resources/v1.27.3/charts/ztunnel/files/profile-remote.yaml
diff --git a/resources/v1.24.4/charts/ztunnel/files/profile-stable.yaml b/resources/v1.27.3/charts/ztunnel/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.4/charts/ztunnel/files/profile-stable.yaml
rename to resources/v1.27.3/charts/ztunnel/files/profile-stable.yaml
diff --git a/resources/v1.24.4/charts/ztunnel/templates/NOTES.txt b/resources/v1.27.3/charts/ztunnel/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.4/charts/ztunnel/templates/NOTES.txt
rename to resources/v1.27.3/charts/ztunnel/templates/NOTES.txt
diff --git a/resources/v1.27.3/charts/ztunnel/templates/_helpers.tpl b/resources/v1.27.3/charts/ztunnel/templates/_helpers.tpl
new file mode 100644
index 000000000..46a7a0b79
--- /dev/null
+++ b/resources/v1.27.3/charts/ztunnel/templates/_helpers.tpl
@@ -0,0 +1 @@
+{{ define "ztunnel.release-name" }}{{ .Values.resourceName| default "ztunnel" }}{{ end }}
diff --git a/resources/v1.27.3/charts/ztunnel/templates/daemonset.yaml b/resources/v1.27.3/charts/ztunnel/templates/daemonset.yaml
new file mode 100644
index 000000000..7de85a2d1
--- /dev/null
+++ b/resources/v1.27.3/charts/ztunnel/templates/daemonset.yaml
@@ -0,0 +1,210 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
+  annotations:
+{{- if .Values.revision }}
+    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
+    {{- toYaml $annos | nindent 4}}
+{{- else }}
+    {{- .Values.annotations | toYaml | nindent 4 }}
+{{- end }}
+spec:
+  {{- with .Values.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app: ztunnel
+  template:
+    metadata:
+      labels:
+        sidecar.istio.io/inject: "false"
+        istio.io/dataplane-mode: none
+        app: ztunnel
+        app.kubernetes.io/name: ztunnel
+        {{- include "istio.labels" . | nindent 8}}
+{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+{{- if .Values.revision }}
+        istio.io/rev: {{ .Values.revision }}
+{{- end }}
+{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
+    spec:
+      nodeSelector:
+        kubernetes.io/os: linux
+{{- if .Values.nodeSelector }}
+{{ toYaml .Values.nodeSelector | indent 8 }}
+{{- end }}
+{{- if .Values.affinity }}
+      affinity:
+{{ toYaml .Values.affinity | trim | indent 8 }}
+{{- end }}
+      serviceAccountName: {{ include "ztunnel.release-name" . }}
+{{- if .Values.tolerations }}
+      tolerations:
+{{ toYaml .Values.tolerations | trim | indent 8 }}
+{{- end }}
+      containers:
+      - name: istio-proxy
+{{- if contains "/" .Values.image }}
+        image: "{{ .Values.image }}"
+{{- else }}
+        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
+{{- end }}
+        ports:
+        - containerPort: 15020
+          name: ztunnel-stats
+          protocol: TCP
+        resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 10 }}
+{{- end }}
+{{- with .Values.imagePullPolicy }}
+        imagePullPolicy: {{ . }}
+{{- end }}
+        securityContext:
+          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
+          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
+          allowPrivilegeEscalation: true
+          privileged: false
+          capabilities:
+            drop:
+            - ALL
+            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
+            - NET_ADMIN # Required for TPROXY and setsockopt
+            - SYS_ADMIN # Required for `setns` - doing things in other netns
+            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
+          readOnlyRootFilesystem: true
+          runAsGroup: 1337
+          runAsNonRoot: false
+          runAsUser: 0
+{{- if .Values.seLinuxOptions }}
+          seLinuxOptions:
+{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
+{{- end }}
+        readinessProbe:
+          httpGet:
+            port: 15021
+            path: /healthz/ready
+        args:
+        - proxy
+        - ztunnel
+        env:
+        - name: CA_ADDRESS
+        {{- if .Values.caAddress }}
+          value: {{ .Values.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: XDS_ADDRESS
+        {{- if .Values.xdsAddress }}
+          value: {{ .Values.xdsAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
+        {{- end }}
+        {{- if .Values.logAsJson }}
+        - name: LOG_FORMAT
+          value: json
+        {{- end}}
+        {{- if .Values.network }}
+        - name: NETWORK
+          value: {{ .Values.network | quote }}
+        {{- end }}
+        - name: RUST_LOG
+          value: {{ .Values.logLevel | quote }}
+        - name: RUST_BACKTRACE
+          value: "1"
+        - name: ISTIO_META_CLUSTER_ID
+          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
+        - name: INPOD_ENABLED
+          value: "true"
+        - name: TERMINATION_GRACE_PERIOD_SECONDS
+          value: "{{ .Values.terminationGracePeriodSeconds }}"
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
+        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- end }}
+        - name: ZTUNNEL_CPU_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        {{- with .Values.env }}
+        {{- range $key, $val := . }}
+        - name: {{ $key }}
+          value: "{{ $val }}"
+        {{- end }}
+        {{- end }}
+        volumeMounts:
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - mountPath: /var/run/ztunnel
+          name: cni-ztunnel-sock-dir
+        - mountPath: /tmp
+          name: tmp
+        {{- with .Values.volumeMounts }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+      priorityClassName: system-node-critical
+      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
+      volumes:
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: istio-token
+              expirationSeconds: 43200
+              audience: istio-ca
+      - name: istiod-ca-cert
+        {{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:{{ .Values.trustBundleName | default "root-cert" }}
+              path: root-cert.pem
+        {{- else }}
+        configMap:
+          name: {{ .Values.trustBundleName | default "istio-ca-root-cert" }}
+        {{- end }}
+      - name: cni-ztunnel-sock-dir
+        hostPath:
+          path: /var/run/ztunnel
+          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
+      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
+      - name: tmp
+        emptyDir: {}
+      {{- with .Values.volumes }}
+        {{- toYaml . | nindent 6}}
+      {{- end }}
diff --git a/resources/v1.25.5/charts/ztunnel/templates/rbac.yaml b/resources/v1.27.3/charts/ztunnel/templates/rbac.yaml
similarity index 100%
rename from resources/v1.25.5/charts/ztunnel/templates/rbac.yaml
rename to resources/v1.27.3/charts/ztunnel/templates/rbac.yaml
diff --git a/resources/v1.27.3/charts/ztunnel/templates/resourcequota.yaml b/resources/v1.27.3/charts/ztunnel/templates/resourcequota.yaml
new file mode 100644
index 000000000..a1c0e5496
--- /dev/null
+++ b/resources/v1.27.3/charts/ztunnel/templates/resourcequota.yaml
@@ -0,0 +1,20 @@
+{{- if .Values.resourceQuotas.enabled }}
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
+spec:
+  hard:
+    pods: {{ .Values.resourceQuotas.pods | quote }}
+  scopeSelector:
+    matchExpressions:
+    - operator: In
+      scopeName: PriorityClass
+      values:
+      - system-node-critical
+{{- end }}
diff --git a/resources/v1.27.3/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.27.3/charts/ztunnel/templates/zzz_profile.yaml
new file mode 100644
index 000000000..606c55669
--- /dev/null
+++ b/resources/v1.27.3/charts/ztunnel/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if true }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.27.3/charts/ztunnel/values.yaml b/resources/v1.27.3/charts/ztunnel/values.yaml
new file mode 100644
index 000000000..ad00f2b47
--- /dev/null
+++ b/resources/v1.27.3/charts/ztunnel/values.yaml
@@ -0,0 +1,128 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
+  hub: gcr.io/istio-release
+  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
+  tag: 1.27.3
+  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
+  variant: ""
+
+  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
+  # If Image contains a "/", it will replace the entire `image` in the pod.
+  image: ztunnel
+
+  # Same as `global.network`, but will override it if set.
+  # Network defines the network this cluster belong to. This name
+  # corresponds to the networks in the map of mesh networks.
+  network: ""
+
+  # resourceName, if set, will override the naming of resources. If not set, will default to 'ztunnel'.
+  # If you set this, you MUST also set `trustedZtunnelName` in the `istiod` chart.
+  resourceName: ""
+
+  # Labels to apply to all top level resources
+  labels: {}
+  # Annotations to apply to all top level resources
+  annotations: {}
+
+  # Additional volumeMounts to the ztunnel container
+  volumeMounts: []
+
+  # Additional volumes to the ztunnel pod
+  volumes: []
+  
+  # Tolerations for the ztunnel pod
+  tolerations:
+    - effect: NoSchedule
+      operator: Exists
+    - key: CriticalAddonsOnly
+      operator: Exists
+    - effect: NoExecute
+      operator: Exists
+
+  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
+  podAnnotations:
+    prometheus.io/port: "15020"
+    prometheus.io/scrape: "true"
+
+  # Additional labels to apply on the pod level
+  podLabels: {}
+
+  # Pod resource configuration
+  resources:
+    requests:
+      cpu: 200m
+      # Ztunnel memory scales with the size of the cluster and traffic load
+      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
+      memory: 512Mi
+
+  resourceQuotas:
+    enabled: false
+    pods: 5000
+
+  # List of secret names to add to the service account as image pull secrets
+  imagePullSecrets: []
+
+  # A `key: value` mapping of environment variables to add to the pod
+  env: {}
+
+  # Override for the pod imagePullPolicy
+  imagePullPolicy: ""
+
+  # Settings for multicluster
+  multiCluster:
+    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
+    # with Istiod configuration.
+    clusterName: ""
+
+  # meshConfig defines runtime configuration of components.
+  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
+  # components.
+  # TODO: https://github.com/istio/istio/issues/43248
+  meshConfig:
+    defaultConfig:
+      proxyMetadata: {}
+
+  # This value defines:
+  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
+  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
+  # Default K8S value is 30 seconds
+  terminationGracePeriodSeconds: 30
+
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
+  revision: ""
+
+  # The customized CA address to retrieve certificates for the pods in the cluster.
+  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+  caAddress: ""
+
+  # The customized XDS address to retrieve configuration.
+  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
+  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
+  xdsAddress: ""
+
+  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
+  istioNamespace: istio-system
+
+  # Configuration log level of ztunnel binary, default is info.
+  # Valid values are: trace, debug, info, warn, error
+  logLevel: info
+
+  # To output all logs in json format
+  logAsJson: false
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seLinuxOptions: {}
+  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
+  #seLinuxOptions:
+  #  type: spc_t
+
+  # K8s DaemonSet update strategy.
+  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
diff --git a/resources/v1.27.3/cni-1.27.3.tgz.etag b/resources/v1.27.3/cni-1.27.3.tgz.etag
new file mode 100644
index 000000000..7a5f5e119
--- /dev/null
+++ b/resources/v1.27.3/cni-1.27.3.tgz.etag
@@ -0,0 +1 @@
+225fe2f64f96f2d06ae32ab8aee589e9
diff --git a/resources/v1.27.3/commit b/resources/v1.27.3/commit
new file mode 100644
index 000000000..3bae5204b
--- /dev/null
+++ b/resources/v1.27.3/commit
@@ -0,0 +1 @@
+1.27.3
diff --git a/resources/v1.27.3/gateway-1.27.3.tgz.etag b/resources/v1.27.3/gateway-1.27.3.tgz.etag
new file mode 100644
index 000000000..c7fcfbf51
--- /dev/null
+++ b/resources/v1.27.3/gateway-1.27.3.tgz.etag
@@ -0,0 +1 @@
+283b9a884ddfc8d6181e4ba9b7b864d3
diff --git a/resources/v1.27.3/istiod-1.27.3.tgz.etag b/resources/v1.27.3/istiod-1.27.3.tgz.etag
new file mode 100644
index 000000000..b8e60f837
--- /dev/null
+++ b/resources/v1.27.3/istiod-1.27.3.tgz.etag
@@ -0,0 +1 @@
+bb59c9d779b441c3b807c7b0e0469672
diff --git a/resources/v1.24.4/profiles/ambient.yaml b/resources/v1.27.3/profiles/ambient.yaml
similarity index 100%
rename from resources/v1.24.4/profiles/ambient.yaml
rename to resources/v1.27.3/profiles/ambient.yaml
diff --git a/resources/v1.25.5/profiles/default.yaml b/resources/v1.27.3/profiles/default.yaml
similarity index 100%
rename from resources/v1.25.5/profiles/default.yaml
rename to resources/v1.27.3/profiles/default.yaml
diff --git a/resources/v1.24.4/profiles/demo.yaml b/resources/v1.27.3/profiles/demo.yaml
similarity index 100%
rename from resources/v1.24.4/profiles/demo.yaml
rename to resources/v1.27.3/profiles/demo.yaml
diff --git a/resources/v1.24.4/profiles/empty.yaml b/resources/v1.27.3/profiles/empty.yaml
similarity index 100%
rename from resources/v1.24.4/profiles/empty.yaml
rename to resources/v1.27.3/profiles/empty.yaml
diff --git a/resources/v1.24.4/profiles/openshift-ambient.yaml b/resources/v1.27.3/profiles/openshift-ambient.yaml
similarity index 100%
rename from resources/v1.24.4/profiles/openshift-ambient.yaml
rename to resources/v1.27.3/profiles/openshift-ambient.yaml
diff --git a/resources/v1.24.4/profiles/openshift.yaml b/resources/v1.27.3/profiles/openshift.yaml
similarity index 100%
rename from resources/v1.24.4/profiles/openshift.yaml
rename to resources/v1.27.3/profiles/openshift.yaml
diff --git a/resources/v1.24.4/profiles/preview.yaml b/resources/v1.27.3/profiles/preview.yaml
similarity index 100%
rename from resources/v1.24.4/profiles/preview.yaml
rename to resources/v1.27.3/profiles/preview.yaml
diff --git a/resources/v1.24.4/profiles/remote.yaml b/resources/v1.27.3/profiles/remote.yaml
similarity index 100%
rename from resources/v1.24.4/profiles/remote.yaml
rename to resources/v1.27.3/profiles/remote.yaml
diff --git a/resources/v1.24.4/profiles/stable.yaml b/resources/v1.27.3/profiles/stable.yaml
similarity index 100%
rename from resources/v1.24.4/profiles/stable.yaml
rename to resources/v1.27.3/profiles/stable.yaml
diff --git a/resources/v1.27.3/ztunnel-1.27.3.tgz.etag b/resources/v1.27.3/ztunnel-1.27.3.tgz.etag
new file mode 100644
index 000000000..e4501f013
--- /dev/null
+++ b/resources/v1.27.3/ztunnel-1.27.3.tgz.etag
@@ -0,0 +1 @@
+1796665ace8eb824959a10e3dab18060
diff --git a/resources/v1.28-alpha.724e2360/base-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz.etag b/resources/v1.28-alpha.724e2360/base-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz.etag
deleted file mode 100644
index 23a6e331a..000000000
--- a/resources/v1.28-alpha.724e2360/base-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-c9beb2bc2a74aa1cc72fba6eac35bd61
diff --git a/resources/v1.28-alpha.724e2360/charts/base/Chart.yaml b/resources/v1.28-alpha.724e2360/charts/base/Chart.yaml
deleted file mode 100644
index ae84e7f2d..000000000
--- a/resources/v1.28-alpha.724e2360/charts/base/Chart.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: v2
-appVersion: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-description: Helm chart for deploying Istio cluster resources and CRDs
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-name: base
-sources:
-- https://github.com/istio/istio
-version: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
diff --git a/resources/v1.28-alpha.724e2360/charts/base/README.md b/resources/v1.28-alpha.724e2360/charts/base/README.md
deleted file mode 100644
index ae8f6d5b0..000000000
--- a/resources/v1.28-alpha.724e2360/charts/base/README.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Istio base Helm Chart
-
-This chart installs resources shared by all Istio revisions. This includes Istio CRDs.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-base`:
-
-```console
-kubectl create namespace istio-system
-helm install istio-base istio/base -n istio-system
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-k3d.yaml b/resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-microk8s.yaml b/resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-minikube.yaml b/resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-openshift.yaml b/resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.28-alpha.724e2360/charts/base/files/profile-preview.yaml b/resources/v1.28-alpha.724e2360/charts/base/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.28-alpha.724e2360/charts/base/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.28-alpha.724e2360/charts/base/files/profile-remote.yaml b/resources/v1.28-alpha.724e2360/charts/base/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.28-alpha.724e2360/charts/base/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.28-alpha.724e2360/charts/base/files/profile-stable.yaml b/resources/v1.28-alpha.724e2360/charts/base/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.28-alpha.724e2360/charts/base/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.28-alpha.724e2360/charts/base/templates/NOTES.txt b/resources/v1.28-alpha.724e2360/charts/base/templates/NOTES.txt
deleted file mode 100644
index f12616f57..000000000
--- a/resources/v1.28-alpha.724e2360/charts/base/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-Istio base successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.28-alpha.724e2360/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml b/resources/v1.28-alpha.724e2360/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
deleted file mode 100644
index 2616b09c9..000000000
--- a/resources/v1.28-alpha.724e2360/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
+++ /dev/null
@@ -1,53 +0,0 @@
-{{- if and .Values.experimental.stableValidationPolicy (not (eq .Values.defaultRevision "")) }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicy
-metadata:
-  name: "stable-channel-default-policy.istio.io"
-  labels:
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision }}
-    app.kubernetes.io/name: "istiod"
-    {{ include "istio.labels" . | nindent 4 }}
-spec:
-  failurePolicy: Fail
-  matchConstraints:
-    resourceRules:
-    - apiGroups:
-        - security.istio.io
-        - networking.istio.io
-        - telemetry.istio.io
-        - extensions.istio.io
-      apiVersions: ["*"]
-      operations:  ["CREATE", "UPDATE"]
-      resources:   ["*"]
-  variables:
-    - name: isEnvoyFilter
-      expression: "object.kind == 'EnvoyFilter'"
-    - name: isWasmPlugin
-      expression: "object.kind == 'WasmPlugin'"
-    - name: isProxyConfig
-      expression: "object.kind == 'ProxyConfig'"
-    - name: isTelemetry
-      expression: "object.kind == 'Telemetry'"
-  validations:
-    - expression: "!variables.isEnvoyFilter"
-    - expression: "!variables.isWasmPlugin"
-    - expression: "!variables.isProxyConfig"
-    - expression: |
-        !(
-          variables.isTelemetry && (
-            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
-            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
-            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
-          )
-        )
----
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingAdmissionPolicyBinding
-metadata:
-  name: "stable-channel-default-policy-binding.istio.io"
-spec:
-  policyName: "stable-channel-default-policy.istio.io"
-  validationActions: [Deny]
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml b/resources/v1.28-alpha.724e2360/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
deleted file mode 100644
index 8cb76fd77..000000000
--- a/resources/v1.28-alpha.724e2360/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-{{- if not (eq .Values.defaultRevision "") }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: istiod-default-validator
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    istio: istiod
-    istio.io/rev: {{ .Values.defaultRevision | quote }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-webhooks:
-  - name: validation.istio.io
-    clientConfig:
-      {{- if .Values.base.validationURL }}
-      url: {{ .Values.base.validationURL }}
-      {{- else }}
-      service:
-        {{- if (eq .Values.defaultRevision "default") }}
-        name: istiod
-        {{- else }}
-        name: istiod-{{ .Values.defaultRevision }}
-        {{- end }}
-        namespace: {{ .Values.global.istioNamespace }}
-        path: "/validate"
-      {{- end }}
-      {{- if .Values.base.validationCABundle }}
-      caBundle: "{{ .Values.base.validationCABundle }}"
-      {{- end }}
-    rules:
-      - operations:
-          - CREATE
-          - UPDATE
-        apiGroups:
-          - security.istio.io
-          - networking.istio.io
-          - telemetry.istio.io
-          - extensions.istio.io
-        apiVersions:
-          - "*"
-        resources:
-          - "*"
-
-    {{- if .Values.base.validationCABundle }}
-    # Disable webhook controller in Pilot to stop patching it
-    failurePolicy: Fail
-    {{- else }}
-    # Fail open until the validation webhook is ready. The webhook controller
-    # will update this to `Fail` and patch in the `caBundle` when the webhook
-    # endpoint is ready.
-    failurePolicy: Ignore
-    {{- end }}
-    sideEffects: None
-    admissionReviewVersions: ["v1"]
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/base/templates/reader-serviceaccount.yaml b/resources/v1.28-alpha.724e2360/charts/base/templates/reader-serviceaccount.yaml
deleted file mode 100644
index ba829a6bf..000000000
--- a/resources/v1.28-alpha.724e2360/charts/base/templates/reader-serviceaccount.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-# This singleton service account aggregates reader permissions for the revisions in a given cluster
-# ATM this is a singleton per cluster with Istio installed, and is not revisioned. It maybe should be,
-# as otherwise compromising the token for this SA would give you access to *every* installed revision.
-# Should be used for remote secret creation.
-apiVersion: v1
-kind: ServiceAccount
-  {{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-  {{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-    {{- end }}
-    {{- end }}
-metadata:
-  name: istio-reader-service-account
-  namespace: {{ .Values.global.istioNamespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.28-alpha.724e2360/charts/base/values.yaml b/resources/v1.28-alpha.724e2360/charts/base/values.yaml
deleted file mode 100644
index d18296f00..000000000
--- a/resources/v1.28-alpha.724e2360/charts/base/values.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  global:
-
-    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-
-    # Used to locate istiod.
-    istioNamespace: istio-system
-  base:
-    # A list of CRDs to exclude. Requires `enableCRDTemplates` to be true.
-    # Example: `excludedCRDs: ["envoyfilters.networking.istio.io"]`.
-    # Note: when installing with `istioctl`, `enableIstioConfigCRDs=false` must also be set.
-    excludedCRDs: []
-    # Helm (as of V3) does not support upgrading CRDs, because it is not universally
-    # safe for them to support this.
-    # Istio as a project enforces certain backwards-compat guarantees that allow us
-    # to safely upgrade CRDs in spite of this, so we default to self-managing CRDs
-    # as standard K8S resources in Helm, and disable Helm's CRD management. See also:
-    # https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#method-2-separate-charts
-    enableCRDTemplates: true
-
-    # Validation webhook configuration url
-    # For example: https://$remotePilotAddress:15017/validate
-    validationURL: ""
-    # Validation webhook caBundle value. Useful when running pilot with a well known cert
-    validationCABundle: ""
-
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  defaultRevision: "default"
-  experimental:
-    stableValidationPolicy: false
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/Chart.yaml b/resources/v1.28-alpha.724e2360/charts/cni/Chart.yaml
deleted file mode 100644
index 6fba50fdb..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-description: Helm chart for istio-cni components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-cni
-- istio
-name: cni
-sources:
-- https://github.com/istio/istio
-version: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/README.md b/resources/v1.28-alpha.724e2360/charts/cni/README.md
deleted file mode 100644
index a8b78d5bd..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/README.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# Istio CNI Helm Chart
-
-This chart installs the Istio CNI Plugin. See the [CNI installation guide](https://istio.io/latest/docs/setup/additional-setup/cni/)
-for more information.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-cni`:
-
-```console
-helm install istio-cni istio/cni -n kube-system
-```
-
-Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
-`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
-'system-node-critical' outside of kube-system.
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istio-cni
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Ambient
-
-To enable ambient, you can use the ambient profile: `--set profile=ambient`.
-
-#### Calico
-
-For Calico, you must also modify the settings to allow source spoofing:
-
-- if deployed by operator,  `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`
-- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )
-
-### GKE notes
-
-On GKE, 'kube-system' is required.
-
-If using `helm template`, `--set cni.cniBinDir=/home/kubernetes/bin` is required - with `helm install`
-it is auto-detected.
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-k3d.yaml b/resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-microk8s.yaml b/resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-minikube.yaml b/resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-openshift.yaml b/resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-preview.yaml b/resources/v1.28-alpha.724e2360/charts/cni/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-remote.yaml b/resources/v1.28-alpha.724e2360/charts/cni/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-stable.yaml b/resources/v1.28-alpha.724e2360/charts/cni/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/templates/NOTES.txt b/resources/v1.28-alpha.724e2360/charts/cni/templates/NOTES.txt
deleted file mode 100644
index fb35525b9..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-"{{ .Release.Name }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/templates/_helpers.tpl b/resources/v1.28-alpha.724e2360/charts/cni/templates/_helpers.tpl
deleted file mode 100644
index 73cc17b2f..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/templates/_helpers.tpl
+++ /dev/null
@@ -1,8 +0,0 @@
-{{- define "name" -}}
-    istio-cni
-{{- end }}
-
-
-{{- define "istio-tag" -}}
-    {{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/templates/clusterrole.yaml b/resources/v1.28-alpha.724e2360/charts/cni/templates/clusterrole.yaml
deleted file mode 100644
index 1779e0bb1..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/templates/clusterrole.yaml
+++ /dev/null
@@ -1,81 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: ["security.openshift.io"] 
-  resources: ["securitycontextconstraints"] 
-  resourceNames: ["privileged"] 
-  verbs: ["use"]
-- apiGroups: [""]
-  resources: ["pods","nodes","namespaces"]
-  verbs: ["get", "list", "watch"]
-{{- if (eq ((coalesce .Values.platform .Values.global.platform) | default "") "openshift") }}
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
-{{- end }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-repair-role
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "patch"]
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["watch", "get", "list"]
-{{- if .Values.repair.repairPods }}
-{{- /*  No privileges needed*/}}
-{{- else if .Values.repair.deletePods }}
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["delete"]
-{{- else if .Values.repair.labelPods }}
-  - apiGroups: [""]
-    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-    resources: ["pods/status"]
-    verbs: ["patch", "update"]
-{{- end }}
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-- apiGroups: [""]
-  {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
-  resources: ["pods/status"]
-  verbs: ["patch", "update"]
-- apiGroups: ["apps"]
-  resources: ["daemonsets"]
-  resourceNames: ["{{ template "name" . }}-node"]
-  verbs: ["get"]
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/templates/clusterrolebinding.yaml b/resources/v1.28-alpha.724e2360/charts/cni/templates/clusterrolebinding.yaml
deleted file mode 100644
index 42fedab1f..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/templates/clusterrolebinding.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
----
-{{- if .Values.repair.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-repair-rolebinding
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-- kind: ServiceAccount
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-repair-role
-{{- end }}
----
-{{- if .Values.ambient.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "name" . }}-ambient
-  labels:
-    k8s-app: {{ template "name" . }}-repair
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "name" . }}
-    namespace: {{ .Release.Namespace}}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "name" . }}-ambient
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/templates/daemonset.yaml b/resources/v1.28-alpha.724e2360/charts/cni/templates/daemonset.yaml
deleted file mode 100644
index 75f61c60a..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/templates/daemonset.yaml
+++ /dev/null
@@ -1,250 +0,0 @@
-# This manifest installs the Istio install-cni container, as well
-# as the Istio CNI plugin and config on
-# each master and worker node in a Kubernetes cluster.
-#
-# $detectedBinDir exists to support a GKE-specific platform override,
-# and is deprecated in favor of using the explicit `gke` platform profile.
-{{- $detectedBinDir := (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
-    "/home/kubernetes/bin"
-    "/opt/cni/bin"
-}}
-{{- if .Values.cniBinDir }}
-{{ $detectedBinDir = .Values.cniBinDir }}
-{{- end }}
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  # Note that this is templated but evaluates to a fixed name
-  # which the CNI plugin may fall back onto in some failsafe scenarios.
-  # if this name is changed, CNI plugin logic that checks for this name
-  # format should also be updated.
-  name: {{ template "name" . }}-node
-  namespace: {{ .Release.Namespace }}
-  labels:
-    k8s-app: {{ template "name" . }}-node
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-    {{ with .Values.daemonSetLabels -}}{{ toYaml . | nindent 4}}{{ end }}
-spec:
-  selector:
-    matchLabels:
-      k8s-app: {{ template "name" . }}-node
-  {{- with .Values.updateStrategy }}
-  updateStrategy:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  template:
-    metadata:
-      labels:
-        k8s-app: {{ template "name" . }}-node
-        sidecar.istio.io/inject: "false"
-        istio.io/dataplane-mode: none
-        app.kubernetes.io/name: {{ template "name" . }}
-        {{- include "istio.labels" . | nindent 8 }}
-        {{ with .Values.podLabels -}}{{ toYaml . | nindent 8}}{{ end }}
-      annotations:
-        sidecar.istio.io/inject: "false"
-        # Add Prometheus Scrape annotations
-        prometheus.io/scrape: 'true'
-        prometheus.io/port: "15014"
-        prometheus.io/path: '/metrics'
-        # Add AppArmor annotation
-        # This is required to avoid conflicts with AppArmor profiles which block certain
-        # privileged pod capabilities.
-        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
-        # securityContext which is otherwise preferred.
-        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
-        # Custom annotations
-        {{- if .Values.podAnnotations }}
-{{ toYaml .Values.podAnnotations | indent 8 }}
-        {{- end }}
-    spec:
-{{- if and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace }}
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-{{- end }}
-      nodeSelector:
-        kubernetes.io/os: linux
-      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      priorityClassName: system-node-critical
-      serviceAccountName: {{ template "name" . }}
-      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
-      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
-      terminationGracePeriodSeconds: 5
-      containers:
-        # This container installs the Istio CNI binaries
-        # and CNI network config file on each node.
-        - name: install-cni
-{{- if contains "/" .Values.image }}
-          image: "{{ .Values.image }}"
-{{- else }}
-          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
-{{- end }}
-{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
-          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
-{{- end }}
-          ports:
-          - containerPort: 15014
-            name: metrics
-            protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8000
-          securityContext:
-            privileged: false
-            runAsGroup: 0
-            runAsUser: 0
-            runAsNonRoot: false
-            # Both ambient and sidecar repair mode require elevated node privileges to function.
-            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
-            # add capabilities based on feature.
-            capabilities:
-              drop:
-              - ALL
-              add:
-              # CAP_NET_ADMIN is required to allow ipset and route table access
-              - NET_ADMIN
-              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
-              - NET_RAW
-              # CAP_SYS_PTRACE is required for repair and ambient mode to describe
-              # the pod's network namespace.
-              - SYS_PTRACE
-              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
-              # network namespaces in `/proc` to obtain descriptors for entering pod network
-              # namespaces. There does not appear to be a more granular capability for this.
-              - SYS_ADMIN
-              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
-              # the typical ability to read/write to folders owned by others.
-              # This can cause problems if the hostPath mounts we use, which we require write access into,
-              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
-              - DAC_OVERRIDE
-{{- if .Values.seLinuxOptions }}
-{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
-            seLinuxOptions:
-{{ toYaml . | trim | indent 14 }}
-{{- end }}
-{{- end }}
-{{- if .Values.seccompProfile }}
-            seccompProfile:
-{{ toYaml .Values.seccompProfile | trim | indent 14 }}
-{{- end }}
-          command: ["install-cni"]
-          args:
-            {{- if or .Values.logging.level .Values.global.logging.level }}
-            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
-            {{- end}}
-            {{- if .Values.global.logAsJson }}
-            - --log_as_json
-            {{- end}}
-          envFrom:
-            - configMapRef:
-                name: {{ template "name" . }}-config
-          env:
-            - name: REPAIR_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: REPAIR_RUN_AS_DAEMON
-              value: "true"
-            - name: REPAIR_SIDECAR_ANNOTATION
-              value: "sidecar.istio.io/status"
-            {{- if not (and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace) }}
-            - name: ALLOW_SWITCH_TO_HOST_NS
-              value: "true"
-            {{- end }}
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  apiVersion: v1
-                  fieldPath: spec.nodeName
-            - name: GOMEMLIMIT
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.memory
-                  divisor: '1'
-            - name: GOMAXPROCS
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.cpu
-                  divisor: '1'
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            {{- if .Values.env }}
-            {{- range $key, $val := .Values.env }}
-            - name: {{ $key }}
-              value: "{{ $val }}"
-            {{- end }}
-            {{- end }}
-          volumeMounts:
-            - mountPath: /host/opt/cni/bin
-              name: cni-bin-dir
-            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-            - mountPath: /host/proc
-              name: cni-host-procfs
-              readOnly: true
-            {{- end }}
-            - mountPath: /host/etc/cni/net.d
-              name: cni-net-dir
-            - mountPath: /var/run/istio-cni
-              name: cni-socket-dir
-            {{- if .Values.ambient.enabled }}
-            - mountPath: /host/var/run/netns
-              mountPropagation: HostToContainer
-              name: cni-netns-dir
-            - mountPath: /var/run/ztunnel
-              name: cni-ztunnel-sock-dir
-            {{ end }}
-          resources:
-{{- if .Values.resources }}
-{{ toYaml .Values.resources | trim | indent 12 }}
-{{- else }}
-{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
-{{- end }}
-      volumes:
-        # Used to install CNI.
-        - name: cni-bin-dir
-          hostPath:
-            path: {{ $detectedBinDir }}
-        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
-        - name: cni-host-procfs
-          hostPath:
-            path: /proc
-            type: Directory
-        {{- end }}
-        {{- if .Values.ambient.enabled }}
-        - name: cni-ztunnel-sock-dir
-          hostPath:
-            path: /var/run/ztunnel
-            type: DirectoryOrCreate
-        {{- end }}
-        - name: cni-net-dir
-          hostPath:
-            path: {{ .Values.cniConfDir }}
-        # Used for UDS sockets for logging, ambient eventing
-        - name: cni-socket-dir
-          hostPath:
-            path: /var/run/istio-cni
-        - name: cni-netns-dir
-          hostPath:
-            path: {{ .Values.cniNetnsDir }}
-            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
-            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
-            # Once the CNI does mount this, it will get populated and we're good.
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/templates/network-attachment-definition.yaml b/resources/v1.28-alpha.724e2360/charts/cni/templates/network-attachment-definition.yaml
deleted file mode 100644
index 86a2eb7c0..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/templates/network-attachment-definition.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-{{- if eq .Values.provider "multus" }}
-apiVersion: k8s.cni.cncf.io/v1
-kind: NetworkAttachmentDefinition
-metadata:
-  name: {{ template "name" . }}
-  namespace: default
-  labels:
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/templates/resourcequota.yaml b/resources/v1.28-alpha.724e2360/charts/cni/templates/resourcequota.yaml
deleted file mode 100644
index 9a6d61ff9..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/templates/resourcequota.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-{{- if .Values.resourceQuotas.enabled }}
-apiVersion: v1
-kind: ResourceQuota
-metadata:
-  name: {{ template "name" . }}-resource-quota
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  hard:
-    pods: {{ .Values.resourceQuotas.pods | quote }}
-  scopeSelector:
-    matchExpressions:
-    - operator: In
-      scopeName: PriorityClass
-      values:
-      - system-node-critical
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/templates/serviceaccount.yaml b/resources/v1.28-alpha.724e2360/charts/cni/templates/serviceaccount.yaml
deleted file mode 100644
index 3193d7b74..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-{{- if .Values.global.imagePullSecrets }}
-imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-{{- end }}
-{{- end }}
-metadata:
-  name: {{ template "name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: {{ template "name" . }}
-    release: {{ .Release.Name }}
-    istio.io/rev: {{ .Values.revision | default "default" }}
-    operator.istio.io/component: "Cni"
-    app.kubernetes.io/name: {{ template "name" . }}
-    {{- include "istio.labels" . | nindent 4 }}
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/templates/zzy_descope_legacy.yaml b/resources/v1.28-alpha.724e2360/charts/cni/templates/zzy_descope_legacy.yaml
deleted file mode 100644
index a9584ac29..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/templates/zzy_descope_legacy.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-{{/* Copy anything under `.cni` to `.`, to avoid the need to specify a redundant prefix.
-Due to the file naming, this always happens after zzz_profile.yaml */}}
-{{- $_ := mustMergeOverwrite $.Values (index $.Values "cni") }}
\ No newline at end of file
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/values.yaml b/resources/v1.28-alpha.724e2360/charts/cni/values.yaml
deleted file mode 100644
index 9dda2e4aa..000000000
--- a/resources/v1.28-alpha.724e2360/charts/cni/values.yaml
+++ /dev/null
@@ -1,184 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  hub: ""
-  tag: ""
-  variant: ""
-  image: install-cni
-  pullPolicy: ""
-
-  # Same as `global.logging.level`, but will override it if set
-  logging:
-    level: ""
-
-  # Configuration file to insert istio-cni plugin configuration
-  # by default this will be the first file found in the cni-conf-dir
-  # Example
-  # cniConfFileName: 10-calico.conflist
-
-  # CNI-and-platform specific path defaults.
-  # These may need to be set to platform-specific values, consult
-  # overrides for your platform in `manifests/helm-profiles/platform-*.yaml`
-  cniBinDir: /opt/cni/bin
-  cniConfDir: /etc/cni/net.d
-  cniConfFileName: ""
-  cniNetnsDir: "/var/run/netns"
-
-  # If Istio owned CNI config is enabled, defaults to 02-istio-cni.conflist
-  istioOwnedCNIConfigFileName: ""
-  istioOwnedCNIConfig: false
-
-  excludeNamespaces:
-    - kube-system
-
-  # Allows user to set custom affinity for the DaemonSet
-  affinity: {}
-
-  # Additional labels to apply on the daemonset level
-  daemonSetLabels: {}
-
-  # Custom annotations on pod level, if you need them
-  podAnnotations: {}
-
-  # Additional labels to apply on the pod level
-  podLabels: {}
-
-  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
-  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
-  chained: true
-
-  # Custom configuration happens based on the CNI provider.
-  # Possible values: "default", "multus"
-  provider: "default"
-
-  # Configure ambient settings
-  ambient:
-    # If enabled, ambient redirection will be enabled
-    enabled: false
-    # If ambient is enabled, this selector will be used to identify the ambient-enabled pods
-    enablementSelectors: 
-    - podSelector:
-        matchLabels: {istio.io/dataplane-mode: ambient}
-    - podSelector:
-        matchExpressions:
-        - { key: istio.io/dataplane-mode, operator: NotIn, values: [none] }
-      namespaceSelector:
-        matchLabels: {istio.io/dataplane-mode: ambient}
-    # Set ambient config dir path: defaults to /etc/ambient-config
-    configDir: ""
-    # If enabled, and ambient is enabled, DNS redirection will be enabled
-    dnsCapture: true
-    # If enabled, and ambient is enabled, enables ipv6 support
-    ipv6: true
-    # If enabled, and ambient is enabled, the CNI agent will reconcile incompatible iptables rules and chains at startup.
-    # This will eventually be enabled by default
-    reconcileIptablesOnStartup: false
-    # If enabled, and ambient is enabled, the CNI agent will always share the network namespace of the host node it is running on
-    shareHostNetworkNamespace: false
-
-
-  repair:
-    enabled: true
-    hub: ""
-    tag: ""
-
-    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
-    # This defines the action the controller will take when a pod is detected as broken.
-
-    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
-    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
-    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
-    labelPods: false
-    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
-    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
-    deletePods: false
-    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
-    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
-    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
-    repairPods: true
-
-    initContainerName: "istio-validation"
-
-    brokenPodLabelKey: "cni.istio.io/uninitialized"
-    brokenPodLabelValue: "true"
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
-  seLinuxOptions: {}
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 100Mi
-
-  resourceQuotas:
-    enabled: false
-    pods: 5000
-
-  tolerations:
-    # Make sure istio-cni-node gets scheduled on all nodes.
-    - effect: NoSchedule
-      operator: Exists
-    # Mark the pod as a critical add-on for rescheduling.
-    - key: CriticalAddonsOnly
-      operator: Exists
-    - effect: NoExecute
-      operator: Exists
-
-  # K8s DaemonSet update strategy.
-  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  global:
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-testing
-
-    # Default tag for Istio images.
-    tag: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # change cni scope level to control logging out of istio-cni-node DaemonSet
-    logging:
-      level: info
-
-    logAsJson: false
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Default resources allocated
-    defaultResources:
-      requests:
-        cpu: 100m
-        memory: 100Mi
-
-    # In order to use native nftable rules instead of iptable rules, set this flag to true.
-    nativeNftables: false
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/Chart.yaml b/resources/v1.28-alpha.724e2360/charts/gateway/Chart.yaml
deleted file mode 100644
index f7171ed0b..000000000
--- a/resources/v1.28-alpha.724e2360/charts/gateway/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-description: Helm chart for deploying Istio gateways
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- gateways
-name: gateway
-sources:
-- https://github.com/istio/istio
-type: application
-version: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/README.md b/resources/v1.28-alpha.724e2360/charts/gateway/README.md
deleted file mode 100644
index 5c064d165..000000000
--- a/resources/v1.28-alpha.724e2360/charts/gateway/README.md
+++ /dev/null
@@ -1,170 +0,0 @@
-# Istio Gateway Helm Chart
-
-This chart installs an Istio gateway deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart with the release name `istio-ingressgateway`:
-
-```console
-helm install istio-ingressgateway istio/gateway
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istio-ingressgateway` deployment:
-
-```console
-helm delete istio-ingressgateway
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/gateway
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### OpenShift
-
-When deploying the gateway in an OpenShift cluster, use the `openshift` profile to override the default values, for example:
-
-```console
-helm install istio-ingressgateway istio/gateway --set profile=openshift
-```
-
-### `image: auto` Information
-
-The image used by the chart, `auto`, may be unintuitive.
-This exists because the pod spec will be automatically populated at runtime, using the same mechanism as [Sidecar Injection](istio.io/latest/docs/setup/additional-setup/sidecar-injection).
-This allows the same configurations and lifecycle to apply to gateways as sidecars.
-
-Note: this does mean that the namespace the gateway is deployed in must not have the `istio-injection=disabled` label.
-See [Controlling the injection policy](https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy) for more info.
-
-### Examples
-
-#### Egress Gateway
-
-Deploying a Gateway to be used as an [Egress Gateway](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/):
-
-```yaml
-service:
-  # Egress gateways do not need an external LoadBalancer IP
-  type: ClusterIP
-```
-
-#### Multi-network/VM Gateway
-
-Deploying a Gateway to be used as a [Multi-network Gateway](https://istio.io/latest/docs/setup/install/multicluster/) for network `network-1`:
-
-```yaml
-networkGateway: network-1
-```
-
-### Migrating from other installation methods
-
-Installations from other installation methods (such as istioctl, Istio Operator, other helm charts, etc) can be migrated to use the new Helm charts
-following the guidance below.
-If you are able to, a clean installation is simpler. However, this often requires an external IP migration which can be challenging.
-
-WARNING: when installing over an existing deployment, the two deployments will be merged together by Helm, which may lead to unexpected results.
-
-#### Legacy Gateway Helm charts
-
-Istio historically offered two different charts - `manifests/charts/gateways/istio-ingress` and `manifests/charts/gateways/istio-egress`.
-These are replaced by this chart.
-While not required, it is recommended all new users use this chart, and existing users migrate when possible.
-
-This chart has the following benefits and differences:
-* Designed with Helm best practices in mind (standardized values options, values schema, values are not all nested under `gateways.istio-ingressgateway.*`, release name and namespace taken into account, etc).
-* Utilizes Gateway injection, simplifying upgrades, allowing gateways to run in any namespace, and avoiding repeating config for sidecars and gateways.
-* Published to official Istio Helm repository.
-* Single chart for all gateways (Ingress, Egress, East West).
-
-#### General concerns
-
-For a smooth migration, the resource names and `Deployment.spec.selector` labels must match.
-
-If you install with `helm install istio-gateway istio/gateway`, resources will be named `istio-gateway` and the `selector` labels set to:
-
-```yaml
-app: istio-gateway
-istio: gateway # the release name with leading istio- prefix stripped
-```
-
-If your existing installation doesn't follow these names, you can override them. For example, if you have resources named `my-custom-gateway` with `selector` labels
-`foo=bar,istio=ingressgateway`:
-
-```yaml
-name: my-custom-gateway # Override the name to match existing resources
-labels:
-  app: "" # Unset default app selector label
-  istio: ingressgateway # override default istio selector label
-  foo: bar # Add the existing custom selector label
-```
-
-#### Migrating an existing Helm release
-
-An existing helm release can be `helm upgrade`d to this chart by using the same release name. For example, if a previous
-installation was done like:
-
-```console
-helm install istio-ingress manifests/charts/gateways/istio-ingress -n istio-system
-```
-
-It could be upgraded with
-
-```console
-helm upgrade istio-ingress manifests/charts/gateway -n istio-system --set name=istio-ingressgateway --set labels.app=istio-ingressgateway --set labels.istio=ingressgateway
-```
-
-Note the name and labels are overridden to match the names of the existing installation.
-
-Warning: the helm charts here default to using port 80 and 443, while the old charts used 8080 and 8443.
-If you have AuthorizationPolicies that reference port these ports, you should update them during this process,
-or customize the ports to match the old defaults.
-See the [security advisory](https://istio.io/latest/news/security/istio-security-2021-002/) for more information.
-
-#### Other migrations
-
-If you see errors like `rendered manifests contain a resource that already exists` during installation, you may need to forcibly take ownership.
-
-The script below can handle this for you. Replace `RELEASE` and `NAMESPACE` with the name and namespace of the release:
-
-```console
-KINDS=(service deployment)
-RELEASE=istio-ingressgateway
-NAMESPACE=istio-system
-for KIND in "${KINDS[@]}"; do
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-name=$RELEASE
-    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-namespace=$NAMESPACE
-    kubectl --namespace $NAMESPACE --overwrite=true label $KIND $RELEASE app.kubernetes.io/managed-by=Helm
-done
-```
-
-You may ignore errors about resources not being found.
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-k3d.yaml b/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-microk8s.yaml b/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-minikube.yaml b/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-openshift.yaml b/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-preview.yaml b/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-remote.yaml b/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-stable.yaml b/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/templates/NOTES.txt b/resources/v1.28-alpha.724e2360/charts/gateway/templates/NOTES.txt
deleted file mode 100644
index fd0142911..000000000
--- a/resources/v1.28-alpha.724e2360/charts/gateway/templates/NOTES.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-"{{ include "gateway.name" . }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
-
-Next steps:
-  * Deploy an HTTP Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/
-  * Deploy an HTTPS Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/templates/_helpers.tpl b/resources/v1.28-alpha.724e2360/charts/gateway/templates/_helpers.tpl
deleted file mode 100644
index e5a0a9b3c..000000000
--- a/resources/v1.28-alpha.724e2360/charts/gateway/templates/_helpers.tpl
+++ /dev/null
@@ -1,40 +0,0 @@
-{{- define "gateway.name" -}}
-{{- if eq .Release.Name "RELEASE-NAME" -}}
-  {{- .Values.name | default "istio-ingressgateway" -}}
-{{- else -}}
-  {{- .Values.name | default .Release.Name | default "istio-ingressgateway" -}}
-{{- end -}}
-{{- end }}
-
-{{- define "gateway.labels" -}}
-{{ include "gateway.selectorLabels" . }}
-{{- range $key, $val := .Values.labels }}
-{{- if and (ne $key "app") (ne $key "istio") }}
-{{ $key | quote }}: {{ $val | quote }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{- define "gateway.selectorLabels" -}}
-app: {{ (.Values.labels.app | quote) | default (include "gateway.name" .) }}
-istio: {{ (.Values.labels.istio | quote) | default (include "gateway.name" . | trimPrefix "istio-") }}
-{{- end }}
-
-{{/*
-Keep sidecar injection labels together
-https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy
-*/}}
-{{- define "gateway.sidecarInjectionLabels" -}}
-sidecar.istio.io/inject: "true"
-{{- with .Values.revision }}
-istio.io/rev: {{ . | quote }}
-{{- end }}
-{{- end }}
-
-{{- define "gateway.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create }}
-{{- .Values.serviceAccount.name | default (include "gateway.name" .)    }}
-{{- else }}
-{{- .Values.serviceAccount.name | default "default" }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/templates/hpa.yaml b/resources/v1.28-alpha.724e2360/charts/gateway/templates/hpa.yaml
deleted file mode 100644
index 64ecb6a4c..000000000
--- a/resources/v1.28-alpha.724e2360/charts/gateway/templates/hpa.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-{{- if and (.Values.autoscaling.enabled) (eq .Values.kind "Deployment") }}
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: {{ include "gateway.name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: {{ .Values.kind | default "Deployment" }}
-    name: {{ include "gateway.name" . }}
-  minReplicas: {{ .Values.autoscaling.minReplicas }}
-  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
-  metrics:
-    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
-          type: Utilization
-    {{- end }}
-    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
-    - type: Resource
-      resource:
-        name: memory
-        target:
-          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
-          type: Utilization
-    {{- end }}
-  {{- if .Values.autoscaling.autoscaleBehavior }}
-  behavior: {{ toYaml .Values.autoscaling.autoscaleBehavior | nindent 4 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/templates/role.yaml b/resources/v1.28-alpha.724e2360/charts/gateway/templates/role.yaml
deleted file mode 100644
index 3d1607963..000000000
--- a/resources/v1.28-alpha.724e2360/charts/gateway/templates/role.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-{{/*Set up roles for Istio Gateway. Not required for gateway-api*/}}
-{{- if .Values.rbac.enabled }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get", "watch", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4}}
-  annotations:
-    {{- .Values.annotations | toYaml | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "gateway.serviceAccountName" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ include "gateway.serviceAccountName" . }}
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/templates/serviceaccount.yaml b/resources/v1.28-alpha.724e2360/charts/gateway/templates/serviceaccount.yaml
deleted file mode 100644
index c88afeadd..000000000
--- a/resources/v1.28-alpha.724e2360/charts/gateway/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-{{- if .Values.serviceAccount.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "gateway.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ include "gateway.name" . }}
-    {{- include "istio.labels" . | nindent 4}}
-    {{- include "gateway.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/Chart.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/Chart.yaml
deleted file mode 100644
index b01c5b10a..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/Chart.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: v2
-appVersion: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-description: Helm chart for istio control plane
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio
-- istiod
-- istio-discovery
-name: istiod
-sources:
-- https://github.com/istio/istio
-version: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/README.md b/resources/v1.28-alpha.724e2360/charts/istiod/README.md
deleted file mode 100644
index ddbfbc8fe..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/README.md
+++ /dev/null
@@ -1,73 +0,0 @@
-# Istiod Helm Chart
-
-This chart installs an Istiod deployment.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-Before installing, ensure CRDs are installed in the cluster (from the `istio/base` chart).
-
-To install the chart with the release name `istiod`:
-
-```console
-kubectl create namespace istio-system
-helm install istiod istio/istiod --namespace istio-system
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the `istiod` deployment:
-
-```console
-helm delete istiod --namespace istio-system
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/istiod
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
-
-### Examples
-
-#### Configuring mesh configuration settings
-
-Any [Mesh Config](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/) options can be configured like below:
-
-```yaml
-meshConfig:
-  accessLogFile: /dev/stdout
-```
-
-#### Revisions
-
-Control plane revisions allow deploying multiple versions of the control plane in the same cluster.
-This allows safe [canary upgrades](https://istio.io/latest/docs/setup/upgrade/canary/)
-
-```yaml
-revision: my-revision-name
-```
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/grpc-simple.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/files/grpc-simple.yaml
deleted file mode 100644
index 9ba0c7a46..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/files/grpc-simple.yaml
+++ /dev/null
@@ -1,65 +0,0 @@
-metadata:
-  annotations:
-    sidecar.istio.io/rewriteAppHTTPProbers: "false"
-spec:
-  initContainers:
-    - name: grpc-bootstrap-init
-      image: busybox:1.28
-      volumeMounts:
-        - mountPath: /var/lib/grpc/data/
-          name: grpc-io-proxyless-bootstrap
-      env:
-        - name: INSTANCE_IP
-          valueFrom:
-            fieldRef:
-              fieldPath: status.podIP
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: ISTIO_NAMESPACE
-          value: |
-             {{ .Values.global.istioNamespace }}
-      command:
-        - sh
-        - "-c"
-        - |-
-          NODE_ID="sidecar~${INSTANCE_IP}~${POD_NAME}.${POD_NAMESPACE}~cluster.local"
-          SERVER_URI="dns:///istiod.${ISTIO_NAMESPACE}.svc:15010"
-          echo '
-          {
-            "xds_servers": [
-              {
-                "server_uri": "'${SERVER_URI}'",
-                "channel_creds": [{"type": "insecure"}],
-                "server_features" : ["xds_v3"]
-              }
-            ],
-            "node": {
-              "id": "'${NODE_ID}'",
-              "metadata": {
-                "GENERATOR": "grpc"
-              }
-            }
-          }' > /var/lib/grpc/data/bootstrap.json
-  containers:
-  {{- range $index, $container := .Spec.Containers }}
-  - name: {{ $container.Name }}
-    env:
-      - name: GRPC_XDS_BOOTSTRAP
-        value: /var/lib/grpc/data/bootstrap.json
-      - name: GRPC_GO_LOG_VERBOSITY_LEVEL
-        value: "99"
-      - name: GRPC_GO_LOG_SEVERITY_LEVEL
-        value: info
-    volumeMounts:
-      - mountPath: /var/lib/grpc/data/
-        name: grpc-io-proxyless-bootstrap
-  {{- end }}
-  volumes:
-    - name: grpc-io-proxyless-bootstrap
-      emptyDir: {}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-k3d.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-microk8s.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-minikube.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-openshift.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-preview.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-remote.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-stable.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/NOTES.txt b/resources/v1.28-alpha.724e2360/charts/istiod/templates/NOTES.txt
deleted file mode 100644
index 0d07ea7f4..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/templates/NOTES.txt
+++ /dev/null
@@ -1,82 +0,0 @@
-"istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}" successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
-
-Next steps:
-{{- $profile := default "" .Values.profile }}
-{{- if (eq $profile "ambient") }}
-  * Get started with ambient: https://istio.io/latest/docs/ops/ambient/getting-started/
-  * Review ambient's architecture: https://istio.io/latest/docs/ops/ambient/architecture/
-{{- else }}
-  * Deploy a Gateway: https://istio.io/latest/docs/setup/additional-setup/gateway/
-  * Try out our tasks to get started on common configurations:
-    * https://istio.io/latest/docs/tasks/traffic-management
-    * https://istio.io/latest/docs/tasks/security/
-    * https://istio.io/latest/docs/tasks/policy-enforcement/
-{{- end }}
-  * Review the list of actively supported releases, CVE publications and our hardening guide:
-    * https://istio.io/latest/docs/releases/supported-releases/
-    * https://istio.io/latest/news/security/
-    * https://istio.io/latest/docs/ops/best-practices/security/
-
-For further documentation see https://istio.io website
-
-{{-
-  $deps := dict
-    "global.outboundTrafficPolicy" "meshConfig.outboundTrafficPolicy"
-    "global.certificates" "meshConfig.certificates"
-    "global.localityLbSetting" "meshConfig.localityLbSetting"
-    "global.policyCheckFailOpen" "meshConfig.policyCheckFailOpen"
-    "global.enableTracing" "meshConfig.enableTracing"
-    "global.proxy.accessLogFormat" "meshConfig.accessLogFormat"
-    "global.proxy.accessLogFile" "meshConfig.accessLogFile"
-    "global.proxy.concurrency" "meshConfig.defaultConfig.concurrency"
-    "global.proxy.envoyAccessLogService" "meshConfig.defaultConfig.envoyAccessLogService"
-    "global.proxy.envoyAccessLogService.enabled" "meshConfig.enableEnvoyAccessLogService"
-    "global.proxy.envoyMetricsService" "meshConfig.defaultConfig.envoyMetricsService"
-    "global.proxy.protocolDetectionTimeout" "meshConfig.protocolDetectionTimeout"
-    "global.proxy.holdApplicationUntilProxyStarts" "meshConfig.defaultConfig.holdApplicationUntilProxyStarts"
-    "pilot.ingress" "meshConfig.ingressService, meshConfig.ingressControllerMode, and meshConfig.ingressClass"
-    "global.mtls.enabled" "the PeerAuthentication resource"
-    "global.mtls.auto" "meshConfig.enableAutoMtls"
-    "global.tracer.lightstep.address" "meshConfig.defaultConfig.tracing.lightstep.address"
-    "global.tracer.lightstep.accessToken" "meshConfig.defaultConfig.tracing.lightstep.accessToken"
-    "global.tracer.zipkin.address" "meshConfig.defaultConfig.tracing.zipkin.address"
-    "global.tracer.datadog.address" "meshConfig.defaultConfig.tracing.datadog.address"
-    "global.meshExpansion.enabled" "Gateway and other Istio networking resources, such as in samples/multicluster/"
-    "istiocoredns.enabled" "the in-proxy DNS capturing (ISTIO_META_DNS_CAPTURE)"
-}}
-{{- range $dep, $replace := $deps }}
-{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
-{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
-{{- if not (eq $res "")}}
-WARNING: {{$dep|quote}} is deprecated; use {{$replace|quote}} instead.
-{{- end }}
-{{- end }}
-{{-
-  $failDeps := dict
-    "telemetry.v2.prometheus.configOverride"
-    "telemetry.v2.stackdriver.configOverride"
-    "telemetry.v2.stackdriver.disableOutbound"
-    "telemetry.v2.stackdriver.outboundAccessLogging"
-    "global.tracer.stackdriver.debug" "meshConfig.defaultConfig.tracing.stackdriver.debug"
-    "global.tracer.stackdriver.maxNumberOfAttributes" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes"
-    "global.tracer.stackdriver.maxNumberOfAnnotations" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations"
-    "global.tracer.stackdriver.maxNumberOfMessageEvents" "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents"
-    "meshConfig.defaultConfig.tracing.stackdriver.debug" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAttributes" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfAnnotations" "Istio supported tracers"
-    "meshConfig.defaultConfig.tracing.stackdriver.maxNumberOfMessageEvents" "Istio supported tracers"
-}}
-{{- range $dep, $replace := $failDeps }}
-{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
-{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
-{{- if not (eq $res "")}}
-{{fail (print $dep " is removed")}}
-{{- end }}
-{{- end }}
-{{- if eq $.Values.global.pilotCertProvider "kubernetes" }}
-{{- fail "pilotCertProvider=kubernetes is not supported" }}
-{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/_helpers.tpl b/resources/v1.28-alpha.724e2360/charts/istiod/templates/_helpers.tpl
deleted file mode 100644
index 042c92538..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/templates/_helpers.tpl
+++ /dev/null
@@ -1,23 +0,0 @@
-{{/* Default Prometheus is enabled if its enabled and there are no config overrides set */}}
-{{ define "default-prometheus" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.prometheus.enabled
-}}
-{{- end }}
-
-{{/* SD has metrics and logging split. Default metrics are enabled if SD is enabled */}}
-{{ define "default-sd-metrics" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
-}}
-{{- end }}
-
-{{/* SD has metrics and logging split. */}}
-{{ define "default-sd-logs" }}
-{{- and
-  (not .Values.meshConfig.defaultProviders)
-  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.stackdriver.enabled
-}}
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/clusterrole.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/templates/clusterrole.yaml
deleted file mode 100644
index 40f39511a..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/templates/clusterrole.yaml
+++ /dev/null
@@ -1,213 +0,0 @@
-# Created if this is not a remote istiod, OR if it is and is also a config cluster
-{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  # sidecar injection controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-
-  # configuration validation webhook controller
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-
-  # istio configuration
-  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
-  # please proceed with caution
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["get", "watch", "list"]
-    resources: ["*"]
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
-    verbs: ["update", "patch"]
-    resources:
-    - authorizationpolicies/status
-    - destinationrules/status
-    - envoyfilters/status
-    - gateways/status
-    - peerauthentications/status
-    - proxyconfigs/status
-    - requestauthentications/status
-    - serviceentries/status
-    - sidecars/status
-    - telemetries/status
-    - virtualservices/status
-    - wasmplugins/status
-    - workloadentries/status
-    - workloadgroups/status
-{{- end }}
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "workloadentries/status",  "serviceentries/status" ]
-  - apiGroups: ["security.istio.io"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "authorizationpolicies/status" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services/status" ]
-
-  # auto-detect installed CRD definitions
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-
-  # discovery and routing
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-
-{{- if .Values.taint.enabled }}
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["patch"]
-{{- end }}
-
-  # ingress controller
-{{- if .Values.global.istiod.enableAnalysis }}
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-{{- end}}
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses", "ingressclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["*"]
-
-  # required for CA's namespace controller
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-
-  # Istiod and bootstrap.
-{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
-{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "certificatesigningrequests"
-      - "certificatesigningrequests/approval"
-      - "certificatesigningrequests/status"
-    verbs: ["update", "create", "get", "delete", "watch"]
-  - apiGroups: ["certificates.k8s.io"]
-    resources:
-      - "signers"
-    resourceNames:
-{{- range .Values.global.certSigners }}
-    - {{ . | quote }}
-{{- end }}
-    verbs: ["approve"]
-{{- end}}
-{{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
-  - apiGroups: ["certificates.k8s.io"]
-    resources: ["clustertrustbundles"]
-    verbs: ["update", "create", "delete", "list", "watch", "get"]
-  - apiGroups: ["certificates.k8s.io"]
-    resources: ["signers"]
-    resourceNames: ["istio.io/istiod-ca"]
-    verbs: ["attest"]
-{{- end }}
-
-  # Used by Istiod to verify the JWT tokens
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-
-  # Used by Istiod to verify gateway SDS
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-
-  # Use for Kubernetes Service APIs
-  - apiGroups: ["gateway.networking.k8s.io", "gateway.networking.x-k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["gateway.networking.x-k8s.io"]
-    resources:
-    - xbackendtrafficpolicies/status
-    - xlistenersets/status
-    verbs: ["update", "patch"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources:
-    - backendtlspolicies/status
-    - gatewayclasses/status
-    - gateways/status
-    - grpcroutes/status
-    - httproutes/status
-    - referencegrants/status
-    - tcproutes/status
-    - tlsroutes/status
-    - udproutes/status
-    verbs: ["update", "patch"]
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["gatewayclasses"]
-    verbs: ["create", "update", "patch", "delete"]
-  - apiGroups: ["inference.networking.k8s.io"]
-    resources: ["inferencepools"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["inference.networking.k8s.io"]
-    resources: ["inferencepools/status"]
-    verbs: ["update", "patch"]
-
-  # Needed for multicluster secret reading, possibly ingress certs in the future
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "watch", "list"]
-
-  # Used for MCS serviceexport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: [ "get", "watch", "list", "create", "delete"]
-
-  # Used for MCS serviceimport management
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "watch", "list"]
----
-{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istiod
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups: ["apps"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "deployments" ]
-  - apiGroups: ["autoscaling"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "horizontalpodautoscalers" ]
-  - apiGroups: ["policy"]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "poddisruptionbudgets" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "services" ]
-  - apiGroups: [""]
-    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
-    resources: [ "serviceaccounts"]
-{{- end }}
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/networkpolicy.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/templates/networkpolicy.yaml
deleted file mode 100644
index bcc1594d9..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/templates/networkpolicy.yaml
+++ /dev/null
@@ -1,45 +0,0 @@
-{{- if (.Values.global.networkPolicy).enabled }}
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    istio: pilot
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  podSelector:
-    matchLabels:
-      app: istiod
-      istio.io/rev: {{ .Values.revision | default "default" | quote }}
-  policyTypes:
-  - Ingress
-  - Egress
-  ingress:
-  # Webhook from kube-apiserver
-  - from: []
-    ports:
-    - protocol: TCP
-      port: 15017
-  # xDS from potentially anywhere
-  - from: []
-    ports:
-    - protocol: TCP
-      port: 15010
-    - protocol: TCP
-      port: 15011
-    - protocol: TCP
-      port: 15012
-    - protocol: TCP
-      port: 8080
-    - protocol: TCP
-      port: 15014
-  # Allow all egress (needed because features like JWKS require connections to user-defined endpoints)
-  egress:
-  - {}
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/templates/poddisruptionbudget.yaml
deleted file mode 100644
index fcd6c7c2e..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/templates/poddisruptionbudget.yaml
+++ /dev/null
@@ -1,39 +0,0 @@
-# Not created if istiod is running remotely
-{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
-{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
-# a workaround for https://github.com/kubernetes/kubernetes/issues/93476
-{{- if or (and .Values.autoscaleEnabled  (gt (int .Values.autoscaleMin) 1)) (and (not .Values.autoscaleEnabled) (gt (int .Values.replicaCount) 1)) }}
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: istiod
-    istio.io/rev: {{ .Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    release: {{ .Release.Name }}
-    istio: pilot
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-spec:
-  {{- if and .Values.pdb.minAvailable (not (hasKey .Values.pdb "maxUnavailable")) }}
-  minAvailable: {{ .Values.pdb.minAvailable }}
-  {{- else if .Values.pdb.maxUnavailable }}
-  maxUnavailable: {{ .Values.pdb.maxUnavailable }}
-  {{- end }}
-  {{- if .Values.pdb.unhealthyPodEvictionPolicy }}
-  unhealthyPodEvictionPolicy: {{ .Values.pdb.unhealthyPodEvictionPolicy }}
-  {{- end }}
-  selector:
-    matchLabels:
-      app: istiod
-      {{- if ne .Values.revision "" }}
-      istio.io/rev: {{ .Values.revision | quote }}
-      {{- else }}
-      istio: pilot
-      {{- end }}
----
-{{- end }}
-{{- end }}
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/templates/reader-clusterrole.yaml
deleted file mode 100644
index dbaa80503..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/templates/reader-clusterrole.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-rules:
-  - apiGroups:
-      - "config.istio.io"
-      - "security.istio.io"
-      - "networking.istio.io"
-      - "authentication.istio.io"
-      - "rbac.istio.io"
-      - "telemetry.istio.io"
-      - "extensions.istio.io"
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.istio.io"]
-    verbs: [ "get", "watch", "list" ]
-    resources: [ "workloadentries" ]
-  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
-    resources: ["gateways"]
-    verbs: ["get", "watch", "list"]
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceexports"]
-    verbs: ["get", "list", "watch", "create", "delete"]
-  - apiGroups: ["{{ $mcsAPIGroup }}"]
-    resources: ["serviceimports"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["apps"]
-    resources: ["replicasets"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["create"]
-  - apiGroups: ["authorization.k8s.io"]
-    resources: ["subjectaccessreviews"]
-    verbs: ["create"]
-{{- if .Values.istiodRemote.enabled }}
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "list", "watch", "update"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["mutatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: ["admissionregistration.k8s.io"]
-    resources: ["validatingwebhookconfigurations"]
-    verbs: ["get", "list", "watch", "update"]
-{{- end}}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/reader-clusterrolebinding.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/templates/reader-clusterrolebinding.yaml
deleted file mode 100644
index aea9f01f7..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/templates/reader-clusterrolebinding.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-  labels:
-    app: istio-reader
-    release: {{ .Release.Name }}
-    app.kubernetes.io/name: "istio-reader"
-    {{- include "istio.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: istio-reader-service-account
-    namespace: {{ .Values.global.istioNamespace }}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/remote-istiod-endpointslices.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/templates/remote-istiod-endpointslices.yaml
deleted file mode 100644
index c173124cd..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/templates/remote-istiod-endpointslices.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-{{- if and .Values.global.remotePilotAddress .Values.istiodRemote.enabled }}
-# if the remotePilotAddress is an IP addr
-{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
-apiVersion: discovery.k8s.io/v1
-kind: EndpointSlice
-metadata:
-  {{- if .Values.istiodRemote.enabledLocalInjectorIstiod }}
-  # This file is only used for remote `istiod` installs.
-  # only primary `istiod` to xds and local `istiod` injection installs.
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
-  {{- else }}
-  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-  {{- end }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- if .Values.istiodRemote.enabledLocalInjectorIstiod }}
-    # only primary `istiod` to xds and local `istiod` injection installs.
-    kubernetes.io/service-name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
-    {{- else }}
-    kubernetes.io/service-name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
-    {{- end }}
-    {{- if .Release.Service }}
-    endpointslice.kubernetes.io/managed-by: {{ .Release.Service | quote }}
-    {{- end }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" . | nindent 4 }}
-addressType: IPv4
-endpoints:
-- addresses:
-  - {{ .Values.global.remotePilotAddress }}
-ports:
-- port: 15012
-  name: tcp-istiod
-  protocol: TCP
-- port: 15017
-  name: tcp-webhook
-  protocol: TCP
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/revision-tags-mwc.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/templates/revision-tags-mwc.yaml
deleted file mode 100644
index d86f5aea8..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/templates/revision-tags-mwc.yaml
+++ /dev/null
@@ -1,151 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
-"revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "caBundle" .Values.istiodRemote.injectionCABundle
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  reinvocationPolicy: "{{ .reinvocationPolicy }}"
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- if not .Values.global.operatorManageWebhooks }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/revision-tags-svc.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/templates/revision-tags-svc.yaml
deleted file mode 100644
index d2e9a3e67..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/templates/revision-tags-svc.yaml
+++ /dev/null
@@ -1,55 +0,0 @@
-# Adapted from istio-discovery/templates/service.yaml
-{{- range $tagName := .Values.revisionTags }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod-revision-tag-{{ $tagName }}
-  namespace: {{ $.Release.Namespace }}
-  {{- if $.Values.serviceAnnotations }}
-  annotations:
-{{ toYaml $.Values.serviceAnnotations | indent 4 }}
-  {{- end }}
-  labels:
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    istio.io/tag: {{ $tagName }}
-    operator.istio.io/component: "Pilot"
-    app: istiod
-    istio: pilot
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-spec:
-  ports:
-    - port: 15010
-      name: grpc-xds # plaintext
-      protocol: TCP
-    - port: 15012
-      name: https-dns # mTLS with k8s-signed cert
-      protocol: TCP
-    - port: 443
-      name: https-webhook # validation and injection
-      targetPort: 15017
-      protocol: TCP
-    - port: 15014
-      name: http-monitoring # prometheus stats
-      protocol: TCP
-  selector:
-    app: istiod
-    {{- if ne $.Values.revision "" }}
-    istio.io/rev: {{ $.Values.revision | quote }}
-    {{- else }}
-    # Label used by the 'default' service. For versioned deployments we match with app and version.
-    # This avoids default deployment picking the canary
-    istio: pilot
-    {{- end }}
-  {{- if $.Values.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ $.Values.ipFamilyPolicy }}
-  {{- end }}
-  {{- if $.Values.ipFamilies }}
-  ipFamilies:
-  {{- range $.Values.ipFamilies }}
-  - {{ . }}
-  {{- end }}
-  {{- end }}
----
-{{- end -}}
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/templates/zzy_descope_legacy.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/templates/zzy_descope_legacy.yaml
deleted file mode 100644
index ae8fced29..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/templates/zzy_descope_legacy.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-{{/* Copy anything under `.pilot` to `.`, to avoid the need to specify a redundant prefix.
-Due to the file naming, this always happens after zzz_profile.yaml */}}
-{{- $_ := mustMergeOverwrite $.Values (index $.Values "pilot") }}
\ No newline at end of file
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/values.yaml b/resources/v1.28-alpha.724e2360/charts/istiod/values.yaml
deleted file mode 100644
index 3bff376ff..000000000
--- a/resources/v1.28-alpha.724e2360/charts/istiod/values.yaml
+++ /dev/null
@@ -1,575 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  envVarFrom: []
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  # Annotations to apply to the istiod deployment.
-  deploymentAnnotations: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-  # Set this if you install ztunnel with a name different from the default.
-  trustedZtunnelName: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-
-    # If `true`, indicates that this cluster/install should consume a "local istiod" installation,
-    # local istiod inject sidecars
-    enabledLocalInjectorIstiod: false
-
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-testing
-    # Default tag for Istio images.
-    tag: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # In order to use native nftable rules instead of iptable rules, set this flag to true.
-    nativeNftables: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    # When enabled, default NetworkPolicy resources will be created
-    networkPolicy:
-      enabled: false
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-      
-      seccompProfile: {}
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
-
-  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
-  # For example:
-  # gatewayClasses:
-  #   istio:
-  #     service:
-  #       spec:
-  #         type: ClusterIP
-  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
-  gatewayClasses: {}
-  
-  pdb:
-    # -- Minimum available pods set in PodDisruptionBudget.
-    # Define either 'minAvailable' or 'maxUnavailable', never both.
-    minAvailable: 1
-    # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
-    # maxUnavailable: 1
-    # -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.
-    # Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/
-    unhealthyPodEvictionPolicy: ""
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/Chart.yaml b/resources/v1.28-alpha.724e2360/charts/revisiontags/Chart.yaml
deleted file mode 100644
index 6b54bfbff..000000000
--- a/resources/v1.28-alpha.724e2360/charts/revisiontags/Chart.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v2
-appVersion: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-description: Helm chart for istio revision tags
-name: revisiontags
-sources:
-- https://github.com/istio-ecosystem/sail-operator
-version: 0.1.0
-
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-k3d.yaml b/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-microk8s.yaml b/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-minikube.yaml b/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-openshift.yaml b/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-preview.yaml b/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-remote.yaml b/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-stable.yaml b/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/templates/revision-tags-mwc.yaml b/resources/v1.28-alpha.724e2360/charts/revisiontags/templates/revision-tags-mwc.yaml
deleted file mode 100644
index d86f5aea8..000000000
--- a/resources/v1.28-alpha.724e2360/charts/revisiontags/templates/revision-tags-mwc.yaml
+++ /dev/null
@@ -1,151 +0,0 @@
-# Adapted from istio-discovery/templates/mutatingwebhook.yaml
-# Removed paths for legacy and default selectors since a revision tag
-# is inherently created from a specific revision
-# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
-{{- $whv := dict
-"revision" .Values.revision
-  "injectionPath" .Values.istiodRemote.injectionPath
-  "injectionURL" .Values.istiodRemote.injectionURL
-  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
-  "caBundle" .Values.istiodRemote.injectionCABundle
-  "namespace" .Release.Namespace }}
-{{- define "core" }}
-{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
-a unique prefix to each. */}}
-- name: {{.Prefix}}sidecar-injector.istio.io
-  clientConfig:
-    {{- if .injectionURL }}
-    url: "{{ .injectionURL }}"
-    {{- else }}
-    service:
-      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
-      namespace: {{ .namespace }}
-      path: "{{ .injectionPath }}"
-      port: 443
-    {{- end }}
-  sideEffects: None
-  rules:
-  - operations: [ "CREATE" ]
-    apiGroups: [""]
-    apiVersions: ["v1"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  reinvocationPolicy: "{{ .reinvocationPolicy }}"
-  admissionReviewVersions: ["v1"]
-{{- end }}
-{{- if not .Values.global.operatorManageWebhooks }}
-{{- range $tagName := $.Values.revisionTags }}
-apiVersion: admissionregistration.k8s.io/v1
-kind: MutatingWebhookConfiguration
-metadata:
-{{- if eq $.Release.Namespace "istio-system"}}
-  name: istio-revision-tag-{{ $tagName }}
-{{- else }}
-  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
-{{- end }}
-  labels:
-    istio.io/tag: {{ $tagName }}
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    operator.istio.io/component: "Pilot"
-    app: sidecar-injector
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-{{- if $.Values.sidecarInjectorWebhookAnnotations }}
-  annotations:
-{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
-{{- end }}
-webhooks:
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: istio-injection
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-    - key: istio.io/rev
-      operator: In
-      values:
-      - "{{ $tagName }}"
-
-{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
-{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
-{{- if (eq $tagName "default") }}
-
-{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: In
-      values:
-      - enabled
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: NotIn
-      values:
-      - "false"
-
-{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: In
-      values:
-      - "true"
-    - key: istio.io/rev
-      operator: DoesNotExist
-
-{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
-{{- /* Special case 3: no labels at all */}}
-{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
-  namespaceSelector:
-    matchExpressions:
-    - key: istio-injection
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-    - key: "kubernetes.io/metadata.name"
-      operator: "NotIn"
-      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
-  objectSelector:
-    matchExpressions:
-    - key: sidecar.istio.io/inject
-      operator: DoesNotExist
-    - key: istio.io/rev
-      operator: DoesNotExist
-{{- end }}
-
-{{- end }}
----
-{{- end }}
-{{- end }}
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/templates/revision-tags-svc.yaml b/resources/v1.28-alpha.724e2360/charts/revisiontags/templates/revision-tags-svc.yaml
deleted file mode 100644
index d2e9a3e67..000000000
--- a/resources/v1.28-alpha.724e2360/charts/revisiontags/templates/revision-tags-svc.yaml
+++ /dev/null
@@ -1,55 +0,0 @@
-# Adapted from istio-discovery/templates/service.yaml
-{{- range $tagName := .Values.revisionTags }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: istiod-revision-tag-{{ $tagName }}
-  namespace: {{ $.Release.Namespace }}
-  {{- if $.Values.serviceAnnotations }}
-  annotations:
-{{ toYaml $.Values.serviceAnnotations | indent 4 }}
-  {{- end }}
-  labels:
-    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
-    istio.io/tag: {{ $tagName }}
-    operator.istio.io/component: "Pilot"
-    app: istiod
-    istio: pilot
-    release: {{ $.Release.Name }}
-    app.kubernetes.io/name: "istiod"
-    {{- include "istio.labels" $ | nindent 4 }}
-spec:
-  ports:
-    - port: 15010
-      name: grpc-xds # plaintext
-      protocol: TCP
-    - port: 15012
-      name: https-dns # mTLS with k8s-signed cert
-      protocol: TCP
-    - port: 443
-      name: https-webhook # validation and injection
-      targetPort: 15017
-      protocol: TCP
-    - port: 15014
-      name: http-monitoring # prometheus stats
-      protocol: TCP
-  selector:
-    app: istiod
-    {{- if ne $.Values.revision "" }}
-    istio.io/rev: {{ $.Values.revision | quote }}
-    {{- else }}
-    # Label used by the 'default' service. For versioned deployments we match with app and version.
-    # This avoids default deployment picking the canary
-    istio: pilot
-    {{- end }}
-  {{- if $.Values.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ $.Values.ipFamilyPolicy }}
-  {{- end }}
-  {{- if $.Values.ipFamilies }}
-  ipFamilies:
-  {{- range $.Values.ipFamilies }}
-  - {{ . }}
-  {{- end }}
-  {{- end }}
----
-{{- end -}}
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/values.yaml b/resources/v1.28-alpha.724e2360/charts/revisiontags/values.yaml
deleted file mode 100644
index 3bff376ff..000000000
--- a/resources/v1.28-alpha.724e2360/charts/revisiontags/values.yaml
+++ /dev/null
@@ -1,575 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  autoscaleEnabled: true
-  autoscaleMin: 1
-  autoscaleMax: 5
-  autoscaleBehavior: {}
-  replicaCount: 1
-  rollingMaxSurge: 100%
-  rollingMaxUnavailable: 25%
-
-  hub: ""
-  tag: ""
-  variant: ""
-
-  # Can be a full hub/image:tag
-  image: pilot
-  traceSampling: 1.0
-
-  # Resources for a small pilot install
-  resources:
-    requests:
-      cpu: 500m
-      memory: 2048Mi
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seccompProfile: {}
-
-  # Whether to use an existing CNI installation
-  cni:
-    enabled: false
-    provider: default
-
-  # Additional container arguments
-  extraContainerArgs: []
-
-  env: {}
-
-  envVarFrom: []
-
-  # Settings related to the untaint controller
-  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
-  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
-  taint:
-    # Controls whether or not the untaint controller is active
-    enabled: false
-    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
-    namespace: ""
-
-  affinity: {}
-
-  tolerations: []
-
-  cpu:
-    targetAverageUtilization: 80
-  memory: {}
-    # targetAverageUtilization: 80
-
-  # Additional volumeMounts to the istiod container
-  volumeMounts: []
-
-  # Additional volumes to the istiod pod
-  volumes: []
-
-  # Inject initContainers into the istiod pod
-  initContainers: []
-
-  nodeSelector: {}
-  podAnnotations: {}
-  serviceAnnotations: {}
-  serviceAccountAnnotations: {}
-  sidecarInjectorWebhookAnnotations: {}
-
-  topologySpreadConstraints: []
-
-  # You can use jwksResolverExtraRootCA to provide a root certificate
-  # in PEM format. This will then be trusted by pilot when resolving
-  # JWKS URIs.
-  jwksResolverExtraRootCA: ""
-
-  # The following is used to limit how long a sidecar can be connected
-  # to a pilot. It balances out load across pilot instances at the cost of
-  # increasing system churn.
-  keepaliveMaxServerConnectionAge: 30m
-
-  # Additional labels to apply to the deployment.
-  deploymentLabels: {}
-
-  # Annotations to apply to the istiod deployment.
-  deploymentAnnotations: {}
-
-  ## Mesh config settings
-
-  # Install the mesh config map, generated from values.yaml.
-  # If false, pilot wil use default values (by default) or user-supplied values.
-  configMap: true
-
-  # Additional labels to apply on the pod level for monitoring and logging configuration.
-  podLabels: {}
-
-  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-  ipFamilyPolicy: ""
-  ipFamilies: []
-
-  # Ambient mode only.
-  # Set this if you install ztunnel to a different namespace from `istiod`.
-  # If set, `istiod` will allow connections from trusted node proxy ztunnels
-  # in the provided namespace.
-  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
-  # in the same namespace as itself.
-  trustedZtunnelNamespace: ""
-  # Set this if you install ztunnel with a name different from the default.
-  trustedZtunnelName: ""
-
-  sidecarInjectorWebhook:
-    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
-    # always skip the injection on pods that match that label selector, regardless of the global policy.
-    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
-    neverInjectSelector: []
-    alwaysInjectSelector: []
-
-    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
-    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
-    #
-    # annotations:
-    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    #
-    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
-    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
-    # injectedAnnotations:
-    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
-    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
-    injectedAnnotations: {}
-
-    # This enables injection of sidecar in all namespaces,
-    # with the exception of namespaces with "istio-injection:disabled" annotation
-    # Only one environment should have this enabled.
-    enableNamespacesByDefault: false
-
-    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
-    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
-    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
-    reinvocationPolicy: Never
-
-    rewriteAppHTTPProbe: true
-
-    # Templates defines a set of custom injection templates that can be used. For example, defining:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
-    # being injected with the hello=world labels.
-    # This is intended for advanced configuration only; most users should use the built in template
-    templates: {}
-
-    # Default templates specifies a set of default templates that are used in sidecar injection.
-    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
-    # To inject other additional templates, define it using the `templates` option, and add it to
-    # the default templates list.
-    # For example:
-    #
-    # templates:
-    #   hello: |
-    #     metadata:
-    #       labels:
-    #         hello: world
-    #
-    # defaultTemplates: ["sidecar", "hello"]
-    defaultTemplates: []
-  istiodRemote:
-    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
-    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
-    # to utilize a remote instance.
-    enabled: false
-
-    # If `true`, indicates that this cluster/install should consume a "local istiod" installation,
-    # local istiod inject sidecars
-    enabledLocalInjectorIstiod: false
-
-    # Sidecar injector mutating webhook configuration clientConfig.url value.
-    # For example: https://$remotePilotAddress:15017/inject
-    # The host should not refer to a service running in the cluster; use a service reference by specifying
-    # the clientConfig.service field instead.
-    injectionURL: ""
-
-    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
-    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
-    injectionPath: "/inject"
-
-    injectionCABundle: ""
-  telemetry:
-    enabled: true
-    v2:
-      # For Null VM case now.
-      # This also enables metadata exchange.
-      enabled: true
-      # Indicate if prometheus stats filter is enabled or not
-      prometheus:
-        enabled: true
-      # stackdriver filter settings.
-      stackdriver:
-        enabled: false
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  revision: ""
-
-  # Revision tags are aliases to Istio control plane revisions
-  revisionTags: []
-
-  # For Helm compatibility.
-  ownerName: ""
-
-  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
-  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
-  meshConfig:
-    enablePrometheusMerge: true
-
-  experimental:
-    stableValidationPolicy: false
-
-  global:
-    # Used to locate istiod.
-    istioNamespace: istio-system
-    # List of cert-signers to allow "approve" action in the istio cluster role
-    #
-    # certSigners:
-    #   - clusterissuers.cert-manager.io/istio-ca
-    certSigners: []
-    # enable pod disruption budget for the control plane, which is used to
-    # ensure Istio control plane components are gradually upgraded or recovered.
-    defaultPodDisruptionBudget:
-      enabled: true
-      # The values aren't mutable due to a current PodDisruptionBudget limitation
-      # minAvailable: 1
-
-    # A minimal set of requested resources to applied to all deployments so that
-    # Horizontal Pod Autoscaler will be able to function (if set).
-    # Each component can overwrite these default values by adding its own resources
-    # block in the relevant section below and setting the desired resources values.
-    defaultResources:
-      requests:
-        cpu: 10m
-      #   memory: 128Mi
-      # limits:
-      #   cpu: 100m
-      #   memory: 128Mi
-
-    # Default hub for Istio images.
-    # Releases are published to docker hub under 'istio' project.
-    # Dev builds from prow are on gcr.io
-    hub: gcr.io/istio-testing
-    # Default tag for Istio images.
-    tag: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-    # Variant of the image to use.
-    # Currently supported are: [debug, distroless]
-    variant: ""
-
-    # Specify image pull policy if default behavior isn't desired.
-    # Default behavior: latest images will be Always else IfNotPresent.
-    imagePullPolicy: ""
-
-    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
-    # to use for pulling any images in pods that reference this ServiceAccount.
-    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
-    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
-    # Must be set for any cluster configured with private docker registry.
-    imagePullSecrets: []
-    # - private-registry-key
-
-    # Enabled by default in master for maximising testing.
-    istiod:
-      enableAnalysis: false
-
-    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
-    logAsJson: false
-
-    # In order to use native nftable rules instead of iptable rules, set this flag to true.
-    nativeNftables: false
-
-    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
-    # The control plane has different scopes depending on component, but can configure default log level across all components
-    # If empty, default scope and level will be used as configured in code
-    logging:
-      level: "default:info"
-
-    # When enabled, default NetworkPolicy resources will be created
-    networkPolicy:
-      enabled: false
-
-    omitSidecarInjectorConfigMap: false
-
-    # Configure whether Operator manages webhook configurations. The current behavior
-    # of Istiod is to manage its own webhook configurations.
-    # When this option is set as true, Istio Operator, instead of webhooks, manages the
-    # webhook configurations. When this option is set as false, webhooks manage their
-    # own webhook configurations.
-    operatorManageWebhooks: false
-
-    # Custom DNS config for the pod to resolve names of services in other
-    # clusters. Use this to add additional search domains, and other settings.
-    # see
-    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
-    # This does not apply to gateway pods as they typically need a different
-    # set of DNS settings than the normal application pods (e.g., in
-    # multicluster scenarios).
-    # NOTE: If using templates, follow the pattern in the commented example below.
-    #podDNSSearchNamespaces:
-    #- global
-    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
-
-    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
-    # system-node-critical, it is better to configure this in order to make sure your Istio pods
-    # will not be killed because of low priority class.
-    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
-    # for more detail.
-    priorityClassName: ""
-
-    proxy:
-      image: proxyv2
-
-      # This controls the 'policy' in the sidecar injector.
-      autoInject: enabled
-
-      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
-      # cluster domain. Default value is "cluster.local".
-      clusterDomain: "cluster.local"
-
-      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
-      # not set, then the global "logLevel" will be used.
-      componentLogLevel: "misc:error"
-
-      # istio ingress capture allowlist
-      # examples:
-      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
-      excludeInboundPorts: ""
-      includeInboundPorts: "*"
-
-      # istio egress capture allowlist
-      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
-      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
-      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
-      # be allowed by the sidecar
-      includeIPRanges: "*"
-      excludeIPRanges: ""
-      includeOutboundPorts: ""
-      excludeOutboundPorts: ""
-
-      # Log level for proxy, applies to gateways and sidecars.
-      # Expected values are: trace|debug|info|warning|error|critical|off
-      logLevel: warning
-
-      # Specify the path to the outlier event log.
-      # Example: /dev/stdout
-      outlierLogPath: ""
-
-      #If set to true, istio-proxy container will have privileged securityContext
-      privileged: false
-      
-      seccompProfile: {}
-
-      # The number of successive failed probes before indicating readiness failure.
-      readinessFailureThreshold: 4
-
-      # The initial delay for readiness probes in seconds.
-      readinessInitialDelaySeconds: 0
-
-      # The period between readiness probes.
-      readinessPeriodSeconds: 15
-
-      # Enables or disables a startup probe.
-      # For optimal startup times, changing this should be tied to the readiness probe values.
-      #
-      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
-      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
-      # and doesn't spam the readiness endpoint too much
-      #
-      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
-      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
-      startupProbe:
-        enabled: true
-        failureThreshold: 600 # 10 minutes
-
-      # Resources for the sidecar.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: 2000m
-          memory: 1024Mi
-
-      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
-      statusPort: 15020
-
-      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
-      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
-      tracer: "none"
-
-    proxy_init:
-      # Base name for the proxy_init container, used to configure iptables.
-      image: proxyv2
-      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
-      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
-      forceApplyIptables: false
-
-    # configure remote pilot and istiod service and endpoint
-    remotePilotAddress: ""
-
-    ##############################################################################################
-    # The following values are found in other charts. To effectively modify these values, make   #
-    # make sure they are consistent across your Istio helm charts                                #
-    ##############################################################################################
-
-    # The customized CA address to retrieve certificates for the pods in the cluster.
-    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-    # If not set explicitly, default to the Istio discovery address.
-    caAddress: ""
-
-    # Enable control of remote clusters.
-    externalIstiod: false
-
-    # Configure a remote cluster as the config cluster for an external istiod.
-    configCluster: false
-
-    # configValidation enables the validation webhook for Istio configuration.
-    configValidation: true
-
-    # Mesh ID means Mesh Identifier. It should be unique within the scope where
-    # meshes will interact with each other, but it is not required to be
-    # globally/universally unique. For example, if any of the following are true,
-    # then two meshes must have different Mesh IDs:
-    # - Meshes will have their telemetry aggregated in one place
-    # - Meshes will be federated together
-    # - Policy will be written referencing one mesh from the other
-    #
-    # If an administrator expects that any of these conditions may become true in
-    # the future, they should ensure their meshes have different Mesh IDs
-    # assigned.
-    #
-    # Within a multicluster mesh, each cluster must be (manually or auto)
-    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
-    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
-    # of migration TBD, and it may be a disruptive operation to change the Mesh
-    # ID post-install.
-    #
-    # If the mesh admin does not specify a value, Istio will use the value of the
-    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
-    # value.
-    meshID: ""
-
-    # Configure the mesh networks to be used by the Split Horizon EDS.
-    #
-    # The following example defines two networks with different endpoints association methods.
-    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
-    # mapped to network1. The gateway for this network example is specified by its public IP
-    # address and port.
-    # The second network, `network2`, in this example is defined differently with all endpoints
-    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
-    # gateway is also defined differently with the name of the gateway service on the remote
-    # cluster. The public IP for the gateway will be determined from that remote service (only
-    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
-    # it still need to be configured manually).
-    #
-    # meshNetworks:
-    #   network1:
-    #     endpoints:
-    #     - fromCidr: "192.168.0.1/24"
-    #     gateways:
-    #     - address: 1.1.1.1
-    #       port: 80
-    #   network2:
-    #     endpoints:
-    #     - fromRegistry: reg1
-    #     gateways:
-    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
-    #       port: 443
-    #
-    meshNetworks: {}
-
-    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
-    mountMtlsCerts: false
-
-    multiCluster:
-      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
-      # to properly label proxies
-      clusterName: ""
-
-    # Network defines the network this cluster belong to. This name
-    # corresponds to the networks in the map of mesh networks.
-    network: ""
-
-    # Configure the certificate provider for control plane communication.
-    # Currently, two providers are supported: "kubernetes" and "istiod".
-    # As some platforms may not have kubernetes signing APIs,
-    # Istiod is the default
-    pilotCertProvider: istiod
-
-    sds:
-      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
-      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
-      # JWT is intended for the CA.
-      token:
-        aud: istio-ca
-
-    sts:
-      # The service port used by Security Token Service (STS) server to handle token exchange requests.
-      # Setting this port to a non-zero value enables STS server.
-      servicePort: 0
-
-    # The name of the CA for workload certificates.
-    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
-    # will be used as the certificates for workloads.
-    # The default value is "" and when caName="", the CA will be configured by other
-    # mechanisms (e.g., environmental variable CA_PROVIDER).
-    caName: ""
-
-    waypoint:
-      # Resources for the waypoint proxy.
-      resources:
-        requests:
-          cpu: 100m
-          memory: 128Mi
-        limits:
-          cpu: "2"
-          memory: 1Gi
-
-      # If specified, affinity defines the scheduling constraints of waypoint pods.
-      affinity: {}
-
-      # Topology Spread Constraints for the waypoint proxy.
-      topologySpreadConstraints: []
-
-      # Node labels for the waypoint proxy.
-      nodeSelector: {}
-
-      # Tolerations for the waypoint proxy.
-      tolerations: []
-
-  base:
-    # For istioctl usage to disable istio config crds in base
-    enableIstioConfigCRDs: true
-
-  # Gateway Settings
-  gateways:
-    # Define the security context for the pod.
-    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
-    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
-    securityContext: {}
-
-    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
-    seccompProfile: {}
-
-  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
-  # For example:
-  # gatewayClasses:
-  #   istio:
-  #     service:
-  #       spec:
-  #         type: ClusterIP
-  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
-  gatewayClasses: {}
-  
-  pdb:
-    # -- Minimum available pods set in PodDisruptionBudget.
-    # Define either 'minAvailable' or 'maxUnavailable', never both.
-    minAvailable: 1
-    # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
-    # maxUnavailable: 1
-    # -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.
-    # Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/
-    unhealthyPodEvictionPolicy: ""
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/Chart.yaml b/resources/v1.28-alpha.724e2360/charts/ztunnel/Chart.yaml
deleted file mode 100644
index 153b7c37a..000000000
--- a/resources/v1.28-alpha.724e2360/charts/ztunnel/Chart.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-apiVersion: v2
-appVersion: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-description: Helm chart for istio ztunnel components
-icon: https://istio.io/latest/favicons/android-192x192.png
-keywords:
-- istio-ztunnel
-- istio
-name: ztunnel
-sources:
-- https://github.com/istio/istio
-version: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/README.md b/resources/v1.28-alpha.724e2360/charts/ztunnel/README.md
deleted file mode 100644
index ffe0b94fe..000000000
--- a/resources/v1.28-alpha.724e2360/charts/ztunnel/README.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# Istio Ztunnel Helm Chart
-
-This chart installs an Istio ztunnel.
-
-## Setup Repo Info
-
-```console
-helm repo add istio https://istio-release.storage.googleapis.com/charts
-helm repo update
-```
-
-_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
-
-## Installing the Chart
-
-To install the chart:
-
-```console
-helm install ztunnel istio/ztunnel
-```
-
-## Uninstalling the Chart
-
-To uninstall/delete the chart:
-
-```console
-helm delete ztunnel
-```
-
-## Configuration
-
-To view support configuration options and documentation, run:
-
-```console
-helm show values istio/ztunnel
-```
-
-### Profiles
-
-Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
-These can be set with `--set profile=<profile>`.
-For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
-
-For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
-
-Explicitly set values have highest priority, then profile settings, then chart defaults.
-
-As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
-When configuring the chart, you should not include this.
-That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-k3d.yaml b/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-k3d.yaml
deleted file mode 100644
index cd86d9ec5..000000000
--- a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-k3d.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-  cniBinDir: /bin
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-microk8s.yaml b/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-microk8s.yaml
deleted file mode 100644
index 57d7f5e3c..000000000
--- a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-microk8s.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniConfDir: /var/snap/microk8s/current/args/cni-network
-  cniBinDir: /var/snap/microk8s/current/opt/cni/bin
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-minikube.yaml b/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-minikube.yaml
deleted file mode 100644
index fa9992e20..000000000
--- a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-minikube.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-cni:
-  cniNetnsDir: /var/run/docker/netns
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-openshift.yaml b/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-openshift.yaml
deleted file mode 100644
index 8ddc5e165..000000000
--- a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-openshift.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The OpenShift profile provides a basic set of settings to run Istio on OpenShift
-cni:
-  cniBinDir: /var/lib/cni/bin
-  cniConfDir: /etc/cni/multus/net.d
-  chained: false
-  cniConfFileName: "istio-cni.conf"
-  provider: "multus"
-pilot:
-  cni:
-    enabled: true
-    provider: "multus"
-seLinuxOptions:
-  type: spc_t
-# Openshift requires privileged pods to run in kube-system
-trustedZtunnelNamespace: "kube-system"
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-preview.yaml b/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-preview.yaml
deleted file mode 100644
index 181d7bda2..000000000
--- a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-preview.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-meshConfig:
-  defaultConfig:
-    proxyMetadata:
-      # Enable Istio agent to handle DNS requests for known hosts
-      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf
-      ISTIO_META_DNS_CAPTURE: "true"
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-remote.yaml b/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-remote.yaml
deleted file mode 100644
index d17b9a801..000000000
--- a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-remote.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The remote profile enables installing istio with a remote control plane. The `base` and `istio-discovery` charts must be deployed with this profile.
-istiodRemote:
-  enabled: true
-configMap: false
-telemetry:
-  enabled: false
-global:
-  # TODO BML maybe a different profile for a configcluster/revisit this
-  omitSidecarInjectorConfigMap: true
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-stable.yaml b/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-stable.yaml
deleted file mode 100644
index 358282e69..000000000
--- a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-stable.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
-# The original version of this file is located at /manifests/helm-profiles directory.
-# If you want to make a change in this file, edit the original one and run "make gen".
-
-# The stable profile deploys admission control to ensure that only stable resources and fields are used
-# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
-experimental:
-  stableValidationPolicy: true
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/templates/NOTES.txt b/resources/v1.28-alpha.724e2360/charts/ztunnel/templates/NOTES.txt
deleted file mode 100644
index 244f59db0..000000000
--- a/resources/v1.28-alpha.724e2360/charts/ztunnel/templates/NOTES.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-ztunnel successfully installed!
-
-To learn more about the release, try:
-  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
-  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/templates/rbac.yaml b/resources/v1.28-alpha.724e2360/charts/ztunnel/templates/rbac.yaml
deleted file mode 100644
index 0a8138c9a..000000000
--- a/resources/v1.28-alpha.724e2360/charts/ztunnel/templates/rbac.yaml
+++ /dev/null
@@ -1,72 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-  {{- with .Values.imagePullSecrets }}
-imagePullSecrets:
-  {{- range . }}
-  - name: {{ . }}
-  {{- end }}
-  {{- end }}
-metadata:
-  name: {{ include "ztunnel.release-name" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
----
-{{- if (eq (.Values.platform | default "") "openshift") }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "ztunnel.release-name" . }}
-  labels:
-    app: ztunnel
-    release: {{ include "ztunnel.release-name" . }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-rules:
-- apiGroups: ["security.openshift.io"]
-  resources: ["securitycontextconstraints"]
-  resourceNames: ["privileged"]
-  verbs: ["use"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "ztunnel.release-name" . }}
-  labels:
-    app: ztunnel
-    release: {{ include "ztunnel.release-name" . }}
-    app.kubernetes.io/name: ztunnel
-    {{- include "istio.labels" . | nindent 4}}
-  annotations:
-{{- if .Values.revision }}
-    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
-    {{- toYaml $annos | nindent 4}}
-{{- else }}
-    {{- .Values.annotations | toYaml | nindent 4 }}
-{{- end }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "ztunnel.release-name" . }}
-subjects:
-- kind: ServiceAccount
-  name: {{ include "ztunnel.release-name" . }}
-  namespace: {{ .Release.Namespace }}
-{{- end }}
----
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/values.yaml b/resources/v1.28-alpha.724e2360/charts/ztunnel/values.yaml
deleted file mode 100644
index f3bea04f9..000000000
--- a/resources/v1.28-alpha.724e2360/charts/ztunnel/values.yaml
+++ /dev/null
@@ -1,128 +0,0 @@
-# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
-# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
-_internal_defaults_do_not_set:
-  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
-  hub: gcr.io/istio-testing
-  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
-  tag: 1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b
-  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
-  variant: ""
-
-  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
-  # If Image contains a "/", it will replace the entire `image` in the pod.
-  image: ztunnel
-
-  # Same as `global.network`, but will override it if set.
-  # Network defines the network this cluster belong to. This name
-  # corresponds to the networks in the map of mesh networks.
-  network: ""
-
-  # resourceName, if set, will override the naming of resources. If not set, will default to 'ztunnel'.
-  # If you set this, you MUST also set `trustedZtunnelName` in the `istiod` chart.
-  resourceName: ""
-
-  # Labels to apply to all top level resources
-  labels: {}
-  # Annotations to apply to all top level resources
-  annotations: {}
-
-  # Additional volumeMounts to the ztunnel container
-  volumeMounts: []
-
-  # Additional volumes to the ztunnel pod
-  volumes: []
-  
-  # Tolerations for the ztunnel pod
-  tolerations:
-    - effect: NoSchedule
-      operator: Exists
-    - key: CriticalAddonsOnly
-      operator: Exists
-    - effect: NoExecute
-      operator: Exists
-
-  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
-  podAnnotations:
-    prometheus.io/port: "15020"
-    prometheus.io/scrape: "true"
-
-  # Additional labels to apply on the pod level
-  podLabels: {}
-
-  # Pod resource configuration
-  resources:
-    requests:
-      cpu: 200m
-      # Ztunnel memory scales with the size of the cluster and traffic load
-      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
-      memory: 512Mi
-
-  resourceQuotas:
-    enabled: false
-    pods: 5000
-
-  # List of secret names to add to the service account as image pull secrets
-  imagePullSecrets: []
-
-  # A `key: value` mapping of environment variables to add to the pod
-  env: {}
-
-  # Override for the pod imagePullPolicy
-  imagePullPolicy: ""
-
-  # Settings for multicluster
-  multiCluster:
-    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
-    # with Istiod configuration.
-    clusterName: ""
-
-  # meshConfig defines runtime configuration of components.
-  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
-  # components.
-  # TODO: https://github.com/istio/istio/issues/43248
-  meshConfig:
-    defaultConfig:
-      proxyMetadata: {}
-
-  # This value defines:
-  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
-  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
-  # Default K8S value is 30 seconds
-  terminationGracePeriodSeconds: 30
-
-  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
-  revision: ""
-
-  # The customized CA address to retrieve certificates for the pods in the cluster.
-  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
-  caAddress: ""
-
-  # The customized XDS address to retrieve configuration.
-  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
-  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
-  xdsAddress: ""
-
-  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
-  istioNamespace: istio-system
-
-  # Configuration log level of ztunnel binary, default is info.
-  # Valid values are: trace, debug, info, warn, error
-  logLevel: info
-
-  # To output all logs in json format
-  logAsJson: false
-
-  # Set to `type: RuntimeDefault` to use the default profile if available.
-  seLinuxOptions: {}
-  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
-  #seLinuxOptions:
-  #  type: spc_t
-
-  # K8s DaemonSet update strategy.
-  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
-  updateStrategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
diff --git a/resources/v1.28-alpha.724e2360/cni-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz.etag b/resources/v1.28-alpha.724e2360/cni-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz.etag
deleted file mode 100644
index 2b8a07eee..000000000
--- a/resources/v1.28-alpha.724e2360/cni-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-e0e79fed313afc77128f98f6f89dd6f1
diff --git a/resources/v1.28-alpha.724e2360/commit b/resources/v1.28-alpha.724e2360/commit
deleted file mode 100644
index 5523d1a99..000000000
--- a/resources/v1.28-alpha.724e2360/commit
+++ /dev/null
@@ -1 +0,0 @@
-724e23601921b13efdc8ee85566eab9b7f3c441b
diff --git a/resources/v1.28-alpha.724e2360/gateway-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz.etag b/resources/v1.28-alpha.724e2360/gateway-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz.etag
deleted file mode 100644
index dee609488..000000000
--- a/resources/v1.28-alpha.724e2360/gateway-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-10118340cf3f2e6557a70bcd134cb64e
diff --git a/resources/v1.28-alpha.724e2360/istiod-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz.etag b/resources/v1.28-alpha.724e2360/istiod-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz.etag
deleted file mode 100644
index f2d8d4daf..000000000
--- a/resources/v1.28-alpha.724e2360/istiod-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-842160fa3956ad7c16eb8288c2cfb0aa
diff --git a/resources/v1.28-alpha.724e2360/profiles/ambient.yaml b/resources/v1.28-alpha.724e2360/profiles/ambient.yaml
deleted file mode 100644
index 71ea784a8..000000000
--- a/resources/v1.28-alpha.724e2360/profiles/ambient.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: ambient
diff --git a/resources/v1.28-alpha.724e2360/profiles/demo.yaml b/resources/v1.28-alpha.724e2360/profiles/demo.yaml
deleted file mode 100644
index 53c4b4163..000000000
--- a/resources/v1.28-alpha.724e2360/profiles/demo.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: demo
diff --git a/resources/v1.28-alpha.724e2360/profiles/empty.yaml b/resources/v1.28-alpha.724e2360/profiles/empty.yaml
deleted file mode 100644
index 4477cb1fe..000000000
--- a/resources/v1.28-alpha.724e2360/profiles/empty.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-# The empty profile has everything disabled
-# This is useful as a base for custom user configuration
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec: {}
diff --git a/resources/v1.28-alpha.724e2360/profiles/openshift-ambient.yaml b/resources/v1.28-alpha.724e2360/profiles/openshift-ambient.yaml
deleted file mode 100644
index 76edf00cd..000000000
--- a/resources/v1.28-alpha.724e2360/profiles/openshift-ambient.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: ambient
-    global:
-      platform: openshift
diff --git a/resources/v1.28-alpha.724e2360/profiles/openshift.yaml b/resources/v1.28-alpha.724e2360/profiles/openshift.yaml
deleted file mode 100644
index 41492660f..000000000
--- a/resources/v1.28-alpha.724e2360/profiles/openshift.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    global:
-      platform: openshift
diff --git a/resources/v1.28-alpha.724e2360/profiles/preview.yaml b/resources/v1.28-alpha.724e2360/profiles/preview.yaml
deleted file mode 100644
index 59d545c84..000000000
--- a/resources/v1.28-alpha.724e2360/profiles/preview.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# The preview profile contains features that are experimental.
-# This is intended to explore new features coming to Istio.
-# Stability, security, and performance are not guaranteed - use at your own risk.
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: preview
diff --git a/resources/v1.28-alpha.724e2360/profiles/remote.yaml b/resources/v1.28-alpha.724e2360/profiles/remote.yaml
deleted file mode 100644
index 54c65c8ba..000000000
--- a/resources/v1.28-alpha.724e2360/profiles/remote.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# The remote profile is used to configure a mesh cluster without a locally deployed control plane.
-# Only the injector mutating webhook configuration is installed.
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: remote
diff --git a/resources/v1.28-alpha.724e2360/profiles/stable.yaml b/resources/v1.28-alpha.724e2360/profiles/stable.yaml
deleted file mode 100644
index 285feba24..000000000
--- a/resources/v1.28-alpha.724e2360/profiles/stable.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: sailoperator.io/v1
-kind: Istio
-spec:
-  values:
-    profile: stable
diff --git a/resources/v1.28-alpha.724e2360/ztunnel-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz.etag b/resources/v1.28-alpha.724e2360/ztunnel-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz.etag
deleted file mode 100644
index 8d7a60d13..000000000
--- a/resources/v1.28-alpha.724e2360/ztunnel-1.28-alpha.724e23601921b13efdc8ee85566eab9b7f3c441b.tgz.etag
+++ /dev/null
@@ -1 +0,0 @@
-4a9cebe93a271ec432471b52db7fbcbc
diff --git a/resources/v1.28.0/base-1.28.0.tgz.etag b/resources/v1.28.0/base-1.28.0.tgz.etag
new file mode 100644
index 000000000..95a40faeb
--- /dev/null
+++ b/resources/v1.28.0/base-1.28.0.tgz.etag
@@ -0,0 +1 @@
+7bc3f40a477bc457daf1899a1adc295b
diff --git a/resources/v1.28.0/charts/base/Chart.yaml b/resources/v1.28.0/charts/base/Chart.yaml
new file mode 100644
index 000000000..3a585967f
--- /dev/null
+++ b/resources/v1.28.0/charts/base/Chart.yaml
@@ -0,0 +1,10 @@
+apiVersion: v2
+appVersion: 1.28.0
+description: Helm chart for deploying Istio cluster resources and CRDs
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+name: base
+sources:
+- https://github.com/istio/istio
+version: 1.28.0
diff --git a/resources/v1.24.5/charts/base/README.md b/resources/v1.28.0/charts/base/README.md
similarity index 100%
rename from resources/v1.24.5/charts/base/README.md
rename to resources/v1.28.0/charts/base/README.md
diff --git a/resources/v1.28.0/charts/base/files/profile-ambient.yaml b/resources/v1.28.0/charts/base/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.28.0/charts/base/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.28-alpha.724e2360/charts/base/files/profile-compatibility-version-1.25.yaml b/resources/v1.28.0/charts/base/files/profile-compatibility-version-1.25.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/base/files/profile-compatibility-version-1.25.yaml
rename to resources/v1.28.0/charts/base/files/profile-compatibility-version-1.25.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/base/files/profile-compatibility-version-1.26.yaml b/resources/v1.28.0/charts/base/files/profile-compatibility-version-1.26.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/base/files/profile-compatibility-version-1.26.yaml
rename to resources/v1.28.0/charts/base/files/profile-compatibility-version-1.26.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/base/files/profile-compatibility-version-1.27.yaml b/resources/v1.28.0/charts/base/files/profile-compatibility-version-1.27.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/base/files/profile-compatibility-version-1.27.yaml
rename to resources/v1.28.0/charts/base/files/profile-compatibility-version-1.27.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/base/files/profile-demo.yaml b/resources/v1.28.0/charts/base/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/base/files/profile-demo.yaml
rename to resources/v1.28.0/charts/base/files/profile-demo.yaml
diff --git a/resources/v1.28.0/charts/base/files/profile-platform-gke.yaml b/resources/v1.28.0/charts/base/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.28.0/charts/base/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.5/charts/base/files/profile-platform-k3d.yaml b/resources/v1.28.0/charts/base/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.5/charts/base/files/profile-platform-k3d.yaml
rename to resources/v1.28.0/charts/base/files/profile-platform-k3d.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-k3s.yaml b/resources/v1.28.0/charts/base/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/base/files/profile-platform-k3s.yaml
rename to resources/v1.28.0/charts/base/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.5/charts/base/files/profile-platform-microk8s.yaml b/resources/v1.28.0/charts/base/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.5/charts/base/files/profile-platform-microk8s.yaml
rename to resources/v1.28.0/charts/base/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.5/charts/base/files/profile-platform-minikube.yaml b/resources/v1.28.0/charts/base/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.5/charts/base/files/profile-platform-minikube.yaml
rename to resources/v1.28.0/charts/base/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.5/charts/base/files/profile-platform-openshift.yaml b/resources/v1.28.0/charts/base/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.5/charts/base/files/profile-platform-openshift.yaml
rename to resources/v1.28.0/charts/base/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.5/charts/base/files/profile-preview.yaml b/resources/v1.28.0/charts/base/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.5/charts/base/files/profile-preview.yaml
rename to resources/v1.28.0/charts/base/files/profile-preview.yaml
diff --git a/resources/v1.24.5/charts/base/files/profile-remote.yaml b/resources/v1.28.0/charts/base/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.5/charts/base/files/profile-remote.yaml
rename to resources/v1.28.0/charts/base/files/profile-remote.yaml
diff --git a/resources/v1.24.5/charts/base/files/profile-stable.yaml b/resources/v1.28.0/charts/base/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.5/charts/base/files/profile-stable.yaml
rename to resources/v1.28.0/charts/base/files/profile-stable.yaml
diff --git a/resources/v1.24.5/charts/base/templates/NOTES.txt b/resources/v1.28.0/charts/base/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.5/charts/base/templates/NOTES.txt
rename to resources/v1.28.0/charts/base/templates/NOTES.txt
diff --git a/resources/v1.28.0/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml b/resources/v1.28.0/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
new file mode 100644
index 000000000..30049df98
--- /dev/null
+++ b/resources/v1.28.0/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
@@ -0,0 +1,55 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+{{- if and .Values.experimental.stableValidationPolicy (not (eq .Values.defaultRevision "")) }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: "stable-channel-default-policy.istio.io"
+  labels:
+    release: {{ .Release.Name }}
+    istio: istiod
+    istio.io/rev: {{ .Values.defaultRevision }}
+    app.kubernetes.io/name: "istiod"
+    {{ include "istio.labels" . | nindent 4 }}
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+        - security.istio.io
+        - networking.istio.io
+        - telemetry.istio.io
+        - extensions.istio.io
+      apiVersions: ["*"]
+      operations:  ["CREATE", "UPDATE"]
+      resources:   ["*"]
+  variables:
+    - name: isEnvoyFilter
+      expression: "object.kind == 'EnvoyFilter'"
+    - name: isWasmPlugin
+      expression: "object.kind == 'WasmPlugin'"
+    - name: isProxyConfig
+      expression: "object.kind == 'ProxyConfig'"
+    - name: isTelemetry
+      expression: "object.kind == 'Telemetry'"
+  validations:
+    - expression: "!variables.isEnvoyFilter"
+    - expression: "!variables.isWasmPlugin"
+    - expression: "!variables.isProxyConfig"
+    - expression: |
+        !(
+          variables.isTelemetry && (
+            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
+            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
+            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
+          )
+        )
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: "stable-channel-default-policy-binding.istio.io"
+spec:
+  policyName: "stable-channel-default-policy.istio.io"
+  validationActions: [Deny]
+{{- end }}
+{{- end }}
diff --git a/resources/v1.28.0/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml b/resources/v1.28.0/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
new file mode 100644
index 000000000..dcd16e964
--- /dev/null
+++ b/resources/v1.28.0/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
@@ -0,0 +1,58 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+{{- if not (eq .Values.defaultRevision "") }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: istiod-default-validator
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    istio: istiod
+    istio.io/rev: {{ .Values.defaultRevision | quote }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+webhooks:
+  - name: validation.istio.io
+    clientConfig:
+      {{- if .Values.base.validationURL }}
+      url: {{ .Values.base.validationURL }}
+      {{- else }}
+      service:
+        {{- if (eq .Values.defaultRevision "default") }}
+        name: istiod
+        {{- else }}
+        name: istiod-{{ .Values.defaultRevision }}
+        {{- end }}
+        namespace: {{ .Values.global.istioNamespace }}
+        path: "/validate"
+      {{- end }}
+      {{- if .Values.base.validationCABundle }}
+      caBundle: "{{ .Values.base.validationCABundle }}"
+      {{- end }}
+    rules:
+      - operations:
+          - CREATE
+          - UPDATE
+        apiGroups:
+          - security.istio.io
+          - networking.istio.io
+          - telemetry.istio.io
+          - extensions.istio.io
+        apiVersions:
+          - "*"
+        resources:
+          - "*"
+
+    {{- if .Values.base.validationCABundle }}
+    # Disable webhook controller in Pilot to stop patching it
+    failurePolicy: Fail
+    {{- else }}
+    # Fail open until the validation webhook is ready. The webhook controller
+    # will update this to `Fail` and patch in the `caBundle` when the webhook
+    # endpoint is ready.
+    failurePolicy: Ignore
+    {{- end }}
+    sideEffects: None
+    admissionReviewVersions: ["v1"]
+{{- end }}
+{{- end }}
diff --git a/resources/v1.28.0/charts/base/templates/reader-serviceaccount.yaml b/resources/v1.28.0/charts/base/templates/reader-serviceaccount.yaml
new file mode 100644
index 000000000..bb7a74ff4
--- /dev/null
+++ b/resources/v1.28.0/charts/base/templates/reader-serviceaccount.yaml
@@ -0,0 +1,22 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# This singleton service account aggregates reader permissions for the revisions in a given cluster
+# ATM this is a singleton per cluster with Istio installed, and is not revisioned. It maybe should be,
+# as otherwise compromising the token for this SA would give you access to *every* installed revision.
+# Should be used for remote secret creation.
+apiVersion: v1
+kind: ServiceAccount
+  {{- if .Values.global.imagePullSecrets }}
+imagePullSecrets:
+  {{- range .Values.global.imagePullSecrets }}
+  - name: {{ . }}
+    {{- end }}
+    {{- end }}
+metadata:
+  name: istio-reader-service-account
+  namespace: {{ .Values.global.istioNamespace }}
+  labels:
+    app: istio-reader
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istio-reader"
+    {{- include "istio.labels" . | nindent 4 }}
+{{- end }}
diff --git a/resources/v1.28.0/charts/base/templates/zzz_profile.yaml b/resources/v1.28.0/charts/base/templates/zzz_profile.yaml
new file mode 100644
index 000000000..3d8495648
--- /dev/null
+++ b/resources/v1.28.0/charts/base/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if false }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.28.0/charts/base/values.yaml b/resources/v1.28.0/charts/base/values.yaml
new file mode 100644
index 000000000..8353c57d6
--- /dev/null
+++ b/resources/v1.28.0/charts/base/values.yaml
@@ -0,0 +1,45 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  global:
+
+    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+
+    # Used to locate istiod.
+    istioNamespace: istio-system
+
+    # resourceScope controls what resources will be processed by helm.
+    # This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
+    # It can be one of:
+    # - all: all resources are processed
+    # - cluster: only cluster-scoped resources are processed
+    # - namespace: only namespace-scoped resources are processed
+    resourceScope: all
+  base:
+    # A list of CRDs to exclude. Requires `enableCRDTemplates` to be true.
+    # Example: `excludedCRDs: ["envoyfilters.networking.istio.io"]`.
+    # Note: when installing with `istioctl`, `enableIstioConfigCRDs=false` must also be set.
+    excludedCRDs: []
+    # Helm (as of V3) does not support upgrading CRDs, because it is not universally
+    # safe for them to support this.
+    # Istio as a project enforces certain backwards-compat guarantees that allow us
+    # to safely upgrade CRDs in spite of this, so we default to self-managing CRDs
+    # as standard K8S resources in Helm, and disable Helm's CRD management. See also:
+    # https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#method-2-separate-charts
+    enableCRDTemplates: true
+
+    # Validation webhook configuration url
+    # For example: https://$remotePilotAddress:15017/validate
+    validationURL: ""
+    # Validation webhook caBundle value. Useful when running pilot with a well known cert
+    validationCABundle: ""
+
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  defaultRevision: "default"
+  experimental:
+    stableValidationPolicy: false
diff --git a/resources/v1.28.0/charts/cni/Chart.yaml b/resources/v1.28.0/charts/cni/Chart.yaml
new file mode 100644
index 000000000..ec567edeb
--- /dev/null
+++ b/resources/v1.28.0/charts/cni/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+appVersion: 1.28.0
+description: Helm chart for istio-cni components
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio-cni
+- istio
+name: cni
+sources:
+- https://github.com/istio/istio
+version: 1.28.0
diff --git a/resources/v1.28.0/charts/cni/README.md b/resources/v1.28.0/charts/cni/README.md
new file mode 100644
index 000000000..f7e5cbd37
--- /dev/null
+++ b/resources/v1.28.0/charts/cni/README.md
@@ -0,0 +1,65 @@
+# Istio CNI Helm Chart
+
+This chart installs the Istio CNI Plugin. See the [CNI installation guide](https://istio.io/latest/docs/setup/additional-setup/cni/)
+for more information.
+
+## Setup Repo Info
+
+```console
+helm repo add istio https://istio-release.storage.googleapis.com/charts
+helm repo update
+```
+
+_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
+
+## Installing the Chart
+
+To install the chart with the release name `istio-cni`:
+
+```console
+helm install istio-cni istio/cni -n kube-system
+```
+
+Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
+`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
+'system-node-critical' outside of kube-system.
+
+## Configuration
+
+To view supported configuration options and documentation, run:
+
+```console
+helm show values istio/istio-cni
+```
+
+### Profiles
+
+Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
+These can be set with `--set profile=<profile>`.
+For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
+
+For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
+
+Explicitly set values have highest priority, then profile settings, then chart defaults.
+
+As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
+When configuring the chart, you should not include this.
+That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
+
+### Ambient
+
+To enable ambient, you can use the ambient profile: `--set profile=ambient`.
+
+#### Calico
+
+For Calico, you must also modify the settings to allow source spoofing:
+
+- if deployed by operator,  `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`
+- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )
+
+### GKE notes
+
+On GKE, 'kube-system' is required.
+
+If using `helm template`, `--set cni.cniBinDir=/home/kubernetes/bin` is required - with `helm install`
+it is auto-detected.
diff --git a/resources/v1.28.0/charts/cni/files/profile-ambient.yaml b/resources/v1.28.0/charts/cni/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.28.0/charts/cni/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-compatibility-version-1.25.yaml b/resources/v1.28.0/charts/cni/files/profile-compatibility-version-1.25.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/cni/files/profile-compatibility-version-1.25.yaml
rename to resources/v1.28.0/charts/cni/files/profile-compatibility-version-1.25.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-compatibility-version-1.26.yaml b/resources/v1.28.0/charts/cni/files/profile-compatibility-version-1.26.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/cni/files/profile-compatibility-version-1.26.yaml
rename to resources/v1.28.0/charts/cni/files/profile-compatibility-version-1.26.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-compatibility-version-1.27.yaml b/resources/v1.28.0/charts/cni/files/profile-compatibility-version-1.27.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/cni/files/profile-compatibility-version-1.27.yaml
rename to resources/v1.28.0/charts/cni/files/profile-compatibility-version-1.27.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-demo.yaml b/resources/v1.28.0/charts/cni/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/cni/files/profile-demo.yaml
rename to resources/v1.28.0/charts/cni/files/profile-demo.yaml
diff --git a/resources/v1.28.0/charts/cni/files/profile-platform-gke.yaml b/resources/v1.28.0/charts/cni/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.28.0/charts/cni/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.5/charts/cni/files/profile-platform-k3d.yaml b/resources/v1.28.0/charts/cni/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.5/charts/cni/files/profile-platform-k3d.yaml
rename to resources/v1.28.0/charts/cni/files/profile-platform-k3d.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-k3s.yaml b/resources/v1.28.0/charts/cni/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/cni/files/profile-platform-k3s.yaml
rename to resources/v1.28.0/charts/cni/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.5/charts/cni/files/profile-platform-microk8s.yaml b/resources/v1.28.0/charts/cni/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.5/charts/cni/files/profile-platform-microk8s.yaml
rename to resources/v1.28.0/charts/cni/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.5/charts/cni/files/profile-platform-minikube.yaml b/resources/v1.28.0/charts/cni/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.5/charts/cni/files/profile-platform-minikube.yaml
rename to resources/v1.28.0/charts/cni/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.5/charts/cni/files/profile-platform-openshift.yaml b/resources/v1.28.0/charts/cni/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.5/charts/cni/files/profile-platform-openshift.yaml
rename to resources/v1.28.0/charts/cni/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.5/charts/cni/files/profile-preview.yaml b/resources/v1.28.0/charts/cni/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.5/charts/cni/files/profile-preview.yaml
rename to resources/v1.28.0/charts/cni/files/profile-preview.yaml
diff --git a/resources/v1.24.5/charts/cni/files/profile-remote.yaml b/resources/v1.28.0/charts/cni/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.5/charts/cni/files/profile-remote.yaml
rename to resources/v1.28.0/charts/cni/files/profile-remote.yaml
diff --git a/resources/v1.24.5/charts/cni/files/profile-stable.yaml b/resources/v1.28.0/charts/cni/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.5/charts/cni/files/profile-stable.yaml
rename to resources/v1.28.0/charts/cni/files/profile-stable.yaml
diff --git a/resources/v1.24.5/charts/cni/templates/NOTES.txt b/resources/v1.28.0/charts/cni/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.5/charts/cni/templates/NOTES.txt
rename to resources/v1.28.0/charts/cni/templates/NOTES.txt
diff --git a/resources/v1.24.5/charts/cni/templates/_helpers.tpl b/resources/v1.28.0/charts/cni/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.5/charts/cni/templates/_helpers.tpl
rename to resources/v1.28.0/charts/cni/templates/_helpers.tpl
diff --git a/resources/v1.28.0/charts/cni/templates/clusterrole.yaml b/resources/v1.28.0/charts/cni/templates/clusterrole.yaml
new file mode 100644
index 000000000..51af4ce7f
--- /dev/null
+++ b/resources/v1.28.0/charts/cni/templates/clusterrole.yaml
@@ -0,0 +1,84 @@
+# Created if cluster resources are not omitted
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "name" . }}
+  labels:
+    app: {{ template "name" . }}
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+- apiGroups: ["security.openshift.io"] 
+  resources: ["securitycontextconstraints"] 
+  resourceNames: ["privileged"] 
+  verbs: ["use"]
+- apiGroups: [""]
+  resources: ["pods","nodes","namespaces"]
+  verbs: ["get", "list", "watch"]
+{{- if (eq ((coalesce .Values.platform .Values.global.platform) | default "") "openshift") }}
+- apiGroups: ["security.openshift.io"]
+  resources: ["securitycontextconstraints"]
+  resourceNames: ["privileged"]
+  verbs: ["use"]
+{{- end }}
+---
+{{- if .Values.repair.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "name" . }}-repair-role
+  labels:
+    app: {{ template "name" . }}
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create", "patch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["watch", "get", "list"]
+{{- if .Values.repair.repairPods }}
+{{- /*  No privileges needed*/}}
+{{- else if .Values.repair.deletePods }}
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["delete"]
+{{- else if .Values.repair.labelPods }}
+  - apiGroups: [""]
+    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
+    resources: ["pods/status"]
+    verbs: ["patch", "update"]
+{{- end }}
+{{- end }}
+---
+{{- if .Values.ambient.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "name" . }}-ambient
+  labels:
+    app: {{ template "name" . }}
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+- apiGroups: [""]
+  {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
+  resources: ["pods/status"]
+  verbs: ["patch", "update"]
+- apiGroups: ["apps"]
+  resources: ["daemonsets"]
+  resourceNames: ["{{ template "name" . }}-node"]
+  verbs: ["get"]
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/cni/templates/clusterrolebinding.yaml b/resources/v1.28.0/charts/cni/templates/clusterrolebinding.yaml
new file mode 100644
index 000000000..60e3c28be
--- /dev/null
+++ b/resources/v1.28.0/charts/cni/templates/clusterrolebinding.yaml
@@ -0,0 +1,66 @@
+# Created if cluster resources are not omitted
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "name" . }}
+  labels:
+    app: {{ template "name" . }}
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "name" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "name" . }}
+  namespace: {{ .Release.Namespace }}
+---
+{{- if .Values.repair.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "name" . }}-repair-rolebinding
+  labels:
+    k8s-app: {{ template "name" . }}-repair
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "name" . }}
+  namespace: {{ .Release.Namespace}}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "name" . }}-repair-role
+{{- end }}
+---
+{{- if .Values.ambient.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "name" . }}-ambient
+  labels:
+    k8s-app: {{ template "name" . }}-repair
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "name" . }}
+    namespace: {{ .Release.Namespace}}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "name" . }}-ambient
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/cni/templates/configmap-cni.yaml b/resources/v1.28.0/charts/cni/templates/configmap-cni.yaml
new file mode 100644
index 000000000..98bc60ac0
--- /dev/null
+++ b/resources/v1.28.0/charts/cni/templates/configmap-cni.yaml
@@ -0,0 +1,43 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: {{ template "name" . }}-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "name" . }}
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+  CURRENT_AGENT_VERSION: {{ .Values.tag | default .Values.global.tag | quote }}
+  AMBIENT_ENABLED: {{ .Values.ambient.enabled | quote }}
+  AMBIENT_ENABLEMENT_SELECTOR: {{ .Values.ambient.enablementSelectors | toYaml | quote }}
+  AMBIENT_DNS_CAPTURE: {{ .Values.ambient.dnsCapture | quote  }}
+  AMBIENT_IPV6: {{ .Values.ambient.ipv6 | quote }}
+  AMBIENT_RECONCILE_POD_RULES_ON_STARTUP: {{ .Values.ambient.reconcileIptablesOnStartup | quote }}
+  {{- if .Values.cniConfFileName }} # K8S < 1.24 doesn't like empty values
+  CNI_CONF_NAME: {{ .Values.cniConfFileName }} # Name of the CNI config file to create. Only override if you know the exact path your CNI requires..
+  {{- end }}
+  ISTIO_OWNED_CNI_CONFIG: {{ .Values.istioOwnedCNIConfig | quote }}
+  {{- if .Values.istioOwnedCNIConfig }}
+  ISTIO_OWNED_CNI_CONF_FILENAME: {{ .Values.istioOwnedCNIConfigFileName | quote }}
+  {{- end }}
+  CHAINED_CNI_PLUGIN: {{ .Values.chained | quote }}
+  EXCLUDE_NAMESPACES: "{{ range $idx, $ns := .Values.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
+  REPAIR_ENABLED: {{ .Values.repair.enabled | quote }}
+  REPAIR_LABEL_PODS: {{ .Values.repair.labelPods | quote }}
+  REPAIR_DELETE_PODS: {{ .Values.repair.deletePods | quote }}
+  REPAIR_REPAIR_PODS: {{ .Values.repair.repairPods | quote }}
+  REPAIR_INIT_CONTAINER_NAME: {{ .Values.repair.initContainerName | quote }}
+  REPAIR_BROKEN_POD_LABEL_KEY: {{ .Values.repair.brokenPodLabelKey | quote }}
+  REPAIR_BROKEN_POD_LABEL_VALUE: {{ .Values.repair.brokenPodLabelValue | quote }}
+  NATIVE_NFTABLES: {{ .Values.global.nativeNftables | quote }}
+  {{- with .Values.env }}
+  {{- range $key, $val := . }}
+  {{ $key }}: "{{ $val }}"
+  {{- end }}
+  {{- end }}
+{{- end }}
diff --git a/resources/v1.28.0/charts/cni/templates/daemonset.yaml b/resources/v1.28.0/charts/cni/templates/daemonset.yaml
new file mode 100644
index 000000000..6d1dda290
--- /dev/null
+++ b/resources/v1.28.0/charts/cni/templates/daemonset.yaml
@@ -0,0 +1,252 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# This manifest installs the Istio install-cni container, as well
+# as the Istio CNI plugin and config on
+# each master and worker node in a Kubernetes cluster.
+#
+# $detectedBinDir exists to support a GKE-specific platform override,
+# and is deprecated in favor of using the explicit `gke` platform profile.
+{{- $detectedBinDir := (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
+    "/home/kubernetes/bin"
+    "/opt/cni/bin"
+}}
+{{- if .Values.cniBinDir }}
+{{ $detectedBinDir = .Values.cniBinDir }}
+{{- end }}
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  # Note that this is templated but evaluates to a fixed name
+  # which the CNI plugin may fall back onto in some failsafe scenarios.
+  # if this name is changed, CNI plugin logic that checks for this name
+  # format should also be updated.
+  name: {{ template "name" . }}-node
+  namespace: {{ .Release.Namespace }}
+  labels:
+    k8s-app: {{ template "name" . }}-node
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+    {{ with .Values.daemonSetLabels -}}{{ toYaml . | nindent 4}}{{ end }}
+spec:
+  selector:
+    matchLabels:
+      k8s-app: {{ template "name" . }}-node
+  {{- with .Values.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  template:
+    metadata:
+      labels:
+        k8s-app: {{ template "name" . }}-node
+        sidecar.istio.io/inject: "false"
+        istio.io/dataplane-mode: none
+        app.kubernetes.io/name: {{ template "name" . }}
+        {{- include "istio.labels" . | nindent 8 }}
+        {{ with .Values.podLabels -}}{{ toYaml . | nindent 8}}{{ end }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+        # Add Prometheus Scrape annotations
+        prometheus.io/scrape: 'true'
+        prometheus.io/port: "15014"
+        prometheus.io/path: '/metrics'
+        # Add AppArmor annotation
+        # This is required to avoid conflicts with AppArmor profiles which block certain
+        # privileged pod capabilities.
+        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
+        # securityContext which is otherwise preferred.
+        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
+        # Custom annotations
+        {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+        {{- end }}
+    spec:
+{{- if and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace }}
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+{{- end }}
+      nodeSelector:
+        kubernetes.io/os: linux
+      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      priorityClassName: system-node-critical
+      serviceAccountName: {{ template "name" . }}
+      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
+      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
+      terminationGracePeriodSeconds: 5
+      containers:
+        # This container installs the Istio CNI binaries
+        # and CNI network config file on each node.
+        - name: install-cni
+{{- if contains "/" .Values.image }}
+          image: "{{ .Values.image }}"
+{{- else }}
+          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
+{{- end }}
+{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
+          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
+{{- end }}
+          ports:
+          - containerPort: 15014
+            name: metrics
+            protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8000
+          securityContext:
+            privileged: false
+            runAsGroup: 0
+            runAsUser: 0
+            runAsNonRoot: false
+            # Both ambient and sidecar repair mode require elevated node privileges to function.
+            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
+            # add capabilities based on feature.
+            capabilities:
+              drop:
+              - ALL
+              add:
+              # CAP_NET_ADMIN is required to allow ipset and route table access
+              - NET_ADMIN
+              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
+              - NET_RAW
+              # CAP_SYS_PTRACE is required for repair and ambient mode to describe
+              # the pod's network namespace.
+              - SYS_PTRACE
+              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
+              # network namespaces in `/proc` to obtain descriptors for entering pod network
+              # namespaces. There does not appear to be a more granular capability for this.
+              - SYS_ADMIN
+              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
+              # the typical ability to read/write to folders owned by others.
+              # This can cause problems if the hostPath mounts we use, which we require write access into,
+              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
+              - DAC_OVERRIDE
+{{- if .Values.seLinuxOptions }}
+{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
+            seLinuxOptions:
+{{ toYaml . | trim | indent 14 }}
+{{- end }}
+{{- end }}
+{{- if .Values.seccompProfile }}
+            seccompProfile:
+{{ toYaml .Values.seccompProfile | trim | indent 14 }}
+{{- end }}
+          command: ["install-cni"]
+          args:
+            {{- if or .Values.logging.level .Values.global.logging.level }}
+            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
+            {{- end}}
+            {{- if .Values.global.logAsJson }}
+            - --log_as_json
+            {{- end}}
+          envFrom:
+            - configMapRef:
+                name: {{ template "name" . }}-config
+          env:
+            - name: REPAIR_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: REPAIR_RUN_AS_DAEMON
+              value: "true"
+            - name: REPAIR_SIDECAR_ANNOTATION
+              value: "sidecar.istio.io/status"
+            {{- if not (and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace) }}
+            - name: ALLOW_SWITCH_TO_HOST_NS
+              value: "true"
+            {{- end }}
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+            - name: GOMEMLIMIT
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.memory
+                  divisor: '1'
+            - name: GOMAXPROCS
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.cpu
+                  divisor: '1'
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            {{- if .Values.env }}
+            {{- range $key, $val := .Values.env }}
+            - name: {{ $key }}
+              value: "{{ $val }}"
+            {{- end }}
+            {{- end }}
+          volumeMounts:
+            - mountPath: /host/opt/cni/bin
+              name: cni-bin-dir
+            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
+            - mountPath: /host/proc
+              name: cni-host-procfs
+              readOnly: true
+            {{- end }}
+            - mountPath: /host/etc/cni/net.d
+              name: cni-net-dir
+            - mountPath: /var/run/istio-cni
+              name: cni-socket-dir
+            {{- if .Values.ambient.enabled }}
+            - mountPath: /host/var/run/netns
+              mountPropagation: HostToContainer
+              name: cni-netns-dir
+            - mountPath: /var/run/ztunnel
+              name: cni-ztunnel-sock-dir
+            {{ end }}
+          resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 12 }}
+{{- else }}
+{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
+{{- end }}
+      volumes:
+        # Used to install CNI.
+        - name: cni-bin-dir
+          hostPath:
+            path: {{ $detectedBinDir }}
+        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
+        - name: cni-host-procfs
+          hostPath:
+            path: /proc
+            type: Directory
+        {{- end }}
+        {{- if .Values.ambient.enabled }}
+        - name: cni-ztunnel-sock-dir
+          hostPath:
+            path: /var/run/ztunnel
+            type: DirectoryOrCreate
+        {{- end }}
+        - name: cni-net-dir
+          hostPath:
+            path: {{ .Values.cniConfDir }}
+        # Used for UDS sockets for logging, ambient eventing
+        - name: cni-socket-dir
+          hostPath:
+            path: /var/run/istio-cni
+        - name: cni-netns-dir
+          hostPath:
+            path: {{ .Values.cniNetnsDir }}
+            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
+            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
+            # Once the CNI does mount this, it will get populated and we're good.
+{{- end }}
diff --git a/resources/v1.28.0/charts/cni/templates/network-attachment-definition.yaml b/resources/v1.28.0/charts/cni/templates/network-attachment-definition.yaml
new file mode 100644
index 000000000..37ef7c3e6
--- /dev/null
+++ b/resources/v1.28.0/charts/cni/templates/network-attachment-definition.yaml
@@ -0,0 +1,13 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+{{- if eq .Values.provider "multus" }}
+apiVersion: k8s.cni.cncf.io/v1
+kind: NetworkAttachmentDefinition
+metadata:
+  name: {{ template "name" . }}
+  namespace: default
+  labels:
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+{{- end }}
+{{- end }}
diff --git a/resources/v1.28.0/charts/cni/templates/resourcequota.yaml b/resources/v1.28.0/charts/cni/templates/resourcequota.yaml
new file mode 100644
index 000000000..2e0be5ab4
--- /dev/null
+++ b/resources/v1.28.0/charts/cni/templates/resourcequota.yaml
@@ -0,0 +1,21 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+{{- if .Values.resourceQuotas.enabled }}
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: {{ template "name" . }}-resource-quota
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  hard:
+    pods: {{ .Values.resourceQuotas.pods | quote }}
+  scopeSelector:
+    matchExpressions:
+    - operator: In
+      scopeName: PriorityClass
+      values:
+      - system-node-critical
+{{- end }}
+{{- end }}
diff --git a/resources/v1.28.0/charts/cni/templates/serviceaccount.yaml b/resources/v1.28.0/charts/cni/templates/serviceaccount.yaml
new file mode 100644
index 000000000..17c8e64a9
--- /dev/null
+++ b/resources/v1.28.0/charts/cni/templates/serviceaccount.yaml
@@ -0,0 +1,20 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+apiVersion: v1
+kind: ServiceAccount
+{{- if .Values.global.imagePullSecrets }}
+imagePullSecrets:
+{{- range .Values.global.imagePullSecrets }}
+  - name: {{ . }}
+{{- end }}
+{{- end }}
+metadata:
+  name: {{ template "name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "name" . }}
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+{{- end }}
diff --git a/resources/v1.24.5/charts/cni/templates/zzy_descope_legacy.yaml b/resources/v1.28.0/charts/cni/templates/zzy_descope_legacy.yaml
similarity index 100%
rename from resources/v1.24.5/charts/cni/templates/zzy_descope_legacy.yaml
rename to resources/v1.28.0/charts/cni/templates/zzy_descope_legacy.yaml
diff --git a/resources/v1.28.0/charts/cni/templates/zzz_profile.yaml b/resources/v1.28.0/charts/cni/templates/zzz_profile.yaml
new file mode 100644
index 000000000..3d8495648
--- /dev/null
+++ b/resources/v1.28.0/charts/cni/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if false }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.28.0/charts/cni/values.yaml b/resources/v1.28.0/charts/cni/values.yaml
new file mode 100644
index 000000000..b48ac06e7
--- /dev/null
+++ b/resources/v1.28.0/charts/cni/values.yaml
@@ -0,0 +1,192 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  hub: ""
+  tag: ""
+  variant: ""
+  image: install-cni
+  pullPolicy: ""
+
+  # Same as `global.logging.level`, but will override it if set
+  logging:
+    level: ""
+
+  # Configuration file to insert istio-cni plugin configuration
+  # by default this will be the first file found in the cni-conf-dir
+  # Example
+  # cniConfFileName: 10-calico.conflist
+
+  # CNI-and-platform specific path defaults.
+  # These may need to be set to platform-specific values, consult
+  # overrides for your platform in `manifests/helm-profiles/platform-*.yaml`
+  cniBinDir: /opt/cni/bin
+  cniConfDir: /etc/cni/net.d
+  cniConfFileName: ""
+  cniNetnsDir: "/var/run/netns"
+
+  # If Istio owned CNI config is enabled, defaults to 02-istio-cni.conflist
+  istioOwnedCNIConfigFileName: ""
+  istioOwnedCNIConfig: false
+
+  excludeNamespaces:
+    - kube-system
+
+  # Allows user to set custom affinity for the DaemonSet
+  affinity: {}
+
+  # Additional labels to apply on the daemonset level
+  daemonSetLabels: {}
+
+  # Custom annotations on pod level, if you need them
+  podAnnotations: {}
+
+  # Additional labels to apply on the pod level
+  podLabels: {}
+
+  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
+  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
+  chained: true
+
+  # Custom configuration happens based on the CNI provider.
+  # Possible values: "default", "multus"
+  provider: "default"
+
+  # Configure ambient settings
+  ambient:
+    # If enabled, ambient redirection will be enabled
+    enabled: false
+    # If ambient is enabled, this selector will be used to identify the ambient-enabled pods
+    enablementSelectors: 
+    - podSelector:
+        matchLabels: {istio.io/dataplane-mode: ambient}
+    - podSelector:
+        matchExpressions:
+        - { key: istio.io/dataplane-mode, operator: NotIn, values: [none] }
+      namespaceSelector:
+        matchLabels: {istio.io/dataplane-mode: ambient}
+    # Set ambient config dir path: defaults to /etc/ambient-config
+    configDir: ""
+    # If enabled, and ambient is enabled, DNS redirection will be enabled
+    dnsCapture: true
+    # If enabled, and ambient is enabled, enables ipv6 support
+    ipv6: true
+    # If enabled, and ambient is enabled, the CNI agent will reconcile incompatible iptables rules and chains at startup.
+    # This will eventually be enabled by default
+    reconcileIptablesOnStartup: false
+    # If enabled, and ambient is enabled, the CNI agent will always share the network namespace of the host node it is running on
+    shareHostNetworkNamespace: false
+
+
+  repair:
+    enabled: true
+    hub: ""
+    tag: ""
+
+    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
+    # This defines the action the controller will take when a pod is detected as broken.
+
+    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
+    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
+    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
+    labelPods: false
+    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
+    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
+    deletePods: false
+    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
+    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
+    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
+    repairPods: true
+
+    initContainerName: "istio-validation"
+
+    brokenPodLabelKey: "cni.istio.io/uninitialized"
+    brokenPodLabelValue: "true"
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
+  seLinuxOptions: {}
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 100Mi
+
+  resourceQuotas:
+    enabled: false
+    pods: 5000
+
+  tolerations:
+    # Make sure istio-cni-node gets scheduled on all nodes.
+    - effect: NoSchedule
+      operator: Exists
+    # Mark the pod as a critical add-on for rescheduling.
+    - key: CriticalAddonsOnly
+      operator: Exists
+    - effect: NoExecute
+      operator: Exists
+
+  # K8s DaemonSet update strategy.
+  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  global:
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+
+    # Default tag for Istio images.
+    tag: 1.28.0
+
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # change cni scope level to control logging out of istio-cni-node DaemonSet
+    logging:
+      level: info
+
+    logAsJson: false
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Default resources allocated
+    defaultResources:
+      requests:
+        cpu: 100m
+        memory: 100Mi
+
+    # In order to use native nftable rules instead of iptable rules, set this flag to true.
+    nativeNftables: false
+
+    # resourceScope controls what resources will be processed by helm.
+    # This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
+    # It can be one of:
+    # - all: all resources are processed
+    # - cluster: only cluster-scoped resources are processed
+    # - namespace: only namespace-scoped resources are processed
+    resourceScope: all
+
+  # A `key: value` mapping of environment variables to add to the pod
+  env: {}
diff --git a/resources/v1.28.0/charts/gateway/Chart.yaml b/resources/v1.28.0/charts/gateway/Chart.yaml
new file mode 100644
index 000000000..0819c9b8b
--- /dev/null
+++ b/resources/v1.28.0/charts/gateway/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+appVersion: 1.28.0
+description: Helm chart for deploying Istio gateways
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+- gateways
+name: gateway
+sources:
+- https://github.com/istio/istio
+type: application
+version: 1.28.0
diff --git a/resources/v1.28.0/charts/gateway/README.md b/resources/v1.28.0/charts/gateway/README.md
new file mode 100644
index 000000000..6344859a2
--- /dev/null
+++ b/resources/v1.28.0/charts/gateway/README.md
@@ -0,0 +1,170 @@
+# Istio Gateway Helm Chart
+
+This chart installs an Istio gateway deployment.
+
+## Setup Repo Info
+
+```console
+helm repo add istio https://istio-release.storage.googleapis.com/charts
+helm repo update
+```
+
+_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
+
+## Installing the Chart
+
+To install the chart with the release name `istio-ingressgateway`:
+
+```console
+helm install istio-ingressgateway istio/gateway
+```
+
+## Uninstalling the Chart
+
+To uninstall/delete the `istio-ingressgateway` deployment:
+
+```console
+helm delete istio-ingressgateway
+```
+
+## Configuration
+
+To view supported configuration options and documentation, run:
+
+```console
+helm show values istio/gateway
+```
+
+### Profiles
+
+Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
+These can be set with `--set profile=<profile>`.
+For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
+
+For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
+
+Explicitly set values have highest priority, then profile settings, then chart defaults.
+
+As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
+When configuring the chart, you should not include this.
+That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
+
+### OpenShift
+
+When deploying the gateway in an OpenShift cluster, use the `openshift` profile to override the default values, for example:
+
+```console
+helm install istio-ingressgateway istio/gateway --set profile=openshift
+```
+
+### `image: auto` Information
+
+The image used by the chart, `auto`, may be unintuitive.
+This exists because the pod spec will be automatically populated at runtime, using the same mechanism as [Sidecar Injection](istio.io/latest/docs/setup/additional-setup/sidecar-injection).
+This allows the same configurations and lifecycle to apply to gateways as sidecars.
+
+Note: this does mean that the namespace the gateway is deployed in must not have the `istio-injection=disabled` label.
+See [Controlling the injection policy](https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy) for more info.
+
+### Examples
+
+#### Egress Gateway
+
+Deploying a Gateway to be used as an [Egress Gateway](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/):
+
+```yaml
+service:
+  # Egress gateways do not need an external LoadBalancer IP
+  type: ClusterIP
+```
+
+#### Multi-network/VM Gateway
+
+Deploying a Gateway to be used as a [Multi-network Gateway](https://istio.io/latest/docs/setup/install/multicluster/) for network `network-1`:
+
+```yaml
+networkGateway: network-1
+```
+
+### Migrating from other installation methods
+
+Installations from other installation methods (such as istioctl, Istio Operator, other helm charts, etc) can be migrated to use the new Helm charts
+following the guidance below.
+If you are able to, a clean installation is simpler. However, this often requires an external IP migration which can be challenging.
+
+WARNING: when installing over an existing deployment, the two deployments will be merged together by Helm, which may lead to unexpected results.
+
+#### Legacy Gateway Helm charts
+
+Istio historically offered two different charts - `manifests/charts/gateways/istio-ingress` and `manifests/charts/gateways/istio-egress`.
+These are replaced by this chart.
+While not required, it is recommended all new users use this chart, and existing users migrate when possible.
+
+This chart has the following benefits and differences:
+* Designed with Helm best practices in mind (standardized values options, values schema, values are not all nested under `gateways.istio-ingressgateway.*`, release name and namespace taken into account, etc).
+* Utilizes Gateway injection, simplifying upgrades, allowing gateways to run in any namespace, and avoiding repeating config for sidecars and gateways.
+* Published to official Istio Helm repository.
+* Single chart for all gateways (Ingress, Egress, East West).
+
+#### General concerns
+
+For a smooth migration, the resource names and `Deployment.spec.selector` labels must match.
+
+If you install with `helm install istio-gateway istio/gateway`, resources will be named `istio-gateway` and the `selector` labels set to:
+
+```yaml
+app: istio-gateway
+istio: gateway # the release name with leading istio- prefix stripped
+```
+
+If your existing installation doesn't follow these names, you can override them. For example, if you have resources named `my-custom-gateway` with `selector` labels
+`foo=bar,istio=ingressgateway`:
+
+```yaml
+name: my-custom-gateway # Override the name to match existing resources
+labels:
+  app: "" # Unset default app selector label
+  istio: ingressgateway # override default istio selector label
+  foo: bar # Add the existing custom selector label
+```
+
+#### Migrating an existing Helm release
+
+An existing helm release can be `helm upgrade`d to this chart by using the same release name. For example, if a previous
+installation was done like:
+
+```console
+helm install istio-ingress manifests/charts/gateways/istio-ingress -n istio-system
+```
+
+It could be upgraded with
+
+```console
+helm upgrade istio-ingress manifests/charts/gateway -n istio-system --set name=istio-ingressgateway --set labels.app=istio-ingressgateway --set labels.istio=ingressgateway
+```
+
+Note the name and labels are overridden to match the names of the existing installation.
+
+Warning: the helm charts here default to using port 80 and 443, while the old charts used 8080 and 8443.
+If you have AuthorizationPolicies that reference port these ports, you should update them during this process,
+or customize the ports to match the old defaults.
+See the [security advisory](https://istio.io/latest/news/security/istio-security-2021-002/) for more information.
+
+#### Other migrations
+
+If you see errors like `rendered manifests contain a resource that already exists` during installation, you may need to forcibly take ownership.
+
+The script below can handle this for you. Replace `RELEASE` and `NAMESPACE` with the name and namespace of the release:
+
+```console
+KINDS=(service deployment)
+RELEASE=istio-ingressgateway
+NAMESPACE=istio-system
+for KIND in "${KINDS[@]}"; do
+    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-name=$RELEASE
+    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-namespace=$NAMESPACE
+    kubectl --namespace $NAMESPACE --overwrite=true label $KIND $RELEASE app.kubernetes.io/managed-by=Helm
+done
+```
+
+You may ignore errors about resources not being found.
diff --git a/resources/v1.28.0/charts/gateway/files/profile-ambient.yaml b/resources/v1.28.0/charts/gateway/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.28.0/charts/gateway/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-compatibility-version-1.25.yaml b/resources/v1.28.0/charts/gateway/files/profile-compatibility-version-1.25.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/gateway/files/profile-compatibility-version-1.25.yaml
rename to resources/v1.28.0/charts/gateway/files/profile-compatibility-version-1.25.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-compatibility-version-1.26.yaml b/resources/v1.28.0/charts/gateway/files/profile-compatibility-version-1.26.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/gateway/files/profile-compatibility-version-1.26.yaml
rename to resources/v1.28.0/charts/gateway/files/profile-compatibility-version-1.26.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-compatibility-version-1.27.yaml b/resources/v1.28.0/charts/gateway/files/profile-compatibility-version-1.27.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/gateway/files/profile-compatibility-version-1.27.yaml
rename to resources/v1.28.0/charts/gateway/files/profile-compatibility-version-1.27.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-demo.yaml b/resources/v1.28.0/charts/gateway/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/gateway/files/profile-demo.yaml
rename to resources/v1.28.0/charts/gateway/files/profile-demo.yaml
diff --git a/resources/v1.28.0/charts/gateway/files/profile-platform-gke.yaml b/resources/v1.28.0/charts/gateway/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.28.0/charts/gateway/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.5/charts/gateway/files/profile-platform-k3d.yaml b/resources/v1.28.0/charts/gateway/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.5/charts/gateway/files/profile-platform-k3d.yaml
rename to resources/v1.28.0/charts/gateway/files/profile-platform-k3d.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-k3s.yaml b/resources/v1.28.0/charts/gateway/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/gateway/files/profile-platform-k3s.yaml
rename to resources/v1.28.0/charts/gateway/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.5/charts/gateway/files/profile-platform-microk8s.yaml b/resources/v1.28.0/charts/gateway/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.5/charts/gateway/files/profile-platform-microk8s.yaml
rename to resources/v1.28.0/charts/gateway/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.5/charts/gateway/files/profile-platform-minikube.yaml b/resources/v1.28.0/charts/gateway/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.5/charts/gateway/files/profile-platform-minikube.yaml
rename to resources/v1.28.0/charts/gateway/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.5/charts/gateway/files/profile-platform-openshift.yaml b/resources/v1.28.0/charts/gateway/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.5/charts/gateway/files/profile-platform-openshift.yaml
rename to resources/v1.28.0/charts/gateway/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.5/charts/gateway/files/profile-preview.yaml b/resources/v1.28.0/charts/gateway/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.5/charts/gateway/files/profile-preview.yaml
rename to resources/v1.28.0/charts/gateway/files/profile-preview.yaml
diff --git a/resources/v1.24.5/charts/gateway/files/profile-remote.yaml b/resources/v1.28.0/charts/gateway/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.5/charts/gateway/files/profile-remote.yaml
rename to resources/v1.28.0/charts/gateway/files/profile-remote.yaml
diff --git a/resources/v1.24.5/charts/gateway/files/profile-stable.yaml b/resources/v1.28.0/charts/gateway/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.5/charts/gateway/files/profile-stable.yaml
rename to resources/v1.28.0/charts/gateway/files/profile-stable.yaml
diff --git a/resources/v1.24.5/charts/gateway/templates/NOTES.txt b/resources/v1.28.0/charts/gateway/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.5/charts/gateway/templates/NOTES.txt
rename to resources/v1.28.0/charts/gateway/templates/NOTES.txt
diff --git a/resources/v1.24.5/charts/gateway/templates/_helpers.tpl b/resources/v1.28.0/charts/gateway/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.5/charts/gateway/templates/_helpers.tpl
rename to resources/v1.28.0/charts/gateway/templates/_helpers.tpl
diff --git a/resources/v1.28.0/charts/gateway/templates/deployment.yaml b/resources/v1.28.0/charts/gateway/templates/deployment.yaml
new file mode 100644
index 000000000..1d8f93a47
--- /dev/null
+++ b/resources/v1.28.0/charts/gateway/templates/deployment.yaml
@@ -0,0 +1,145 @@
+apiVersion: apps/v1
+kind: {{ .Values.kind | default "Deployment" }}
+metadata:
+  name: {{ include "gateway.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "gateway.name" . }}
+    {{- include "istio.labels" . | nindent 4}}
+    {{- include "gateway.labels" . | nindent 4}}
+  annotations:
+    {{- .Values.annotations | toYaml | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  {{- if and (hasKey .Values "replicaCount") (ne .Values.replicaCount nil) }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  {{- end }}
+  {{- with .Values.strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.minReadySeconds }}
+  minReadySeconds: {{ . }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "gateway.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
+        {{- include "gateway.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/name: {{ include "gateway.name" . }}
+        {{- include "istio.labels" .  | nindent 8}}
+        {{- range $key, $val := .Values.labels }}
+        {{- if and (ne $key "app") (ne $key "istio") }}
+        {{ $key | quote }}: {{ $val | quote }}
+        {{- end }}
+        {{- end }}
+        {{- with .Values.networkGateway }}
+        topology.istio.io/network: "{{.}}"
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
+      securityContext:
+      {{- if .Values.securityContext }}
+        {{- toYaml .Values.securityContext | nindent 8 }}
+      {{- else }}
+        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
+        sysctls:
+        - name: net.ipv4.ip_unprivileged_port_start
+          value: "0"
+      {{- end }}
+      {{- with .Values.volumes }}
+      volumes:
+        {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.initContainers }}
+      initContainers:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: istio-proxy
+          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
+          image: auto
+          {{- with .Values.imagePullPolicy }}
+          imagePullPolicy: {{ . }}
+          {{- end }}
+          securityContext:
+          {{- if .Values.containerSecurityContext }}
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          {{- else }}
+            capabilities:
+              drop:
+              - ALL
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: true
+            {{- if not (eq (.Values.platform | default "") "openshift") }}
+            runAsUser: 1337
+            runAsGroup: 1337
+            {{- end }}
+            runAsNonRoot: true
+          {{- end }}
+          env:
+          {{- with .Values.networkGateway }}
+          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
+            value: "{{.}}"
+          {{- end }}
+          {{- range $key, $val := .Values.env }}
+          - name: {{ $key }}
+            value: {{ $val | quote }}
+          {{- end }}
+          {{- with .Values.envVarFrom }}
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+          ports:
+          - containerPort: 15090
+            protocol: TCP
+            name: http-envoy-prom
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          {{- with .Values.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.lifecycle }}
+          lifecycle:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.additionalContainers }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
+      {{- with .Values.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
diff --git a/resources/v1.24.5/charts/gateway/templates/hpa.yaml b/resources/v1.28.0/charts/gateway/templates/hpa.yaml
similarity index 100%
rename from resources/v1.24.5/charts/gateway/templates/hpa.yaml
rename to resources/v1.28.0/charts/gateway/templates/hpa.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/templates/networkpolicy.yaml b/resources/v1.28.0/charts/gateway/templates/networkpolicy.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/gateway/templates/networkpolicy.yaml
rename to resources/v1.28.0/charts/gateway/templates/networkpolicy.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/templates/poddisruptionbudget.yaml b/resources/v1.28.0/charts/gateway/templates/poddisruptionbudget.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/gateway/templates/poddisruptionbudget.yaml
rename to resources/v1.28.0/charts/gateway/templates/poddisruptionbudget.yaml
diff --git a/resources/v1.24.5/charts/gateway/templates/role.yaml b/resources/v1.28.0/charts/gateway/templates/role.yaml
similarity index 100%
rename from resources/v1.24.5/charts/gateway/templates/role.yaml
rename to resources/v1.28.0/charts/gateway/templates/role.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/templates/service.yaml b/resources/v1.28.0/charts/gateway/templates/service.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/gateway/templates/service.yaml
rename to resources/v1.28.0/charts/gateway/templates/service.yaml
diff --git a/resources/v1.24.5/charts/gateway/templates/serviceaccount.yaml b/resources/v1.28.0/charts/gateway/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.5/charts/gateway/templates/serviceaccount.yaml
rename to resources/v1.28.0/charts/gateway/templates/serviceaccount.yaml
diff --git a/resources/v1.28.0/charts/gateway/templates/zzz_profile.yaml b/resources/v1.28.0/charts/gateway/templates/zzz_profile.yaml
new file mode 100644
index 000000000..606c55669
--- /dev/null
+++ b/resources/v1.28.0/charts/gateway/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if true }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/values.schema.json b/resources/v1.28.0/charts/gateway/values.schema.json
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/gateway/values.schema.json
rename to resources/v1.28.0/charts/gateway/values.schema.json
diff --git a/resources/v1.28-alpha.724e2360/charts/gateway/values.yaml b/resources/v1.28.0/charts/gateway/values.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/gateway/values.yaml
rename to resources/v1.28.0/charts/gateway/values.yaml
diff --git a/resources/v1.28.0/charts/istiod/Chart.yaml b/resources/v1.28.0/charts/istiod/Chart.yaml
new file mode 100644
index 000000000..f6afa92b6
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+appVersion: 1.28.0
+description: Helm chart for istio control plane
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+- istiod
+- istio-discovery
+name: istiod
+sources:
+- https://github.com/istio/istio
+version: 1.28.0
diff --git a/resources/v1.28.0/charts/istiod/README.md b/resources/v1.28.0/charts/istiod/README.md
new file mode 100644
index 000000000..44f7b1d8c
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/README.md
@@ -0,0 +1,73 @@
+# Istiod Helm Chart
+
+This chart installs an Istiod deployment.
+
+## Setup Repo Info
+
+```console
+helm repo add istio https://istio-release.storage.googleapis.com/charts
+helm repo update
+```
+
+_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
+
+## Installing the Chart
+
+Before installing, ensure CRDs are installed in the cluster (from the `istio/base` chart).
+
+To install the chart with the release name `istiod`:
+
+```console
+kubectl create namespace istio-system
+helm install istiod istio/istiod --namespace istio-system
+```
+
+## Uninstalling the Chart
+
+To uninstall/delete the `istiod` deployment:
+
+```console
+helm delete istiod --namespace istio-system
+```
+
+## Configuration
+
+To view supported configuration options and documentation, run:
+
+```console
+helm show values istio/istiod
+```
+
+### Profiles
+
+Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
+These can be set with `--set profile=<profile>`.
+For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
+
+For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
+
+Explicitly set values have highest priority, then profile settings, then chart defaults.
+
+As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
+When configuring the chart, you should not include this.
+That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
+
+### Examples
+
+#### Configuring mesh configuration settings
+
+Any [Mesh Config](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/) options can be configured like below:
+
+```yaml
+meshConfig:
+  accessLogFile: /dev/stdout
+```
+
+#### Revisions
+
+Control plane revisions allow deploying multiple versions of the control plane in the same cluster.
+This allows safe [canary upgrades](https://istio.io/latest/docs/setup/upgrade/canary/)
+
+```yaml
+revision: my-revision-name
+```
diff --git a/resources/v1.28.0/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.28.0/charts/istiod/files/gateway-injection-template.yaml
new file mode 100644
index 000000000..bc15ee3c3
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/files/gateway-injection-template.yaml
@@ -0,0 +1,274 @@
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations:
+    istio.io/rev: {{ .Revision | default "default" | quote }}
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}"
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}"
+    {{- end }}
+    {{- end }}
+spec:
+  securityContext:
+  {{- if .Values.gateways.securityContext }}
+    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
+  {{- else }}
+    sysctls:
+    - name: net.ipv4.ip_unprivileged_port_start
+      value: "0"
+  {{- end }}
+  containers:
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    ports:
+    - containerPort: 15090
+      protocol: TCP
+      name: http-envoy-prom
+    args:
+    - proxy
+    - router
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+  {{- if .Values.global.proxy.lifecycle }}
+    lifecycle:
+      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
+  {{- end }}
+    securityContext:
+      runAsUser: {{ .ProxyUID | default "1337" }}
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+    env:
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: ISTIO_CPU_LIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: GOMEMLIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.memory
+    - name: GOMAXPROCS
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+    {{- if .CompliancePolicy }}
+    - name: COMPLIANCE_POLICY
+      value: "{{ .CompliancePolicy }}"
+    {{- end }}
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    - name: ISTIO_META_INTERCEPTION_MODE
+      value: "{{ .ProxyConfig.InterceptionMode.String }}"
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- if .DeploymentMeta.Name }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ .DeploymentMeta.Name }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - name: ISTIO_BOOTSTRAP_OVERRIDE
+      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
+    {{- end }}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    - name: credential-socket
+      mountPath: /var/run/secrets/credential-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - mountPath: /etc/istio/custom-bootstrap
+      name: custom-bootstrap-volume
+    {{- end }}
+    # SDS channel between istioagent and Envoy
+    - mountPath: /etc/istio/proxy
+      name: istio-envoy
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+  volumes:
+  - emptyDir:
+    name: workload-socket
+  - emptyDir: {}
+    name: credential-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else}}
+  - emptyDir: {}
+    name: workload-certs
+  {{- end }}
+  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+  - name: custom-bootstrap-volume
+    configMap:
+      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-envoy
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+          name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+          path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.28.0/charts/istiod/files/grpc-agent.yaml b/resources/v1.28.0/charts/istiod/files/grpc-agent.yaml
new file mode 100644
index 000000000..6e3102e4c
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/files/grpc-agent.yaml
@@ -0,0 +1,318 @@
+{{- define "resources"  }}
+  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
+      requests:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
+        {{ end }}
+    {{- end }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+      limits:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
+        {{ end }}
+    {{- end }}
+  {{- else }}
+    {{- if .Values.global.proxy.resources }}
+      {{ toYaml .Values.global.proxy.resources | indent 6 }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations: {
+    istio.io/rev: {{ .Revision | default "default" | quote }},
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- end }}
+    sidecar.istio.io/rewriteAppHTTPProbers: "false",
+  }
+spec:
+  containers:
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    ports:
+    - containerPort: 15020
+      protocol: TCP
+      name: mesh-metrics
+    args:
+    - proxy
+    - sidecar
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+    lifecycle:
+      postStart:
+        exec:
+          command:
+          - pilot-agent
+          - wait
+          - --url=http://localhost:15020/healthz/ready
+    env:
+    - name: ISTIO_META_GENERATOR
+      value: grpc
+    - name: OUTPUT_CERTS
+      value: /var/lib/istio/data
+    {{- if eq .InboundTrafficPolicyMode "localhost" }}
+    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
+      value: "true"
+    {{- end }}
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- if .DeploymentMeta.Name }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ .DeploymentMeta.Name }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    # grpc uses xds:/// to resolve – no need to resolve VIP
+    - name: ISTIO_META_DNS_CAPTURE
+      value: "false"
+    - name: DISABLE_ENVOY
+      value: "true"
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15020
+      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
+    resources:
+  {{ template "resources" . }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    # UDS channel between istioagent and gRPC client for XDS/SDS
+    - mountPath: /etc/istio/proxy
+      name: istio-xds
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+    {{- end }}
+      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
+      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
+    - name: "{{  $index }}"
+      {{ toYaml $value | indent 6 }}
+      {{ end }}
+      {{- end }}
+{{- range $index, $container := .Spec.Containers  }}
+{{ if not (eq $container.Name "istio-proxy") }}
+  - name: {{ $container.Name }}
+    env:
+      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
+        value: "true"
+      - name: "GRPC_XDS_BOOTSTRAP"
+        value: "/etc/istio/proxy/grpc-bootstrap.json"
+    volumeMounts:
+      - mountPath: /var/lib/istio/data
+        name: istio-data
+      # UDS channel between istioagent and gRPC client for XDS/SDS
+      - mountPath: /etc/istio/proxy
+        name: istio-xds
+      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
+      - name: gke-workload-certificate
+        mountPath: /var/run/secrets/workload-spiffe-credentials
+        readOnly: true
+      {{- else }}
+      - name: workload-certs
+        mountPath: /var/run/secrets/workload-spiffe-credentials
+      {{- end }}
+{{- end }}
+{{- end }}
+  volumes:
+  - emptyDir:
+    name: workload-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else }}
+  - emptyDir:
+    name: workload-certs
+  {{- end }}
+  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+  - name: custom-bootstrap-volume
+    configMap:
+      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-xds
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+          name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+          path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
+    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
+  - name: "{{ $index }}"
+    {{ toYaml $value | indent 4 }}
+    {{ end }}
+    {{ end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.24.5/charts/istiod/files/grpc-simple.yaml b/resources/v1.28.0/charts/istiod/files/grpc-simple.yaml
similarity index 100%
rename from resources/v1.24.5/charts/istiod/files/grpc-simple.yaml
rename to resources/v1.28.0/charts/istiod/files/grpc-simple.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/injection-template.yaml b/resources/v1.28.0/charts/istiod/files/injection-template.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/files/injection-template.yaml
rename to resources/v1.28.0/charts/istiod/files/injection-template.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/kube-gateway.yaml b/resources/v1.28.0/charts/istiod/files/kube-gateway.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/files/kube-gateway.yaml
rename to resources/v1.28.0/charts/istiod/files/kube-gateway.yaml
diff --git a/resources/v1.28.0/charts/istiod/files/profile-ambient.yaml b/resources/v1.28.0/charts/istiod/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-compatibility-version-1.25.yaml b/resources/v1.28.0/charts/istiod/files/profile-compatibility-version-1.25.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/files/profile-compatibility-version-1.25.yaml
rename to resources/v1.28.0/charts/istiod/files/profile-compatibility-version-1.25.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-compatibility-version-1.26.yaml b/resources/v1.28.0/charts/istiod/files/profile-compatibility-version-1.26.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/files/profile-compatibility-version-1.26.yaml
rename to resources/v1.28.0/charts/istiod/files/profile-compatibility-version-1.26.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-compatibility-version-1.27.yaml b/resources/v1.28.0/charts/istiod/files/profile-compatibility-version-1.27.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/files/profile-compatibility-version-1.27.yaml
rename to resources/v1.28.0/charts/istiod/files/profile-compatibility-version-1.27.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-demo.yaml b/resources/v1.28.0/charts/istiod/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/files/profile-demo.yaml
rename to resources/v1.28.0/charts/istiod/files/profile-demo.yaml
diff --git a/resources/v1.28.0/charts/istiod/files/profile-platform-gke.yaml b/resources/v1.28.0/charts/istiod/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.5/charts/istiod/files/profile-platform-k3d.yaml b/resources/v1.28.0/charts/istiod/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.5/charts/istiod/files/profile-platform-k3d.yaml
rename to resources/v1.28.0/charts/istiod/files/profile-platform-k3d.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-k3s.yaml b/resources/v1.28.0/charts/istiod/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/files/profile-platform-k3s.yaml
rename to resources/v1.28.0/charts/istiod/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.5/charts/istiod/files/profile-platform-microk8s.yaml b/resources/v1.28.0/charts/istiod/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.5/charts/istiod/files/profile-platform-microk8s.yaml
rename to resources/v1.28.0/charts/istiod/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.5/charts/istiod/files/profile-platform-minikube.yaml b/resources/v1.28.0/charts/istiod/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.5/charts/istiod/files/profile-platform-minikube.yaml
rename to resources/v1.28.0/charts/istiod/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.5/charts/istiod/files/profile-platform-openshift.yaml b/resources/v1.28.0/charts/istiod/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.5/charts/istiod/files/profile-platform-openshift.yaml
rename to resources/v1.28.0/charts/istiod/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.5/charts/istiod/files/profile-preview.yaml b/resources/v1.28.0/charts/istiod/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.5/charts/istiod/files/profile-preview.yaml
rename to resources/v1.28.0/charts/istiod/files/profile-preview.yaml
diff --git a/resources/v1.24.5/charts/istiod/files/profile-remote.yaml b/resources/v1.28.0/charts/istiod/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.5/charts/istiod/files/profile-remote.yaml
rename to resources/v1.28.0/charts/istiod/files/profile-remote.yaml
diff --git a/resources/v1.24.5/charts/istiod/files/profile-stable.yaml b/resources/v1.28.0/charts/istiod/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.5/charts/istiod/files/profile-stable.yaml
rename to resources/v1.28.0/charts/istiod/files/profile-stable.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/istiod/files/waypoint.yaml b/resources/v1.28.0/charts/istiod/files/waypoint.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/istiod/files/waypoint.yaml
rename to resources/v1.28.0/charts/istiod/files/waypoint.yaml
diff --git a/resources/v1.24.5/charts/istiod/templates/NOTES.txt b/resources/v1.28.0/charts/istiod/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.5/charts/istiod/templates/NOTES.txt
rename to resources/v1.28.0/charts/istiod/templates/NOTES.txt
diff --git a/resources/v1.24.5/charts/istiod/templates/_helpers.tpl b/resources/v1.28.0/charts/istiod/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.5/charts/istiod/templates/_helpers.tpl
rename to resources/v1.28.0/charts/istiod/templates/_helpers.tpl
diff --git a/resources/v1.28.0/charts/istiod/templates/autoscale.yaml b/resources/v1.28.0/charts/istiod/templates/autoscale.yaml
new file mode 100644
index 000000000..9ab43b5bf
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/autoscale.yaml
@@ -0,0 +1,45 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+{{- if and .Values.autoscaleEnabled .Values.autoscaleMin .Values.autoscaleMax }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  maxReplicas: {{ .Values.autoscaleMax }}
+  minReplicas: {{ .Values.autoscaleMin }}
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: {{ .Values.cpu.targetAverageUtilization }}
+  {{- if .Values.memory.targetAverageUtilization }}
+  - type: Resource
+    resource:
+      name: memory
+      target:
+        type: Utilization
+        averageUtilization: {{ .Values.memory.targetAverageUtilization }}
+  {{- end }}
+  {{- if .Values.autoscaleBehavior }}
+  behavior: {{ toYaml .Values.autoscaleBehavior | nindent 4 }}
+  {{- end }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/resources/v1.28.0/charts/istiod/templates/clusterrole.yaml b/resources/v1.28.0/charts/istiod/templates/clusterrole.yaml
new file mode 100644
index 000000000..3280c96b5
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/clusterrole.yaml
@@ -0,0 +1,216 @@
+# Created if cluster resources are not omitted
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  # sidecar injection controller
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+
+  # configuration validation webhook controller
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update"]
+
+  # istio configuration
+  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
+  # please proceed with caution
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["get", "watch", "list"]
+    resources: ["*"]
+{{- if .Values.global.istiod.enableAnalysis }}
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["update", "patch"]
+    resources:
+    - authorizationpolicies/status
+    - destinationrules/status
+    - envoyfilters/status
+    - gateways/status
+    - peerauthentications/status
+    - proxyconfigs/status
+    - requestauthentications/status
+    - serviceentries/status
+    - sidecars/status
+    - telemetries/status
+    - virtualservices/status
+    - wasmplugins/status
+    - workloadentries/status
+    - workloadgroups/status
+{{- end }}
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "workloadentries" ]
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "workloadentries/status",  "serviceentries/status" ]
+  - apiGroups: ["security.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "authorizationpolicies/status" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "services/status" ]
+
+  # auto-detect installed CRD definitions
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+
+  # discovery and routing
+  - apiGroups: [""]
+    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+
+{{- if .Values.taint.enabled }}
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["patch"]
+{{- end }}
+
+  # ingress controller
+{{- if .Values.global.istiod.enableAnalysis }}
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["*"]
+{{- end}}
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses", "ingressclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["*"]
+
+  # required for CA's namespace controller
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create", "get", "list", "watch", "update"]
+
+  # Istiod and bootstrap.
+{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
+{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
+  - apiGroups: ["certificates.k8s.io"]
+    resources:
+      - "certificatesigningrequests"
+      - "certificatesigningrequests/approval"
+      - "certificatesigningrequests/status"
+    verbs: ["update", "create", "get", "delete", "watch"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources:
+      - "signers"
+    resourceNames:
+{{- range .Values.global.certSigners }}
+    - {{ . | quote }}
+{{- end }}
+    verbs: ["approve"]
+{{- end}}
+{{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["clustertrustbundles"]
+    verbs: ["update", "create", "delete", "list", "watch", "get"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["signers"]
+    resourceNames: ["istio.io/istiod-ca"]
+    verbs: ["attest"]
+{{- end }}
+
+  # Used by Istiod to verify the JWT tokens
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]
+
+  # Used by Istiod to verify gateway SDS
+  - apiGroups: ["authorization.k8s.io"]
+    resources: ["subjectaccessreviews"]
+    verbs: ["create"]
+
+  # Use for Kubernetes Service APIs
+  - apiGroups: ["gateway.networking.k8s.io", "gateway.networking.x-k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["gateway.networking.x-k8s.io"]
+    resources:
+    - xbackendtrafficpolicies/status
+    - xlistenersets/status
+    verbs: ["update", "patch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources:
+    - backendtlspolicies/status
+    - gatewayclasses/status
+    - gateways/status
+    - grpcroutes/status
+    - httproutes/status
+    - referencegrants/status
+    - tcproutes/status
+    - tlsroutes/status
+    - udproutes/status
+    verbs: ["update", "patch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources: ["gatewayclasses"]
+    verbs: ["create", "update", "patch", "delete"]
+  - apiGroups: ["inference.networking.k8s.io"]
+    resources: ["inferencepools"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["inference.networking.k8s.io"]
+    resources: ["inferencepools/status"]
+    verbs: ["update", "patch"]
+
+  # Needed for multicluster secret reading, possibly ingress certs in the future
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "watch", "list"]
+
+  # Used for MCS serviceexport management
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceexports"]
+    verbs: [ "get", "watch", "list", "create", "delete"]
+
+  # Used for MCS serviceimport management
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceimports"]
+    verbs: ["get", "watch", "list"]
+---
+{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["apps"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "deployments" ]
+  - apiGroups: ["autoscaling"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "horizontalpodautoscalers" ]
+  - apiGroups: ["policy"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "poddisruptionbudgets" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "services" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "serviceaccounts"]
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.28.0/charts/istiod/templates/clusterrolebinding.yaml
new file mode 100644
index 000000000..0ca21b957
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/clusterrolebinding.yaml
@@ -0,0 +1,43 @@
+# Created if cluster resources are not omitted
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
+    namespace: {{ .Values.global.istioNamespace }}
+---
+{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+subjects:
+- kind: ServiceAccount
+  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Values.global.istioNamespace }}
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.28.0/charts/istiod/templates/configmap-jwks.yaml
new file mode 100644
index 000000000..45943d383
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/configmap-jwks.yaml
@@ -0,0 +1,20 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+{{- if .Values.jwksResolverExtraRootCA }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+  extra.pem: {{ .Values.jwksResolverExtraRootCA | quote }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/resources/v1.28.0/charts/istiod/templates/configmap-values.yaml b/resources/v1.28.0/charts/istiod/templates/configmap-values.yaml
new file mode 100644
index 000000000..dcd1e3530
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/configmap-values.yaml
@@ -0,0 +1,21 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+  original-values: |-
+{{ .Values._original | toPrettyJson | indent 4 }}
+{{- $_ := unset $.Values "_original" }}
+  merged-values: |-
+{{ .Values | toPrettyJson | indent 4 }}
+{{- end }}
diff --git a/resources/v1.28.0/charts/istiod/templates/configmap.yaml b/resources/v1.28.0/charts/istiod/templates/configmap.yaml
new file mode 100644
index 000000000..a24ff9ee2
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/configmap.yaml
@@ -0,0 +1,113 @@
+{{- define "mesh" }}
+    # The trust domain corresponds to the trust root of a system.
+    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
+    trustDomain: "cluster.local"
+
+    # The namespace to treat as the administrative root namespace for Istio configuration.
+    # When processing a leaf namespace Istio will search for declarations in that namespace first
+    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
+    # is processed as if it were declared in the leaf namespace.
+    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
+
+  {{ $prom := include "default-prometheus" . | eq "true" }}
+  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
+  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
+  {{- if or $prom $sdMetrics $sdLogs }}
+    defaultProviders:
+    {{- if or $prom $sdMetrics }}
+      metrics:
+      {{ if $prom }}- prometheus{{ end }}
+      {{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
+    {{- end }}
+    {{- if and $sdMetrics $sdLogs }}
+      accessLogging:
+      - stackdriver
+    {{- end }}
+  {{- end }}
+
+    defaultConfig:
+      {{- if .Values.global.meshID }}
+      meshId: "{{ .Values.global.meshID }}"
+      {{- end }}
+      {{- with (.Values.global.proxy.variant | default .Values.global.variant) }}
+      image:
+        imageType: {{. | quote}}
+      {{- end }}
+      {{- if not (eq .Values.global.proxy.tracer "none") }}
+      tracing:
+      {{- if eq .Values.global.proxy.tracer "lightstep" }}
+        lightstep:
+          # Address of the LightStep Satellite pool
+          address: {{ .Values.global.tracer.lightstep.address }}
+          # Access Token used to communicate with the Satellite pool
+          accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
+      {{- else if eq .Values.global.proxy.tracer "zipkin" }}
+        zipkin:
+          # Address of the Zipkin collector
+          address: {{ ((.Values.global.tracer).zipkin).address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
+      {{- else if eq .Values.global.proxy.tracer "datadog" }}
+        datadog:
+          # Address of the Datadog Agent
+          address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
+      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
+        stackdriver:
+          # enables trace output to stdout.
+          debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}
+          # The global default max number of attributes per span.
+          maxNumberOfAttributes: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAttributes | default "200" }}
+          # The global default max number of annotation events per span.
+          maxNumberOfAnnotations: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAnnotations | default "200" }}
+          # The global default max number of message events per span.
+          maxNumberOfMessageEvents: {{ (($.Values.global.tracer).stackdriver).maxNumberOfMessageEvents | default "200" }}
+      {{- end }}
+      {{- end }}
+      {{- if .Values.global.remotePilotAddress }}
+      {{- if and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod }}
+      #  only primary `istiod` to xds and local `istiod` injection installs.
+      discoveryAddress: {{ printf "istiod-remote.%s.svc" .Release.Namespace }}:15012
+      {{- else }}
+      discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
+      {{- end }}
+      {{- else }}
+      discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
+      {{- end }}
+{{- end }}
+
+{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
+{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
+{{- $originalMesh := include "mesh" . | fromYaml }}
+{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
+
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+{{- if .Values.configMap }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+
+  # Configuration file for the mesh networks to be used by the Split Horizon EDS.
+  meshNetworks: |-
+  {{- if .Values.global.meshNetworks }}
+    networks:
+{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
+  {{- else }}
+    networks: {}
+  {{- end }}
+
+  mesh: |-
+{{- if .Values.meshConfig }}
+{{ $mesh | toYaml | indent 4 }}
+{{- else }}
+{{- include "mesh" . }}
+{{- end }}
+---
+{{- end }}
+{{- end }}
diff --git a/resources/v1.28.0/charts/istiod/templates/deployment.yaml b/resources/v1.28.0/charts/istiod/templates/deployment.yaml
new file mode 100644
index 000000000..15107e745
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/deployment.yaml
@@ -0,0 +1,314 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istiod
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    istio: pilot
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+{{- range $key, $val := .Values.deploymentLabels }}
+    {{ $key }}: "{{ $val }}"
+{{- end }}
+  {{- if .Values.deploymentAnnotations }}
+  annotations:
+{{ toYaml .Values.deploymentAnnotations | indent 4 }}
+  {{- end }}
+spec:
+{{- if not .Values.autoscaleEnabled }}
+{{- if .Values.replicaCount }}
+  replicas: {{ .Values.replicaCount }}
+{{- end }}
+{{- end }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingMaxSurge }}
+      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
+  selector:
+    matchLabels:
+      {{- if ne .Values.revision "" }}
+      app: istiod
+      istio.io/rev: {{ .Values.revision | default "default" | quote }}
+      {{- else }}
+      istio: pilot
+      {{- end }}
+  template:
+    metadata:
+      labels:
+        app: istiod
+        istio.io/rev: {{ .Values.revision | default "default" | quote }}
+        sidecar.istio.io/inject: "false"
+        operator.istio.io/component: "Pilot"
+        {{- if ne .Values.revision "" }}
+        istio: istiod
+        {{- else }}
+        istio: pilot
+        {{- end }}
+        {{- range $key, $val := .Values.podLabels }}
+        {{ $key }}: "{{ $val }}"
+        {{- end }}
+        istio.io/dataplane-mode: none
+        app.kubernetes.io/name: "istiod"
+        {{- include "istio.labels" . | nindent 8 }}
+      annotations:
+        prometheus.io/port: "15014"
+        prometheus.io/scrape: "true"
+        sidecar.istio.io/inject: "false"
+        {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+        {{- end }}
+    spec:
+{{- if .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 8 }}
+{{- end }}
+{{- with .Values.affinity }}
+      affinity:
+{{- toYaml . | nindent 8 }}
+{{- end }}
+      tolerations:
+        - key: cni.istio.io/not-ready
+          operator: "Exists"
+{{- with .Values.tolerations }}
+{{- toYaml . | nindent 8 }}
+{{- end }}
+{{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+{{- toYaml . | nindent 8 }}
+{{- end }}
+      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+{{- if .Values.global.priorityClassName }}
+      priorityClassName: "{{ .Values.global.priorityClassName }}"
+{{- end }}
+{{- with .Values.initContainers }}
+      initContainers:
+        {{- tpl (toYaml .) $ | nindent 8 }}
+{{- end }}
+      containers:
+        - name: discovery
+{{- if contains "/" .Values.image }}
+          image: "{{ .Values.image }}"
+{{- else }}
+          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
+{{- end }}
+{{- if .Values.global.imagePullPolicy }}
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+{{- end }}
+          args:
+          - "discovery"
+          - --monitoringAddr=:15014
+{{- if .Values.global.logging.level }}
+          - --log_output_level={{ .Values.global.logging.level }}
+{{- end}}
+{{- if .Values.global.logAsJson }}
+          - --log_as_json
+{{- end }}
+          - --domain
+          - {{ .Values.global.proxy.clusterDomain }}
+{{- if .Values.taint.namespace }}
+          - --cniNamespace={{ .Values.taint.namespace }}
+{{- end }}
+          - --keepaliveMaxServerConnectionAge
+          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
+{{- if .Values.extraContainerArgs }}
+          {{- with .Values.extraContainerArgs }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+{{- end }}
+          ports:
+          - containerPort: 8080
+            protocol: TCP
+            name: http-debug
+          - containerPort: 15010
+            protocol: TCP
+            name: grpc-xds
+          - containerPort: 15012
+            protocol: TCP
+            name: tls-xds
+          - containerPort: 15017
+            protocol: TCP
+            name: https-webhooks
+          - containerPort: 15014
+            protocol: TCP
+            name: http-monitoring
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8080
+            initialDelaySeconds: 1
+            periodSeconds: 3
+            timeoutSeconds: 5
+          env:
+          - name: REVISION
+            value: "{{ .Values.revision | default `default` }}"
+          - name: PILOT_CERT_PROVIDER
+            value: {{ .Values.global.pilotCertProvider }}
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.name
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+          - name: SERVICE_ACCOUNT
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: spec.serviceAccountName
+          - name: KUBECONFIG
+            value: /var/run/secrets/remote/config
+          # If you explicitly told us where ztunnel lives, use that.
+          # Otherwise, assume it lives in our namespace
+          # Also, check for an explicit ENV override (legacy approach) and prefer that
+          # if present
+          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
+          {{ $ztTrustedName := or .Values.trustedZtunnelName "ztunnel" }}
+          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
+          - name: CA_TRUSTED_NODE_ACCOUNTS
+            value: "{{ $ztTrustedNS }}/{{ $ztTrustedName }}"
+          {{- end }}
+          {{- if .Values.env }}
+          {{- range $key, $val := .Values.env }}
+          - name: {{ $key }}
+            value: "{{ $val }}"
+          {{- end }}
+          {{- end }}
+          {{- with .Values.envVarFrom }}
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+{{- if .Values.traceSampling }}
+          - name: PILOT_TRACE_SAMPLING
+            value: "{{ .Values.traceSampling }}"
+{{- end }}
+# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
+# don't set it here to avoid duplication.
+# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
+{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
+          - name: EXTERNAL_ISTIOD
+            value: "{{ .Values.global.externalIstiod }}"
+{{- end }}
+{{- if .Values.global.trustBundleName }}
+          - name: PILOT_CA_CERT_CONFIGMAP
+            value: "{{ .Values.global.trustBundleName }}"
+{{- end }}
+          - name: PILOT_ENABLE_ANALYSIS
+            value: "{{ .Values.global.istiod.enableAnalysis }}"
+          - name: CLUSTER_ID
+            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
+          - name: GOMEMLIMIT
+            valueFrom:
+              resourceFieldRef:
+                resource: limits.memory
+                divisor: "1"
+          - name: GOMAXPROCS
+            valueFrom:
+              resourceFieldRef:
+                resource: limits.cpu
+                divisor: "1"
+          - name: PLATFORM
+            value: "{{ coalesce .Values.global.platform .Values.platform }}"
+          resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 12 }}
+{{- else }}
+{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
+{{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+              - ALL
+{{- if .Values.seccompProfile }}
+            seccompProfile:
+{{ toYaml .Values.seccompProfile | trim | indent 14 }}
+{{- end }}
+          volumeMounts:
+          - name: istio-token
+            mountPath: /var/run/secrets/tokens
+            readOnly: true
+          - name: local-certs
+            mountPath: /var/run/secrets/istio-dns
+          - name: cacerts
+            mountPath: /etc/cacerts
+            readOnly: true
+          - name: istio-kubeconfig
+            mountPath: /var/run/secrets/remote
+            readOnly: true
+          {{- if .Values.jwksResolverExtraRootCA }}
+          - name: extracacerts
+            mountPath: /cacerts
+          {{- end }}
+          - name: istio-csr-dns-cert
+            mountPath: /var/run/secrets/istiod/tls
+            readOnly: true
+          - name: istio-csr-ca-configmap
+            mountPath: /var/run/secrets/istiod/ca
+            readOnly: true
+          {{- with .Values.volumeMounts }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+      volumes:
+      # Technically not needed on this pod - but it helps debugging/testing SDS
+      # Should be removed after everything works.
+      - emptyDir:
+          medium: Memory
+        name: local-certs
+      - name: istio-token
+        projected:
+          sources:
+            - serviceAccountToken:
+                audience: {{ .Values.global.sds.token.aud }}
+                expirationSeconds: 43200
+                path: istio-token
+      # Optional: user-generated root
+      - name: cacerts
+        secret:
+          secretName: cacerts
+          optional: true
+      - name: istio-kubeconfig
+        secret:
+          secretName: istio-kubeconfig
+          optional: true
+      # Optional: istio-csr dns pilot certs
+      - name: istio-csr-dns-cert
+        secret:
+          secretName: istiod-tls
+          optional: true
+      - name: istio-csr-ca-configmap
+  {{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+              path: root-cert.pem
+              optional: true
+  {{- else }}
+        configMap:
+          name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+          defaultMode: 420
+          optional: true
+  {{- end }}
+  {{- if .Values.jwksResolverExtraRootCA }}
+      - name: extracacerts
+        configMap:
+          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  {{- end }}
+      {{- with .Values.volumes }}
+        {{- toYaml . | nindent 6}}
+      {{- end }}
+
+---
+{{- end }}
+{{- end }}
diff --git a/resources/v1.28.0/charts/istiod/templates/gateway-class-configmap.yaml b/resources/v1.28.0/charts/istiod/templates/gateway-class-configmap.yaml
new file mode 100644
index 000000000..9f7cdb01d
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/gateway-class-configmap.yaml
@@ -0,0 +1,22 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+{{ range $key, $value := .Values.gatewayClasses }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-{{ $.Values.revision | default "default"  }}-gatewayclass-{{$key}}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    gateway.istio.io/defaults-for-class: {{$key|quote}}
+    {{- include "istio.labels" $ | nindent 4 }}
+data:
+{{ range $kind, $overlay := $value }}
+  {{$kind}}: |
+{{$overlay|toYaml|trim|indent 4}}
+{{ end }}
+---
+{{ end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.28.0/charts/istiod/templates/istiod-injector-configmap.yaml
new file mode 100644
index 000000000..a5a6cf9ae
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/istiod-injector-configmap.yaml
@@ -0,0 +1,83 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+{{- if not .Values.global.omitSidecarInjectorConfigMap }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
+  values: |-
+{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
+{{ $pilotVals := pick .Values "cni" "env" -}}
+{{ $vals = set $vals "pilot" $pilotVals -}}
+{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
+{{ $vals = set $vals "gateways" $gatewayVals -}}
+{{ $vals | toPrettyJson | indent 4 }}
+
+  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
+  # and istiod webhook functionality.
+  #
+  # New fields should not use Values - it is a 'primary' config object, users should be able
+  # to fine tune it or use it with kube-inject.
+  config: |-
+    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
+    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
+    defaultTemplates:
+{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
+    - {{ . }}
+{{- end }}
+    {{- else }}
+    defaultTemplates: [sidecar]
+    {{- end }}
+    policy: {{ .Values.global.proxy.autoInject }}
+    alwaysInjectSelector:
+{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
+    neverInjectSelector:
+{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
+    injectedAnnotations:
+      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
+      "{{ $key }}": {{ $val | quote }}
+      {{- end }}
+    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
+         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
+         This should make it obvious that their installation is broken.
+     */}}
+    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
+    templates:
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
+      sidecar: |
+{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
+      gateway: |
+{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
+      grpc-simple: |
+{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
+      grpc-agent: |
+{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
+      waypoint: |
+{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
+      kube-gateway: |
+{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
+{{- end }}
+{{- with .Values.sidecarInjectorWebhook.templates }}
+{{ toYaml . | trim | indent 6 }}
+{{- end }}
+
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.28.0/charts/istiod/templates/mutatingwebhook.yaml
new file mode 100644
index 000000000..26a6c8f00
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/mutatingwebhook.yaml
@@ -0,0 +1,167 @@
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- /* Core defines the common configuration used by all webhook segments */}}
+{{/* Copy just what we need to avoid expensive deepCopy */}}
+{{- $whv := dict
+"revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "caBundle" .Values.istiodRemote.injectionCABundle
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+    {{- if .caBundle }}
+    caBundle: "{{ .caBundle }}"
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
+{{- if not .Values.global.operatorManageWebhooks }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq .Release.Namespace "istio-system"}}
+  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+{{- else }}
+  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
+
+{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
+{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      {{- if (eq .Values.revision "") }}
+      - "default"
+      {{- else }}
+      - "{{ .Values.revision }}"
+      {{- end }}
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      {{- if (eq .Values.revision "") }}
+      - "default"
+      {{- else }}
+      - "{{ .Values.revision }}"
+      {{- end }}
+
+
+{{- /* Webhooks for default revision */}}
+{{- if (eq .Values.revision "") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/networkpolicy.yaml b/resources/v1.28.0/charts/istiod/templates/networkpolicy.yaml
new file mode 100644
index 000000000..e844d5e5d
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/networkpolicy.yaml
@@ -0,0 +1,47 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+{{- if (.Values.global.networkPolicy).enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istiod
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    istio: pilot
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      app: istiod
+      istio.io/rev: {{ .Values.revision | default "default" | quote }}
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  # Webhook from kube-apiserver
+  - from: []
+    ports:
+    - protocol: TCP
+      port: 15017
+  # xDS from potentially anywhere
+  - from: []
+    ports:
+    - protocol: TCP
+      port: 15010
+    - protocol: TCP
+      port: 15011
+    - protocol: TCP
+      port: 15012
+    - protocol: TCP
+      port: 8080
+    - protocol: TCP
+      port: 15014
+  # Allow all egress (needed because features like JWKS require connections to user-defined endpoints)
+  egress:
+  - {}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.28.0/charts/istiod/templates/poddisruptionbudget.yaml
new file mode 100644
index 000000000..0ac37d1cd
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/poddisruptionbudget.yaml
@@ -0,0 +1,41 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
+# a workaround for https://github.com/kubernetes/kubernetes/issues/93476
+{{- if or (and .Values.autoscaleEnabled  (gt (int .Values.autoscaleMin) 1)) (and (not .Values.autoscaleEnabled) (gt (int .Values.replicaCount) 1)) }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istiod
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    istio: pilot
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  {{- if and .Values.pdb.minAvailable (not (hasKey .Values.pdb "maxUnavailable")) }}
+  minAvailable: {{ .Values.pdb.minAvailable }}
+  {{- else if .Values.pdb.maxUnavailable }}
+  maxUnavailable: {{ .Values.pdb.maxUnavailable }}
+  {{- end }}
+  {{- if .Values.pdb.unhealthyPodEvictionPolicy }}
+  unhealthyPodEvictionPolicy: {{ .Values.pdb.unhealthyPodEvictionPolicy }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app: istiod
+      {{- if ne .Values.revision "" }}
+      istio.io/rev: {{ .Values.revision | quote }}
+      {{- else }}
+      istio: pilot
+      {{- end }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.28.0/charts/istiod/templates/reader-clusterrole.yaml
new file mode 100644
index 000000000..e0b0ff42a
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/reader-clusterrole.yaml
@@ -0,0 +1,65 @@
+# Created if cluster resources are not omitted
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istio-reader
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istio-reader"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - "config.istio.io"
+      - "security.istio.io"
+      - "networking.istio.io"
+      - "authentication.istio.io"
+      - "rbac.istio.io"
+      - "telemetry.istio.io"
+      - "extensions.istio.io"
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list" ]
+    resources: [ "workloadentries" ]
+  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
+    resources: ["gateways"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceexports"]
+    verbs: ["get", "list", "watch", "create", "delete"]
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceimports"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]
+  - apiGroups: ["authorization.k8s.io"]
+    resources: ["subjectaccessreviews"]
+    verbs: ["create"]
+{{- if .Values.istiodRemote.enabled }}
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create", "get", "list", "watch", "update"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update"]
+{{- end}}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/reader-clusterrolebinding.yaml b/resources/v1.28.0/charts/istiod/templates/reader-clusterrolebinding.yaml
new file mode 100644
index 000000000..624f00dce
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/reader-clusterrolebinding.yaml
@@ -0,0 +1,20 @@
+# Created if cluster resources are not omitted
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istio-reader
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istio-reader"
+    {{- include "istio.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: istio-reader-service-account
+    namespace: {{ .Values.global.istioNamespace }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/remote-istiod-endpointslices.yaml b/resources/v1.28.0/charts/istiod/templates/remote-istiod-endpointslices.yaml
new file mode 100644
index 000000000..e2f4ff03b
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/remote-istiod-endpointslices.yaml
@@ -0,0 +1,42 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+{{- if and .Values.global.remotePilotAddress .Values.istiodRemote.enabled }}
+# if the remotePilotAddress is an IP addr
+{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  {{- if .Values.istiodRemote.enabledLocalInjectorIstiod }}
+  # This file is only used for remote `istiod` installs.
+  # only primary `istiod` to xds and local `istiod` injection installs.
+  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
+  {{- else }}
+  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
+  {{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- if .Values.istiodRemote.enabledLocalInjectorIstiod }}
+    # only primary `istiod` to xds and local `istiod` injection installs.
+    kubernetes.io/service-name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
+    {{- else }}
+    kubernetes.io/service-name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
+    {{- end }}
+    {{- if .Release.Service }}
+    endpointslice.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    {{- end }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+addressType: IPv4
+endpoints:
+- addresses:
+  - {{ .Values.global.remotePilotAddress }}
+ports:
+- port: 15012
+  name: tcp-istiod
+  protocol: TCP
+- port: 15017
+  name: tcp-webhook
+  protocol: TCP
+---
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.28.0/charts/istiod/templates/remote-istiod-service.yaml
new file mode 100644
index 000000000..ab14497ba
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/remote-istiod-service.yaml
@@ -0,0 +1,43 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# This file is only used for remote
+{{- if and .Values.global.remotePilotAddress .Values.istiodRemote.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  {{- if .Values.istiodRemote.enabledLocalInjectorIstiod }}
+  # only primary `istiod` to xds and local `istiod` injection installs.
+  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
+  {{- else }}
+  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
+  {{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    app.kubernetes.io/name: "istiod"
+    {{ include "istio.labels" . | nindent 4 }}
+spec:
+  ports:
+  - port: 15012
+    name: tcp-istiod
+    protocol: TCP
+  - port: 443
+    targetPort: 15017
+    name: tcp-webhook
+    protocol: TCP
+  {{- if and .Values.global.remotePilotAddress (not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress)) }}
+  # if the remotePilotAddress is not an IP addr, we use ExternalName
+  type: ExternalName
+  externalName: {{ .Values.global.remotePilotAddress }}
+  {{- end }}
+{{- if .Values.global.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
+{{- end }}
+{{- if .Values.global.ipFamilies }}
+  ipFamilies:
+{{- range .Values.global.ipFamilies }}
+  - {{ . }}
+{{- end }}
+{{- end }}
+---
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/revision-tags-mwc.yaml b/resources/v1.28.0/charts/istiod/templates/revision-tags-mwc.yaml
new file mode 100644
index 000000000..556bb2f1e
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/revision-tags-mwc.yaml
@@ -0,0 +1,154 @@
+# Adapted from istio-discovery/templates/mutatingwebhook.yaml
+# Removed paths for legacy and default selectors since a revision tag
+# is inherently created from a specific revision
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- $whv := dict
+"revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "caBundle" .Values.istiodRemote.injectionCABundle
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+{{- if not .Values.global.operatorManageWebhooks }}
+{{- range $tagName := $.Values.revisionTags }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq $.Release.Namespace "istio-system"}}
+  name: istio-revision-tag-{{ $tagName }}
+{{- else }}
+  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/tag: {{ $tagName }}
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+
+{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
+{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
+{{- if (eq $tagName "default") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/revision-tags-svc.yaml b/resources/v1.28.0/charts/istiod/templates/revision-tags-svc.yaml
new file mode 100644
index 000000000..5c4826d23
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/revision-tags-svc.yaml
@@ -0,0 +1,57 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Adapted from istio-discovery/templates/service.yaml
+{{- range $tagName := .Values.revisionTags }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: istiod-revision-tag-{{ $tagName }}
+  namespace: {{ $.Release.Namespace }}
+  {{- if $.Values.serviceAnnotations }}
+  annotations:
+{{ toYaml $.Values.serviceAnnotations | indent 4 }}
+  {{- end }}
+  labels:
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    istio.io/tag: {{ $tagName }}
+    operator.istio.io/component: "Pilot"
+    app: istiod
+    istio: pilot
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+spec:
+  ports:
+    - port: 15010
+      name: grpc-xds # plaintext
+      protocol: TCP
+    - port: 15012
+      name: https-dns # mTLS with k8s-signed cert
+      protocol: TCP
+    - port: 443
+      name: https-webhook # validation and injection
+      targetPort: 15017
+      protocol: TCP
+    - port: 15014
+      name: http-monitoring # prometheus stats
+      protocol: TCP
+  selector:
+    app: istiod
+    {{- if ne $.Values.revision "" }}
+    istio.io/rev: {{ $.Values.revision | quote }}
+    {{- else }}
+    # Label used by the 'default' service. For versioned deployments we match with app and version.
+    # This avoids default deployment picking the canary
+    istio: pilot
+    {{- end }}
+  {{- if $.Values.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ $.Values.ipFamilyPolicy }}
+  {{- end }}
+  {{- if $.Values.ipFamilies }}
+  ipFamilies:
+  {{- range $.Values.ipFamilies }}
+  - {{ . }}
+  {{- end }}
+  {{- end }}
+---
+{{- end -}}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/role.yaml b/resources/v1.28.0/charts/istiod/templates/role.yaml
new file mode 100644
index 000000000..8abe608b6
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/role.yaml
@@ -0,0 +1,37 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Values.global.istioNamespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+# permissions to verify the webhook is ready and rejecting
+# invalid config. We use --server-dry-run so no config is persisted.
+- apiGroups: ["networking.istio.io"]
+  verbs: ["create"]
+  resources: ["gateways"]
+
+# For storing CA secret
+- apiGroups: [""]
+  resources: ["secrets"]
+  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
+  verbs: ["create", "get", "watch", "list", "update", "delete"]
+
+# For status controller, so it can delete the distribution report configmap
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["delete"]
+
+# For gateway deployment controller
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  verbs: ["get", "update", "patch", "create"]
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/rolebinding.yaml b/resources/v1.28.0/charts/istiod/templates/rolebinding.yaml
new file mode 100644
index 000000000..731964f04
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/rolebinding.yaml
@@ -0,0 +1,23 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Values.global.istioNamespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
+subjects:
+  - kind: ServiceAccount
+    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+    namespace: {{ .Values.global.istioNamespace }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/service.yaml b/resources/v1.28.0/charts/istiod/templates/service.yaml
new file mode 100644
index 000000000..c3aade8a4
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/service.yaml
@@ -0,0 +1,59 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  {{- if .Values.serviceAnnotations }}
+  annotations:
+{{ toYaml .Values.serviceAnnotations | indent 4 }}
+  {{- end }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: istiod
+    istio: pilot
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  ports:
+    - port: 15010
+      name: grpc-xds # plaintext
+      protocol: TCP
+    - port: 15012
+      name: https-dns # mTLS with k8s-signed cert
+      protocol: TCP
+    - port: 443
+      name: https-webhook # validation and injection
+      targetPort: 15017
+      protocol: TCP
+    - port: 15014
+      name: http-monitoring # prometheus stats
+      protocol: TCP
+  selector:
+    app: istiod
+    {{- if ne .Values.revision "" }}
+    istio.io/rev: {{ .Values.revision | quote }}
+    {{- else }}
+    # Label used by the 'default' service. For versioned deployments we match with app and version.
+    # This avoids default deployment picking the canary
+    istio: pilot
+    {{- end }}
+  {{- if .Values.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.ipFamilyPolicy }}
+  {{- end }}
+  {{- if .Values.ipFamilies }}
+  ipFamilies:
+  {{- range .Values.ipFamilies }}
+  - {{ . }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.trafficDistribution }}
+  trafficDistribution: {{ .Values.trafficDistribution }}
+  {{- end }}
+---
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/serviceaccount.yaml b/resources/v1.28.0/charts/istiod/templates/serviceaccount.yaml
new file mode 100644
index 000000000..ee40eedf8
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/serviceaccount.yaml
@@ -0,0 +1,26 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+apiVersion: v1
+kind: ServiceAccount
+  {{- if .Values.global.imagePullSecrets }}
+imagePullSecrets:
+  {{- range .Values.global.imagePullSecrets }}
+  - name: {{ . }}
+  {{- end }}
+  {{- end }}
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Values.global.istioNamespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+  {{- if .Values.serviceAccountAnnotations }}
+  annotations:
+{{- toYaml .Values.serviceAccountAnnotations | nindent 4 }}
+  {{- end }}
+{{- end }}
+---
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.28.0/charts/istiod/templates/validatingadmissionpolicy.yaml
new file mode 100644
index 000000000..838d9fbaf
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/validatingadmissionpolicy.yaml
@@ -0,0 +1,65 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+{{- if .Values.experimental.stableValidationPolicy }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
+  labels:
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+        - security.istio.io
+        - networking.istio.io
+        - telemetry.istio.io
+        - extensions.istio.io
+      apiVersions: ["*"]
+      operations:  ["CREATE", "UPDATE"]
+      resources:   ["*"]
+    objectSelector:
+      matchExpressions:
+        - key: istio.io/rev
+          operator: In
+          values:
+          {{- if (eq .Values.revision "") }}
+          - "default"
+          {{- else }}
+          - "{{ .Values.revision }}"
+          {{- end }}
+  variables:
+    - name: isEnvoyFilter
+      expression: "object.kind == 'EnvoyFilter'"
+    - name: isWasmPlugin
+      expression: "object.kind == 'WasmPlugin'"
+    - name: isProxyConfig
+      expression: "object.kind == 'ProxyConfig'"
+    - name: isTelemetry
+      expression: "object.kind == 'Telemetry'"
+  validations:
+    - expression: "!variables.isEnvoyFilter"
+    - expression: "!variables.isWasmPlugin"
+    - expression: "!variables.isProxyConfig"
+    - expression: |
+        !(
+          variables.isTelemetry && (
+            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
+            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
+            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
+          )
+        )
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: "stable-channel-policy-binding{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
+spec:
+  policyName: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
+  validationActions: [Deny]
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.28.0/charts/istiod/templates/validatingwebhookconfiguration.yaml
new file mode 100644
index 000000000..6903b29b5
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/validatingwebhookconfiguration.yaml
@@ -0,0 +1,70 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+{{- if .Values.global.configValidation }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    istio: istiod
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+webhooks:
+  # Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
+  # are rejecting invalid configs on a per-revision basis.
+  - name: rev.validation.istio.io
+    clientConfig:
+      # Should change from base but cannot for API compat
+      {{- if .Values.base.validationURL }}
+      url: {{ .Values.base.validationURL }}
+      {{- else }}
+      service:
+        name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+        namespace: {{ .Values.global.istioNamespace }}
+        path: "/validate"
+      {{- end }}
+      {{- if .Values.base.validationCABundle }}
+      caBundle: "{{ .Values.base.validationCABundle }}"
+      {{- end }}
+    rules:
+      - operations:
+          - CREATE
+          - UPDATE
+        apiGroups:
+          - security.istio.io
+          - networking.istio.io
+          - telemetry.istio.io
+          - extensions.istio.io
+        apiVersions:
+          - "*"
+        resources:
+          - "*"
+    {{- if .Values.base.validationCABundle }}
+    # Disable webhook controller in Pilot to stop patching it
+    failurePolicy: Fail
+    {{- else }}
+    # Fail open until the validation webhook is ready. The webhook controller
+    # will update this to `Fail` and patch in the `caBundle` when the webhook
+    # endpoint is ready.
+    failurePolicy: Ignore
+    {{- end }}
+    sideEffects: None
+    admissionReviewVersions: ["v1"]
+    objectSelector:
+      matchExpressions:
+        - key: istio.io/rev
+          operator: In
+          values:
+          {{- if (eq .Values.revision "") }}
+          - "default"
+          {{- else }}
+          - "{{ .Values.revision }}"
+          {{- end }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/istiod/templates/zzy_descope_legacy.yaml b/resources/v1.28.0/charts/istiod/templates/zzy_descope_legacy.yaml
new file mode 100644
index 000000000..73202418c
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/zzy_descope_legacy.yaml
@@ -0,0 +1,3 @@
+{{/* Copy anything under `.pilot` to `.`, to avoid the need to specify a redundant prefix.
+Due to the file naming, this always happens after zzz_profile.yaml */}}
+{{- $_ := mustMergeOverwrite $.Values (index $.Values "pilot") }}
diff --git a/resources/v1.28.0/charts/istiod/templates/zzz_profile.yaml b/resources/v1.28.0/charts/istiod/templates/zzz_profile.yaml
new file mode 100644
index 000000000..3d8495648
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if false }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.28.0/charts/istiod/values.yaml b/resources/v1.28.0/charts/istiod/values.yaml
new file mode 100644
index 000000000..1a28f3853
--- /dev/null
+++ b/resources/v1.28.0/charts/istiod/values.yaml
@@ -0,0 +1,583 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  autoscaleBehavior: {}
+  replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+
+  hub: ""
+  tag: ""
+  variant: ""
+
+  # Can be a full hub/image:tag
+  image: pilot
+  traceSampling: 1.0
+
+  # Resources for a small pilot install
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2048Mi
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # Whether to use an existing CNI installation
+  cni:
+    enabled: false
+    provider: default
+
+  # Additional container arguments
+  extraContainerArgs: []
+
+  env: {}
+
+  envVarFrom: []
+
+  # Settings related to the untaint controller
+  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
+  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
+  taint:
+    # Controls whether or not the untaint controller is active
+    enabled: false
+    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
+    namespace: ""
+
+  affinity: {}
+
+  tolerations: []
+
+  cpu:
+    targetAverageUtilization: 80
+  memory: {}
+    # targetAverageUtilization: 80
+
+  # Additional volumeMounts to the istiod container
+  volumeMounts: []
+
+  # Additional volumes to the istiod pod
+  volumes: []
+
+  # Inject initContainers into the istiod pod
+  initContainers: []
+
+  nodeSelector: {}
+  podAnnotations: {}
+  serviceAnnotations: {}
+  serviceAccountAnnotations: {}
+  sidecarInjectorWebhookAnnotations: {}
+
+  topologySpreadConstraints: []
+
+  # You can use jwksResolverExtraRootCA to provide a root certificate
+  # in PEM format. This will then be trusted by pilot when resolving
+  # JWKS URIs.
+  jwksResolverExtraRootCA: ""
+
+  # The following is used to limit how long a sidecar can be connected
+  # to a pilot. It balances out load across pilot instances at the cost of
+  # increasing system churn.
+  keepaliveMaxServerConnectionAge: 30m
+
+  # Additional labels to apply to the deployment.
+  deploymentLabels: {}
+
+  # Annotations to apply to the istiod deployment.
+  deploymentAnnotations: {}
+
+  ## Mesh config settings
+
+  # Install the mesh config map, generated from values.yaml.
+  # If false, pilot wil use default values (by default) or user-supplied values.
+  configMap: true
+
+  # Additional labels to apply on the pod level for monitoring and logging configuration.
+  podLabels: {}
+
+  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
+  ipFamilyPolicy: ""
+  ipFamilies: []
+
+  # Ambient mode only.
+  # Set this if you install ztunnel to a different namespace from `istiod`.
+  # If set, `istiod` will allow connections from trusted node proxy ztunnels
+  # in the provided namespace.
+  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
+  # in the same namespace as itself.
+  trustedZtunnelNamespace: ""
+  # Set this if you install ztunnel with a name different from the default.
+  trustedZtunnelName: ""
+
+  sidecarInjectorWebhook:
+    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
+    # always skip the injection on pods that match that label selector, regardless of the global policy.
+    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
+    neverInjectSelector: []
+    alwaysInjectSelector: []
+
+    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
+    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
+    #
+    # annotations:
+    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+    #
+    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
+    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
+    # injectedAnnotations:
+    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
+    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
+    injectedAnnotations: {}
+
+    # This enables injection of sidecar in all namespaces,
+    # with the exception of namespaces with "istio-injection:disabled" annotation
+    # Only one environment should have this enabled.
+    enableNamespacesByDefault: false
+
+    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
+    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
+    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
+    reinvocationPolicy: Never
+
+    rewriteAppHTTPProbe: true
+
+    # Templates defines a set of custom injection templates that can be used. For example, defining:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
+    # being injected with the hello=world labels.
+    # This is intended for advanced configuration only; most users should use the built in template
+    templates: {}
+
+    # Default templates specifies a set of default templates that are used in sidecar injection.
+    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
+    # To inject other additional templates, define it using the `templates` option, and add it to
+    # the default templates list.
+    # For example:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # defaultTemplates: ["sidecar", "hello"]
+    defaultTemplates: []
+  istiodRemote:
+    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
+    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
+    # to utilize a remote instance.
+    enabled: false
+
+    # If `true`, indicates that this cluster/install should consume a "local istiod" installation,
+    # local istiod inject sidecars
+    enabledLocalInjectorIstiod: false
+
+    # Sidecar injector mutating webhook configuration clientConfig.url value.
+    # For example: https://$remotePilotAddress:15017/inject
+    # The host should not refer to a service running in the cluster; use a service reference by specifying
+    # the clientConfig.service field instead.
+    injectionURL: ""
+
+    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
+    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
+    injectionPath: "/inject"
+
+    injectionCABundle: ""
+  telemetry:
+    enabled: true
+    v2:
+      # For Null VM case now.
+      # This also enables metadata exchange.
+      enabled: true
+      # Indicate if prometheus stats filter is enabled or not
+      prometheus:
+        enabled: true
+      # stackdriver filter settings.
+      stackdriver:
+        enabled: false
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # Revision tags are aliases to Istio control plane revisions
+  revisionTags: []
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
+  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
+  meshConfig:
+    enablePrometheusMerge: true
+
+  experimental:
+    stableValidationPolicy: false
+
+  global:
+    # Used to locate istiod.
+    istioNamespace: istio-system
+    # List of cert-signers to allow "approve" action in the istio cluster role
+    #
+    # certSigners:
+    #   - clusterissuers.cert-manager.io/istio-ca
+    certSigners: []
+    # enable pod disruption budget for the control plane, which is used to
+    # ensure Istio control plane components are gradually upgraded or recovered.
+    defaultPodDisruptionBudget:
+      enabled: true
+      # The values aren't mutable due to a current PodDisruptionBudget limitation
+      # minAvailable: 1
+
+    # A minimal set of requested resources to applied to all deployments so that
+    # Horizontal Pod Autoscaler will be able to function (if set).
+    # Each component can overwrite these default values by adding its own resources
+    # block in the relevant section below and setting the desired resources values.
+    defaultResources:
+      requests:
+        cpu: 10m
+      #   memory: 128Mi
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+    # Default tag for Istio images.
+    tag: 1.28.0
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Enabled by default in master for maximising testing.
+    istiod:
+      enableAnalysis: false
+
+    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
+    logAsJson: false
+
+    # In order to use native nftable rules instead of iptable rules, set this flag to true.
+    nativeNftables: false
+
+    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+    # The control plane has different scopes depending on component, but can configure default log level across all components
+    # If empty, default scope and level will be used as configured in code
+    logging:
+      level: "default:info"
+
+    # When enabled, default NetworkPolicy resources will be created
+    networkPolicy:
+      enabled: false
+
+    omitSidecarInjectorConfigMap: false
+
+    # resourceScope controls what resources will be processed by helm.
+    # This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
+    # It can be one of:
+    # - all: all resources are processed
+    # - cluster: only cluster-scoped resources are processed
+    # - namespace: only namespace-scoped resources are processed
+    resourceScope: all
+
+    # Configure whether Operator manages webhook configurations. The current behavior
+    # of Istiod is to manage its own webhook configurations.
+    # When this option is set as true, Istio Operator, instead of webhooks, manages the
+    # webhook configurations. When this option is set as false, webhooks manage their
+    # own webhook configurations.
+    operatorManageWebhooks: false
+
+    # Custom DNS config for the pod to resolve names of services in other
+    # clusters. Use this to add additional search domains, and other settings.
+    # see
+    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
+    # This does not apply to gateway pods as they typically need a different
+    # set of DNS settings than the normal application pods (e.g., in
+    # multicluster scenarios).
+    # NOTE: If using templates, follow the pattern in the commented example below.
+    #podDNSSearchNamespaces:
+    #- global
+    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
+
+    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
+    # system-node-critical, it is better to configure this in order to make sure your Istio pods
+    # will not be killed because of low priority class.
+    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+    # for more detail.
+    priorityClassName: ""
+
+    proxy:
+      image: proxyv2
+
+      # This controls the 'policy' in the sidecar injector.
+      autoInject: enabled
+
+      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
+      # cluster domain. Default value is "cluster.local".
+      clusterDomain: "cluster.local"
+
+      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
+      # not set, then the global "logLevel" will be used.
+      componentLogLevel: "misc:error"
+
+      # istio ingress capture allowlist
+      # examples:
+      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
+      excludeInboundPorts: ""
+      includeInboundPorts: "*"
+
+      # istio egress capture allowlist
+      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
+      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
+      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
+      # be allowed by the sidecar
+      includeIPRanges: "*"
+      excludeIPRanges: ""
+      includeOutboundPorts: ""
+      excludeOutboundPorts: ""
+
+      # Log level for proxy, applies to gateways and sidecars.
+      # Expected values are: trace|debug|info|warning|error|critical|off
+      logLevel: warning
+
+      # Specify the path to the outlier event log.
+      # Example: /dev/stdout
+      outlierLogPath: ""
+
+      #If set to true, istio-proxy container will have privileged securityContext
+      privileged: false
+      
+      seccompProfile: {}
+
+      # The number of successive failed probes before indicating readiness failure.
+      readinessFailureThreshold: 4
+
+      # The initial delay for readiness probes in seconds.
+      readinessInitialDelaySeconds: 0
+
+      # The period between readiness probes.
+      readinessPeriodSeconds: 15
+
+      # Enables or disables a startup probe.
+      # For optimal startup times, changing this should be tied to the readiness probe values.
+      #
+      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
+      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
+      # and doesn't spam the readiness endpoint too much
+      #
+      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
+      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
+      startupProbe:
+        enabled: true
+        failureThreshold: 600 # 10 minutes
+
+      # Resources for the sidecar.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: 2000m
+          memory: 1024Mi
+
+      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
+      statusPort: 15020
+
+      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
+      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
+      tracer: "none"
+
+    proxy_init:
+      # Base name for the proxy_init container, used to configure iptables.
+      image: proxyv2
+      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
+      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
+      forceApplyIptables: false
+
+    # configure remote pilot and istiod service and endpoint
+    remotePilotAddress: ""
+
+    ##############################################################################################
+    # The following values are found in other charts. To effectively modify these values, make   #
+    # make sure they are consistent across your Istio helm charts                                #
+    ##############################################################################################
+
+    # The customized CA address to retrieve certificates for the pods in the cluster.
+    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+    # If not set explicitly, default to the Istio discovery address.
+    caAddress: ""
+
+    # Enable control of remote clusters.
+    externalIstiod: false
+
+    # Configure a remote cluster as the config cluster for an external istiod.
+    configCluster: false
+
+    # configValidation enables the validation webhook for Istio configuration.
+    configValidation: true
+
+    # Mesh ID means Mesh Identifier. It should be unique within the scope where
+    # meshes will interact with each other, but it is not required to be
+    # globally/universally unique. For example, if any of the following are true,
+    # then two meshes must have different Mesh IDs:
+    # - Meshes will have their telemetry aggregated in one place
+    # - Meshes will be federated together
+    # - Policy will be written referencing one mesh from the other
+    #
+    # If an administrator expects that any of these conditions may become true in
+    # the future, they should ensure their meshes have different Mesh IDs
+    # assigned.
+    #
+    # Within a multicluster mesh, each cluster must be (manually or auto)
+    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
+    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
+    # of migration TBD, and it may be a disruptive operation to change the Mesh
+    # ID post-install.
+    #
+    # If the mesh admin does not specify a value, Istio will use the value of the
+    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
+    # value.
+    meshID: ""
+
+    # Configure the mesh networks to be used by the Split Horizon EDS.
+    #
+    # The following example defines two networks with different endpoints association methods.
+    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
+    # mapped to network1. The gateway for this network example is specified by its public IP
+    # address and port.
+    # The second network, `network2`, in this example is defined differently with all endpoints
+    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
+    # gateway is also defined differently with the name of the gateway service on the remote
+    # cluster. The public IP for the gateway will be determined from that remote service (only
+    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
+    # it still need to be configured manually).
+    #
+    # meshNetworks:
+    #   network1:
+    #     endpoints:
+    #     - fromCidr: "192.168.0.1/24"
+    #     gateways:
+    #     - address: 1.1.1.1
+    #       port: 80
+    #   network2:
+    #     endpoints:
+    #     - fromRegistry: reg1
+    #     gateways:
+    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
+    #       port: 443
+    #
+    meshNetworks: {}
+
+    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
+    mountMtlsCerts: false
+
+    multiCluster:
+      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
+      # to properly label proxies
+      clusterName: ""
+
+    # Network defines the network this cluster belong to. This name
+    # corresponds to the networks in the map of mesh networks.
+    network: ""
+
+    # Configure the certificate provider for control plane communication.
+    # Currently, two providers are supported: "kubernetes" and "istiod".
+    # As some platforms may not have kubernetes signing APIs,
+    # Istiod is the default
+    pilotCertProvider: istiod
+
+    sds:
+      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
+      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
+      # JWT is intended for the CA.
+      token:
+        aud: istio-ca
+
+    sts:
+      # The service port used by Security Token Service (STS) server to handle token exchange requests.
+      # Setting this port to a non-zero value enables STS server.
+      servicePort: 0
+
+    # The name of the CA for workload certificates.
+    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
+    # will be used as the certificates for workloads.
+    # The default value is "" and when caName="", the CA will be configured by other
+    # mechanisms (e.g., environmental variable CA_PROVIDER).
+    caName: ""
+
+    waypoint:
+      # Resources for the waypoint proxy.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: "2"
+          memory: 1Gi
+
+      # If specified, affinity defines the scheduling constraints of waypoint pods.
+      affinity: {}
+
+      # Topology Spread Constraints for the waypoint proxy.
+      topologySpreadConstraints: []
+
+      # Node labels for the waypoint proxy.
+      nodeSelector: {}
+
+      # Tolerations for the waypoint proxy.
+      tolerations: []
+
+  base:
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  # Gateway Settings
+  gateways:
+    # Define the security context for the pod.
+    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+    securityContext: {}
+
+    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
+    seccompProfile: {}
+
+  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
+  # For example:
+  # gatewayClasses:
+  #   istio:
+  #     service:
+  #       spec:
+  #         type: ClusterIP
+  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
+  gatewayClasses: {}
+  
+  pdb:
+    # -- Minimum available pods set in PodDisruptionBudget.
+    # Define either 'minAvailable' or 'maxUnavailable', never both.
+    minAvailable: 1
+    # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
+    # maxUnavailable: 1
+    # -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.
+    # Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/
+    unhealthyPodEvictionPolicy: ""
diff --git a/resources/v1.28.0/charts/revisiontags/Chart.yaml b/resources/v1.28.0/charts/revisiontags/Chart.yaml
new file mode 100644
index 000000000..b7b663e5b
--- /dev/null
+++ b/resources/v1.28.0/charts/revisiontags/Chart.yaml
@@ -0,0 +1,8 @@
+apiVersion: v2
+appVersion: 1.28.0
+description: Helm chart for istio revision tags
+name: revisiontags
+sources:
+- https://github.com/istio-ecosystem/sail-operator
+version: 0.1.0
+
diff --git a/resources/v1.28.0/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.28.0/charts/revisiontags/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.28.0/charts/revisiontags/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-compatibility-version-1.25.yaml b/resources/v1.28.0/charts/revisiontags/files/profile-compatibility-version-1.25.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-compatibility-version-1.25.yaml
rename to resources/v1.28.0/charts/revisiontags/files/profile-compatibility-version-1.25.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-compatibility-version-1.26.yaml b/resources/v1.28.0/charts/revisiontags/files/profile-compatibility-version-1.26.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-compatibility-version-1.26.yaml
rename to resources/v1.28.0/charts/revisiontags/files/profile-compatibility-version-1.26.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-compatibility-version-1.27.yaml b/resources/v1.28.0/charts/revisiontags/files/profile-compatibility-version-1.27.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-compatibility-version-1.27.yaml
rename to resources/v1.28.0/charts/revisiontags/files/profile-compatibility-version-1.27.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-demo.yaml b/resources/v1.28.0/charts/revisiontags/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-demo.yaml
rename to resources/v1.28.0/charts/revisiontags/files/profile-demo.yaml
diff --git a/resources/v1.28.0/charts/revisiontags/files/profile-platform-gke.yaml b/resources/v1.28.0/charts/revisiontags/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.28.0/charts/revisiontags/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.5/charts/revisiontags/files/profile-platform-k3d.yaml b/resources/v1.28.0/charts/revisiontags/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.5/charts/revisiontags/files/profile-platform-k3d.yaml
rename to resources/v1.28.0/charts/revisiontags/files/profile-platform-k3d.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-k3s.yaml b/resources/v1.28.0/charts/revisiontags/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/revisiontags/files/profile-platform-k3s.yaml
rename to resources/v1.28.0/charts/revisiontags/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.5/charts/revisiontags/files/profile-platform-microk8s.yaml b/resources/v1.28.0/charts/revisiontags/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.5/charts/revisiontags/files/profile-platform-microk8s.yaml
rename to resources/v1.28.0/charts/revisiontags/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.5/charts/revisiontags/files/profile-platform-minikube.yaml b/resources/v1.28.0/charts/revisiontags/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.5/charts/revisiontags/files/profile-platform-minikube.yaml
rename to resources/v1.28.0/charts/revisiontags/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.5/charts/revisiontags/files/profile-platform-openshift.yaml b/resources/v1.28.0/charts/revisiontags/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.5/charts/revisiontags/files/profile-platform-openshift.yaml
rename to resources/v1.28.0/charts/revisiontags/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.5/charts/revisiontags/files/profile-preview.yaml b/resources/v1.28.0/charts/revisiontags/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.5/charts/revisiontags/files/profile-preview.yaml
rename to resources/v1.28.0/charts/revisiontags/files/profile-preview.yaml
diff --git a/resources/v1.24.5/charts/revisiontags/files/profile-remote.yaml b/resources/v1.28.0/charts/revisiontags/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.5/charts/revisiontags/files/profile-remote.yaml
rename to resources/v1.28.0/charts/revisiontags/files/profile-remote.yaml
diff --git a/resources/v1.24.5/charts/revisiontags/files/profile-stable.yaml b/resources/v1.28.0/charts/revisiontags/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.5/charts/revisiontags/files/profile-stable.yaml
rename to resources/v1.28.0/charts/revisiontags/files/profile-stable.yaml
diff --git a/resources/v1.28.0/charts/revisiontags/templates/revision-tags-mwc.yaml b/resources/v1.28.0/charts/revisiontags/templates/revision-tags-mwc.yaml
new file mode 100644
index 000000000..556bb2f1e
--- /dev/null
+++ b/resources/v1.28.0/charts/revisiontags/templates/revision-tags-mwc.yaml
@@ -0,0 +1,154 @@
+# Adapted from istio-discovery/templates/mutatingwebhook.yaml
+# Removed paths for legacy and default selectors since a revision tag
+# is inherently created from a specific revision
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- $whv := dict
+"revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "caBundle" .Values.istiodRemote.injectionCABundle
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+{{- if not .Values.global.operatorManageWebhooks }}
+{{- range $tagName := $.Values.revisionTags }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq $.Release.Namespace "istio-system"}}
+  name: istio-revision-tag-{{ $tagName }}
+{{- else }}
+  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/tag: {{ $tagName }}
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+
+{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
+{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
+{{- if (eq $tagName "default") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/revisiontags/templates/revision-tags-svc.yaml b/resources/v1.28.0/charts/revisiontags/templates/revision-tags-svc.yaml
new file mode 100644
index 000000000..5c4826d23
--- /dev/null
+++ b/resources/v1.28.0/charts/revisiontags/templates/revision-tags-svc.yaml
@@ -0,0 +1,57 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Adapted from istio-discovery/templates/service.yaml
+{{- range $tagName := .Values.revisionTags }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: istiod-revision-tag-{{ $tagName }}
+  namespace: {{ $.Release.Namespace }}
+  {{- if $.Values.serviceAnnotations }}
+  annotations:
+{{ toYaml $.Values.serviceAnnotations | indent 4 }}
+  {{- end }}
+  labels:
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    istio.io/tag: {{ $tagName }}
+    operator.istio.io/component: "Pilot"
+    app: istiod
+    istio: pilot
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+spec:
+  ports:
+    - port: 15010
+      name: grpc-xds # plaintext
+      protocol: TCP
+    - port: 15012
+      name: https-dns # mTLS with k8s-signed cert
+      protocol: TCP
+    - port: 443
+      name: https-webhook # validation and injection
+      targetPort: 15017
+      protocol: TCP
+    - port: 15014
+      name: http-monitoring # prometheus stats
+      protocol: TCP
+  selector:
+    app: istiod
+    {{- if ne $.Values.revision "" }}
+    istio.io/rev: {{ $.Values.revision | quote }}
+    {{- else }}
+    # Label used by the 'default' service. For versioned deployments we match with app and version.
+    # This avoids default deployment picking the canary
+    istio: pilot
+    {{- end }}
+  {{- if $.Values.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ $.Values.ipFamilyPolicy }}
+  {{- end }}
+  {{- if $.Values.ipFamilies }}
+  ipFamilies:
+  {{- range $.Values.ipFamilies }}
+  - {{ . }}
+  {{- end }}
+  {{- end }}
+---
+{{- end -}}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.28.0/charts/revisiontags/templates/zzz_profile.yaml
new file mode 100644
index 000000000..3d8495648
--- /dev/null
+++ b/resources/v1.28.0/charts/revisiontags/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if false }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.28.0/charts/revisiontags/values.yaml b/resources/v1.28.0/charts/revisiontags/values.yaml
new file mode 100644
index 000000000..1a28f3853
--- /dev/null
+++ b/resources/v1.28.0/charts/revisiontags/values.yaml
@@ -0,0 +1,583 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  autoscaleBehavior: {}
+  replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+
+  hub: ""
+  tag: ""
+  variant: ""
+
+  # Can be a full hub/image:tag
+  image: pilot
+  traceSampling: 1.0
+
+  # Resources for a small pilot install
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2048Mi
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # Whether to use an existing CNI installation
+  cni:
+    enabled: false
+    provider: default
+
+  # Additional container arguments
+  extraContainerArgs: []
+
+  env: {}
+
+  envVarFrom: []
+
+  # Settings related to the untaint controller
+  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
+  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
+  taint:
+    # Controls whether or not the untaint controller is active
+    enabled: false
+    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
+    namespace: ""
+
+  affinity: {}
+
+  tolerations: []
+
+  cpu:
+    targetAverageUtilization: 80
+  memory: {}
+    # targetAverageUtilization: 80
+
+  # Additional volumeMounts to the istiod container
+  volumeMounts: []
+
+  # Additional volumes to the istiod pod
+  volumes: []
+
+  # Inject initContainers into the istiod pod
+  initContainers: []
+
+  nodeSelector: {}
+  podAnnotations: {}
+  serviceAnnotations: {}
+  serviceAccountAnnotations: {}
+  sidecarInjectorWebhookAnnotations: {}
+
+  topologySpreadConstraints: []
+
+  # You can use jwksResolverExtraRootCA to provide a root certificate
+  # in PEM format. This will then be trusted by pilot when resolving
+  # JWKS URIs.
+  jwksResolverExtraRootCA: ""
+
+  # The following is used to limit how long a sidecar can be connected
+  # to a pilot. It balances out load across pilot instances at the cost of
+  # increasing system churn.
+  keepaliveMaxServerConnectionAge: 30m
+
+  # Additional labels to apply to the deployment.
+  deploymentLabels: {}
+
+  # Annotations to apply to the istiod deployment.
+  deploymentAnnotations: {}
+
+  ## Mesh config settings
+
+  # Install the mesh config map, generated from values.yaml.
+  # If false, pilot wil use default values (by default) or user-supplied values.
+  configMap: true
+
+  # Additional labels to apply on the pod level for monitoring and logging configuration.
+  podLabels: {}
+
+  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
+  ipFamilyPolicy: ""
+  ipFamilies: []
+
+  # Ambient mode only.
+  # Set this if you install ztunnel to a different namespace from `istiod`.
+  # If set, `istiod` will allow connections from trusted node proxy ztunnels
+  # in the provided namespace.
+  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
+  # in the same namespace as itself.
+  trustedZtunnelNamespace: ""
+  # Set this if you install ztunnel with a name different from the default.
+  trustedZtunnelName: ""
+
+  sidecarInjectorWebhook:
+    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
+    # always skip the injection on pods that match that label selector, regardless of the global policy.
+    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
+    neverInjectSelector: []
+    alwaysInjectSelector: []
+
+    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
+    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
+    #
+    # annotations:
+    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+    #
+    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
+    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
+    # injectedAnnotations:
+    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
+    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
+    injectedAnnotations: {}
+
+    # This enables injection of sidecar in all namespaces,
+    # with the exception of namespaces with "istio-injection:disabled" annotation
+    # Only one environment should have this enabled.
+    enableNamespacesByDefault: false
+
+    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
+    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
+    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
+    reinvocationPolicy: Never
+
+    rewriteAppHTTPProbe: true
+
+    # Templates defines a set of custom injection templates that can be used. For example, defining:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
+    # being injected with the hello=world labels.
+    # This is intended for advanced configuration only; most users should use the built in template
+    templates: {}
+
+    # Default templates specifies a set of default templates that are used in sidecar injection.
+    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
+    # To inject other additional templates, define it using the `templates` option, and add it to
+    # the default templates list.
+    # For example:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # defaultTemplates: ["sidecar", "hello"]
+    defaultTemplates: []
+  istiodRemote:
+    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
+    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
+    # to utilize a remote instance.
+    enabled: false
+
+    # If `true`, indicates that this cluster/install should consume a "local istiod" installation,
+    # local istiod inject sidecars
+    enabledLocalInjectorIstiod: false
+
+    # Sidecar injector mutating webhook configuration clientConfig.url value.
+    # For example: https://$remotePilotAddress:15017/inject
+    # The host should not refer to a service running in the cluster; use a service reference by specifying
+    # the clientConfig.service field instead.
+    injectionURL: ""
+
+    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
+    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
+    injectionPath: "/inject"
+
+    injectionCABundle: ""
+  telemetry:
+    enabled: true
+    v2:
+      # For Null VM case now.
+      # This also enables metadata exchange.
+      enabled: true
+      # Indicate if prometheus stats filter is enabled or not
+      prometheus:
+        enabled: true
+      # stackdriver filter settings.
+      stackdriver:
+        enabled: false
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # Revision tags are aliases to Istio control plane revisions
+  revisionTags: []
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
+  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
+  meshConfig:
+    enablePrometheusMerge: true
+
+  experimental:
+    stableValidationPolicy: false
+
+  global:
+    # Used to locate istiod.
+    istioNamespace: istio-system
+    # List of cert-signers to allow "approve" action in the istio cluster role
+    #
+    # certSigners:
+    #   - clusterissuers.cert-manager.io/istio-ca
+    certSigners: []
+    # enable pod disruption budget for the control plane, which is used to
+    # ensure Istio control plane components are gradually upgraded or recovered.
+    defaultPodDisruptionBudget:
+      enabled: true
+      # The values aren't mutable due to a current PodDisruptionBudget limitation
+      # minAvailable: 1
+
+    # A minimal set of requested resources to applied to all deployments so that
+    # Horizontal Pod Autoscaler will be able to function (if set).
+    # Each component can overwrite these default values by adding its own resources
+    # block in the relevant section below and setting the desired resources values.
+    defaultResources:
+      requests:
+        cpu: 10m
+      #   memory: 128Mi
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-release
+    # Default tag for Istio images.
+    tag: 1.28.0
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Enabled by default in master for maximising testing.
+    istiod:
+      enableAnalysis: false
+
+    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
+    logAsJson: false
+
+    # In order to use native nftable rules instead of iptable rules, set this flag to true.
+    nativeNftables: false
+
+    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+    # The control plane has different scopes depending on component, but can configure default log level across all components
+    # If empty, default scope and level will be used as configured in code
+    logging:
+      level: "default:info"
+
+    # When enabled, default NetworkPolicy resources will be created
+    networkPolicy:
+      enabled: false
+
+    omitSidecarInjectorConfigMap: false
+
+    # resourceScope controls what resources will be processed by helm.
+    # This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
+    # It can be one of:
+    # - all: all resources are processed
+    # - cluster: only cluster-scoped resources are processed
+    # - namespace: only namespace-scoped resources are processed
+    resourceScope: all
+
+    # Configure whether Operator manages webhook configurations. The current behavior
+    # of Istiod is to manage its own webhook configurations.
+    # When this option is set as true, Istio Operator, instead of webhooks, manages the
+    # webhook configurations. When this option is set as false, webhooks manage their
+    # own webhook configurations.
+    operatorManageWebhooks: false
+
+    # Custom DNS config for the pod to resolve names of services in other
+    # clusters. Use this to add additional search domains, and other settings.
+    # see
+    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
+    # This does not apply to gateway pods as they typically need a different
+    # set of DNS settings than the normal application pods (e.g., in
+    # multicluster scenarios).
+    # NOTE: If using templates, follow the pattern in the commented example below.
+    #podDNSSearchNamespaces:
+    #- global
+    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
+
+    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
+    # system-node-critical, it is better to configure this in order to make sure your Istio pods
+    # will not be killed because of low priority class.
+    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+    # for more detail.
+    priorityClassName: ""
+
+    proxy:
+      image: proxyv2
+
+      # This controls the 'policy' in the sidecar injector.
+      autoInject: enabled
+
+      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
+      # cluster domain. Default value is "cluster.local".
+      clusterDomain: "cluster.local"
+
+      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
+      # not set, then the global "logLevel" will be used.
+      componentLogLevel: "misc:error"
+
+      # istio ingress capture allowlist
+      # examples:
+      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
+      excludeInboundPorts: ""
+      includeInboundPorts: "*"
+
+      # istio egress capture allowlist
+      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
+      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
+      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
+      # be allowed by the sidecar
+      includeIPRanges: "*"
+      excludeIPRanges: ""
+      includeOutboundPorts: ""
+      excludeOutboundPorts: ""
+
+      # Log level for proxy, applies to gateways and sidecars.
+      # Expected values are: trace|debug|info|warning|error|critical|off
+      logLevel: warning
+
+      # Specify the path to the outlier event log.
+      # Example: /dev/stdout
+      outlierLogPath: ""
+
+      #If set to true, istio-proxy container will have privileged securityContext
+      privileged: false
+      
+      seccompProfile: {}
+
+      # The number of successive failed probes before indicating readiness failure.
+      readinessFailureThreshold: 4
+
+      # The initial delay for readiness probes in seconds.
+      readinessInitialDelaySeconds: 0
+
+      # The period between readiness probes.
+      readinessPeriodSeconds: 15
+
+      # Enables or disables a startup probe.
+      # For optimal startup times, changing this should be tied to the readiness probe values.
+      #
+      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
+      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
+      # and doesn't spam the readiness endpoint too much
+      #
+      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
+      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
+      startupProbe:
+        enabled: true
+        failureThreshold: 600 # 10 minutes
+
+      # Resources for the sidecar.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: 2000m
+          memory: 1024Mi
+
+      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
+      statusPort: 15020
+
+      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
+      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
+      tracer: "none"
+
+    proxy_init:
+      # Base name for the proxy_init container, used to configure iptables.
+      image: proxyv2
+      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
+      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
+      forceApplyIptables: false
+
+    # configure remote pilot and istiod service and endpoint
+    remotePilotAddress: ""
+
+    ##############################################################################################
+    # The following values are found in other charts. To effectively modify these values, make   #
+    # make sure they are consistent across your Istio helm charts                                #
+    ##############################################################################################
+
+    # The customized CA address to retrieve certificates for the pods in the cluster.
+    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+    # If not set explicitly, default to the Istio discovery address.
+    caAddress: ""
+
+    # Enable control of remote clusters.
+    externalIstiod: false
+
+    # Configure a remote cluster as the config cluster for an external istiod.
+    configCluster: false
+
+    # configValidation enables the validation webhook for Istio configuration.
+    configValidation: true
+
+    # Mesh ID means Mesh Identifier. It should be unique within the scope where
+    # meshes will interact with each other, but it is not required to be
+    # globally/universally unique. For example, if any of the following are true,
+    # then two meshes must have different Mesh IDs:
+    # - Meshes will have their telemetry aggregated in one place
+    # - Meshes will be federated together
+    # - Policy will be written referencing one mesh from the other
+    #
+    # If an administrator expects that any of these conditions may become true in
+    # the future, they should ensure their meshes have different Mesh IDs
+    # assigned.
+    #
+    # Within a multicluster mesh, each cluster must be (manually or auto)
+    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
+    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
+    # of migration TBD, and it may be a disruptive operation to change the Mesh
+    # ID post-install.
+    #
+    # If the mesh admin does not specify a value, Istio will use the value of the
+    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
+    # value.
+    meshID: ""
+
+    # Configure the mesh networks to be used by the Split Horizon EDS.
+    #
+    # The following example defines two networks with different endpoints association methods.
+    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
+    # mapped to network1. The gateway for this network example is specified by its public IP
+    # address and port.
+    # The second network, `network2`, in this example is defined differently with all endpoints
+    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
+    # gateway is also defined differently with the name of the gateway service on the remote
+    # cluster. The public IP for the gateway will be determined from that remote service (only
+    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
+    # it still need to be configured manually).
+    #
+    # meshNetworks:
+    #   network1:
+    #     endpoints:
+    #     - fromCidr: "192.168.0.1/24"
+    #     gateways:
+    #     - address: 1.1.1.1
+    #       port: 80
+    #   network2:
+    #     endpoints:
+    #     - fromRegistry: reg1
+    #     gateways:
+    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
+    #       port: 443
+    #
+    meshNetworks: {}
+
+    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
+    mountMtlsCerts: false
+
+    multiCluster:
+      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
+      # to properly label proxies
+      clusterName: ""
+
+    # Network defines the network this cluster belong to. This name
+    # corresponds to the networks in the map of mesh networks.
+    network: ""
+
+    # Configure the certificate provider for control plane communication.
+    # Currently, two providers are supported: "kubernetes" and "istiod".
+    # As some platforms may not have kubernetes signing APIs,
+    # Istiod is the default
+    pilotCertProvider: istiod
+
+    sds:
+      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
+      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
+      # JWT is intended for the CA.
+      token:
+        aud: istio-ca
+
+    sts:
+      # The service port used by Security Token Service (STS) server to handle token exchange requests.
+      # Setting this port to a non-zero value enables STS server.
+      servicePort: 0
+
+    # The name of the CA for workload certificates.
+    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
+    # will be used as the certificates for workloads.
+    # The default value is "" and when caName="", the CA will be configured by other
+    # mechanisms (e.g., environmental variable CA_PROVIDER).
+    caName: ""
+
+    waypoint:
+      # Resources for the waypoint proxy.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: "2"
+          memory: 1Gi
+
+      # If specified, affinity defines the scheduling constraints of waypoint pods.
+      affinity: {}
+
+      # Topology Spread Constraints for the waypoint proxy.
+      topologySpreadConstraints: []
+
+      # Node labels for the waypoint proxy.
+      nodeSelector: {}
+
+      # Tolerations for the waypoint proxy.
+      tolerations: []
+
+  base:
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  # Gateway Settings
+  gateways:
+    # Define the security context for the pod.
+    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+    securityContext: {}
+
+    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
+    seccompProfile: {}
+
+  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
+  # For example:
+  # gatewayClasses:
+  #   istio:
+  #     service:
+  #       spec:
+  #         type: ClusterIP
+  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
+  gatewayClasses: {}
+  
+  pdb:
+    # -- Minimum available pods set in PodDisruptionBudget.
+    # Define either 'minAvailable' or 'maxUnavailable', never both.
+    minAvailable: 1
+    # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
+    # maxUnavailable: 1
+    # -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.
+    # Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/
+    unhealthyPodEvictionPolicy: ""
diff --git a/resources/v1.28.0/charts/ztunnel/Chart.yaml b/resources/v1.28.0/charts/ztunnel/Chart.yaml
new file mode 100644
index 000000000..00f9bcda3
--- /dev/null
+++ b/resources/v1.28.0/charts/ztunnel/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+appVersion: 1.28.0
+description: Helm chart for istio ztunnel components
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio-ztunnel
+- istio
+name: ztunnel
+sources:
+- https://github.com/istio/istio
+version: 1.28.0
diff --git a/resources/v1.28.0/charts/ztunnel/README.md b/resources/v1.28.0/charts/ztunnel/README.md
new file mode 100644
index 000000000..72ea6892e
--- /dev/null
+++ b/resources/v1.28.0/charts/ztunnel/README.md
@@ -0,0 +1,50 @@
+# Istio Ztunnel Helm Chart
+
+This chart installs an Istio ztunnel.
+
+## Setup Repo Info
+
+```console
+helm repo add istio https://istio-release.storage.googleapis.com/charts
+helm repo update
+```
+
+_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
+
+## Installing the Chart
+
+To install the chart:
+
+```console
+helm install ztunnel istio/ztunnel
+```
+
+## Uninstalling the Chart
+
+To uninstall/delete the chart:
+
+```console
+helm delete ztunnel
+```
+
+## Configuration
+
+To view supported configuration options and documentation, run:
+
+```console
+helm show values istio/ztunnel
+```
+
+### Profiles
+
+Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
+These can be set with `--set profile=<profile>`.
+For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
+
+For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
+
+Explicitly set values have highest priority, then profile settings, then chart defaults.
+
+As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
+When configuring the chart, you should not include this.
+That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.28.0/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.28.0/charts/ztunnel/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.28.0/charts/ztunnel/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-compatibility-version-1.25.yaml b/resources/v1.28.0/charts/ztunnel/files/profile-compatibility-version-1.25.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-compatibility-version-1.25.yaml
rename to resources/v1.28.0/charts/ztunnel/files/profile-compatibility-version-1.25.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-compatibility-version-1.26.yaml b/resources/v1.28.0/charts/ztunnel/files/profile-compatibility-version-1.26.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-compatibility-version-1.26.yaml
rename to resources/v1.28.0/charts/ztunnel/files/profile-compatibility-version-1.26.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-compatibility-version-1.27.yaml b/resources/v1.28.0/charts/ztunnel/files/profile-compatibility-version-1.27.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-compatibility-version-1.27.yaml
rename to resources/v1.28.0/charts/ztunnel/files/profile-compatibility-version-1.27.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-demo.yaml b/resources/v1.28.0/charts/ztunnel/files/profile-demo.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-demo.yaml
rename to resources/v1.28.0/charts/ztunnel/files/profile-demo.yaml
diff --git a/resources/v1.28.0/charts/ztunnel/files/profile-platform-gke.yaml b/resources/v1.28.0/charts/ztunnel/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.28.0/charts/ztunnel/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.5/charts/ztunnel/files/profile-platform-k3d.yaml b/resources/v1.28.0/charts/ztunnel/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.5/charts/ztunnel/files/profile-platform-k3d.yaml
rename to resources/v1.28.0/charts/ztunnel/files/profile-platform-k3d.yaml
diff --git a/resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-k3s.yaml b/resources/v1.28.0/charts/ztunnel/files/profile-platform-k3s.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/charts/ztunnel/files/profile-platform-k3s.yaml
rename to resources/v1.28.0/charts/ztunnel/files/profile-platform-k3s.yaml
diff --git a/resources/v1.24.5/charts/ztunnel/files/profile-platform-microk8s.yaml b/resources/v1.28.0/charts/ztunnel/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.5/charts/ztunnel/files/profile-platform-microk8s.yaml
rename to resources/v1.28.0/charts/ztunnel/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.5/charts/ztunnel/files/profile-platform-minikube.yaml b/resources/v1.28.0/charts/ztunnel/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.5/charts/ztunnel/files/profile-platform-minikube.yaml
rename to resources/v1.28.0/charts/ztunnel/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.5/charts/ztunnel/files/profile-platform-openshift.yaml b/resources/v1.28.0/charts/ztunnel/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.5/charts/ztunnel/files/profile-platform-openshift.yaml
rename to resources/v1.28.0/charts/ztunnel/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.5/charts/ztunnel/files/profile-preview.yaml b/resources/v1.28.0/charts/ztunnel/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.5/charts/ztunnel/files/profile-preview.yaml
rename to resources/v1.28.0/charts/ztunnel/files/profile-preview.yaml
diff --git a/resources/v1.24.5/charts/ztunnel/files/profile-remote.yaml b/resources/v1.28.0/charts/ztunnel/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.5/charts/ztunnel/files/profile-remote.yaml
rename to resources/v1.28.0/charts/ztunnel/files/profile-remote.yaml
diff --git a/resources/v1.24.5/charts/ztunnel/files/profile-stable.yaml b/resources/v1.28.0/charts/ztunnel/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.5/charts/ztunnel/files/profile-stable.yaml
rename to resources/v1.28.0/charts/ztunnel/files/profile-stable.yaml
diff --git a/resources/v1.24.5/charts/ztunnel/templates/NOTES.txt b/resources/v1.28.0/charts/ztunnel/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.5/charts/ztunnel/templates/NOTES.txt
rename to resources/v1.28.0/charts/ztunnel/templates/NOTES.txt
diff --git a/resources/v1.28.0/charts/ztunnel/templates/_helpers.tpl b/resources/v1.28.0/charts/ztunnel/templates/_helpers.tpl
new file mode 100644
index 000000000..46a7a0b79
--- /dev/null
+++ b/resources/v1.28.0/charts/ztunnel/templates/_helpers.tpl
@@ -0,0 +1 @@
+{{ define "ztunnel.release-name" }}{{ .Values.resourceName| default "ztunnel" }}{{ end }}
diff --git a/resources/v1.28.0/charts/ztunnel/templates/daemonset.yaml b/resources/v1.28.0/charts/ztunnel/templates/daemonset.yaml
new file mode 100644
index 000000000..b10e99cfa
--- /dev/null
+++ b/resources/v1.28.0/charts/ztunnel/templates/daemonset.yaml
@@ -0,0 +1,212 @@
+{{- if or (eq .Values.resourceScope "all") (eq .Values.resourceScope "namespace") }}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
+  annotations:
+{{- if .Values.revision }}
+    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
+    {{- toYaml $annos | nindent 4}}
+{{- else }}
+    {{- .Values.annotations | toYaml | nindent 4 }}
+{{- end }}
+spec:
+  {{- with .Values.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app: ztunnel
+  template:
+    metadata:
+      labels:
+        sidecar.istio.io/inject: "false"
+        istio.io/dataplane-mode: none
+        app: ztunnel
+        app.kubernetes.io/name: ztunnel
+        {{- include "istio.labels" . | nindent 8}}
+{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+{{- if .Values.revision }}
+        istio.io/rev: {{ .Values.revision }}
+{{- end }}
+{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
+    spec:
+      nodeSelector:
+        kubernetes.io/os: linux
+{{- if .Values.nodeSelector }}
+{{ toYaml .Values.nodeSelector | indent 8 }}
+{{- end }}
+{{- if .Values.affinity }}
+      affinity:
+{{ toYaml .Values.affinity | trim | indent 8 }}
+{{- end }}
+      serviceAccountName: {{ include "ztunnel.release-name" . }}
+{{- if .Values.tolerations }}
+      tolerations:
+{{ toYaml .Values.tolerations | trim | indent 8 }}
+{{- end }}
+      containers:
+      - name: istio-proxy
+{{- if contains "/" .Values.image }}
+        image: "{{ .Values.image }}"
+{{- else }}
+        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
+{{- end }}
+        ports:
+        - containerPort: 15020
+          name: ztunnel-stats
+          protocol: TCP
+        resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 10 }}
+{{- end }}
+{{- with .Values.imagePullPolicy }}
+        imagePullPolicy: {{ . }}
+{{- end }}
+        securityContext:
+          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
+          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
+          allowPrivilegeEscalation: true
+          privileged: false
+          capabilities:
+            drop:
+            - ALL
+            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
+            - NET_ADMIN # Required for TPROXY and setsockopt
+            - SYS_ADMIN # Required for `setns` - doing things in other netns
+            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
+          readOnlyRootFilesystem: true
+          runAsGroup: 1337
+          runAsNonRoot: false
+          runAsUser: 0
+{{- if .Values.seLinuxOptions }}
+          seLinuxOptions:
+{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
+{{- end }}
+        readinessProbe:
+          httpGet:
+            port: 15021
+            path: /healthz/ready
+        args:
+        - proxy
+        - ztunnel
+        env:
+        - name: CA_ADDRESS
+        {{- if .Values.caAddress }}
+          value: {{ .Values.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: XDS_ADDRESS
+        {{- if .Values.xdsAddress }}
+          value: {{ .Values.xdsAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
+        {{- end }}
+        {{- if .Values.logAsJson }}
+        - name: LOG_FORMAT
+          value: json
+        {{- end}}
+        {{- if .Values.network }}
+        - name: NETWORK
+          value: {{ .Values.network | quote }}
+        {{- end }}
+        - name: RUST_LOG
+          value: {{ .Values.logLevel | quote }}
+        - name: RUST_BACKTRACE
+          value: "1"
+        - name: ISTIO_META_CLUSTER_ID
+          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
+        - name: INPOD_ENABLED
+          value: "true"
+        - name: TERMINATION_GRACE_PERIOD_SECONDS
+          value: "{{ .Values.terminationGracePeriodSeconds }}"
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
+        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- end }}
+        - name: ZTUNNEL_CPU_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+        {{- with .Values.env }}
+        {{- range $key, $val := . }}
+        - name: {{ $key }}
+          value: "{{ $val }}"
+        {{- end }}
+        {{- end }}
+        volumeMounts:
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - mountPath: /var/run/ztunnel
+          name: cni-ztunnel-sock-dir
+        - mountPath: /tmp
+          name: tmp
+        {{- with .Values.volumeMounts }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+      priorityClassName: system-node-critical
+      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
+      volumes:
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: istio-token
+              expirationSeconds: 43200
+              audience: istio-ca
+      - name: istiod-ca-cert
+        {{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:{{ .Values.trustBundleName | default "root-cert" }}
+              path: root-cert.pem
+        {{- else }}
+        configMap:
+          name: {{ .Values.trustBundleName | default "istio-ca-root-cert" }}
+        {{- end }}
+      - name: cni-ztunnel-sock-dir
+        hostPath:
+          path: /var/run/ztunnel
+          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
+      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
+      - name: tmp
+        emptyDir: {}
+      {{- with .Values.volumes }}
+        {{- toYaml . | nindent 6}}
+      {{- end }}
+{{- end }}
diff --git a/resources/v1.28.0/charts/ztunnel/templates/rbac.yaml b/resources/v1.28.0/charts/ztunnel/templates/rbac.yaml
new file mode 100644
index 000000000..18291716b
--- /dev/null
+++ b/resources/v1.28.0/charts/ztunnel/templates/rbac.yaml
@@ -0,0 +1,51 @@
+{{- if or (eq .Values.resourceScope "all") (eq .Values.resourceScope "cluster") }}
+{{- if (eq (.Values.platform | default "") "openshift") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  labels:
+    app: ztunnel
+    release: {{ include "ztunnel.release-name" . }}
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+  annotations:
+{{- if .Values.revision }}
+    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
+    {{- toYaml $annos | nindent 4}}
+{{- else }}
+    {{- .Values.annotations | toYaml | nindent 4 }}
+{{- end }}
+rules:
+- apiGroups: ["security.openshift.io"]
+  resources: ["securitycontextconstraints"]
+  resourceNames: ["privileged"]
+  verbs: ["use"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  labels:
+    app: ztunnel
+    release: {{ include "ztunnel.release-name" . }}
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+  annotations:
+{{- if .Values.revision }}
+    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
+    {{- toYaml $annos | nindent 4}}
+{{- else }}
+    {{- .Values.annotations | toYaml | nindent 4 }}
+{{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "ztunnel.release-name" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}
+---
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/ztunnel/templates/resourcequota.yaml b/resources/v1.28.0/charts/ztunnel/templates/resourcequota.yaml
new file mode 100644
index 000000000..d33c9fe13
--- /dev/null
+++ b/resources/v1.28.0/charts/ztunnel/templates/resourcequota.yaml
@@ -0,0 +1,22 @@
+{{- if or (eq .Values.resourceScope "all") (eq .Values.resourceScope "namespace") }}
+{{- if .Values.resourceQuotas.enabled }}
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
+spec:
+  hard:
+    pods: {{ .Values.resourceQuotas.pods | quote }}
+  scopeSelector:
+    matchExpressions:
+    - operator: In
+      scopeName: PriorityClass
+      values:
+      - system-node-critical
+{{- end }}
+{{- end }}
diff --git a/resources/v1.28.0/charts/ztunnel/templates/serviceaccount.yaml b/resources/v1.28.0/charts/ztunnel/templates/serviceaccount.yaml
new file mode 100644
index 000000000..e1146f392
--- /dev/null
+++ b/resources/v1.28.0/charts/ztunnel/templates/serviceaccount.yaml
@@ -0,0 +1,24 @@
+{{- if or (eq .Values.resourceScope "all") (eq .Values.resourceScope "namespace") }}
+apiVersion: v1
+kind: ServiceAccount
+  {{- with .Values.imagePullSecrets }}
+imagePullSecrets:
+  {{- range . }}
+  - name: {{ . }}
+  {{- end }}
+  {{- end }}
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
+  annotations:
+{{- if .Values.revision }}
+    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
+    {{- toYaml $annos | nindent 4}}
+{{- else }}
+    {{- .Values.annotations | toYaml | nindent 4 }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.28.0/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.28.0/charts/ztunnel/templates/zzz_profile.yaml
new file mode 100644
index 000000000..606c55669
--- /dev/null
+++ b/resources/v1.28.0/charts/ztunnel/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if true }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.28.0/charts/ztunnel/values.yaml b/resources/v1.28.0/charts/ztunnel/values.yaml
new file mode 100644
index 000000000..21364a58c
--- /dev/null
+++ b/resources/v1.28.0/charts/ztunnel/values.yaml
@@ -0,0 +1,136 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
+  hub: gcr.io/istio-release
+  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
+  tag: 1.28.0
+  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
+  variant: ""
+
+  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
+  # If Image contains a "/", it will replace the entire `image` in the pod.
+  image: ztunnel
+
+  # Same as `global.network`, but will override it if set.
+  # Network defines the network this cluster belong to. This name
+  # corresponds to the networks in the map of mesh networks.
+  network: ""
+
+  # resourceName, if set, will override the naming of resources. If not set, will default to 'ztunnel'.
+  # If you set this, you MUST also set `trustedZtunnelName` in the `istiod` chart.
+  resourceName: ""
+
+  # Labels to apply to all top level resources
+  labels: {}
+  # Annotations to apply to all top level resources
+  annotations: {}
+
+  # Additional volumeMounts to the ztunnel container
+  volumeMounts: []
+
+  # Additional volumes to the ztunnel pod
+  volumes: []
+  
+  # Tolerations for the ztunnel pod
+  tolerations:
+    - effect: NoSchedule
+      operator: Exists
+    - key: CriticalAddonsOnly
+      operator: Exists
+    - effect: NoExecute
+      operator: Exists
+
+  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
+  podAnnotations:
+    prometheus.io/port: "15020"
+    prometheus.io/scrape: "true"
+
+  # Additional labels to apply on the pod level
+  podLabels: {}
+
+  # Pod resource configuration
+  resources:
+    requests:
+      cpu: 200m
+      # Ztunnel memory scales with the size of the cluster and traffic load
+      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
+      memory: 512Mi
+
+  resourceQuotas:
+    enabled: false
+    pods: 5000
+
+  # List of secret names to add to the service account as image pull secrets
+  imagePullSecrets: []
+
+  # A `key: value` mapping of environment variables to add to the pod
+  env: {}
+
+  # Override for the pod imagePullPolicy
+  imagePullPolicy: ""
+
+  # Settings for multicluster
+  multiCluster:
+    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
+    # with Istiod configuration.
+    clusterName: ""
+
+  # meshConfig defines runtime configuration of components.
+  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
+  # components.
+  # TODO: https://github.com/istio/istio/issues/43248
+  meshConfig:
+    defaultConfig:
+      proxyMetadata: {}
+
+  # This value defines:
+  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
+  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
+  # Default K8S value is 30 seconds
+  terminationGracePeriodSeconds: 30
+
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
+  revision: ""
+
+  # The customized CA address to retrieve certificates for the pods in the cluster.
+  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+  caAddress: ""
+
+  # The customized XDS address to retrieve configuration.
+  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
+  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
+  xdsAddress: ""
+
+  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
+  istioNamespace: istio-system
+
+  # Configuration log level of ztunnel binary, default is info.
+  # Valid values are: trace, debug, info, warn, error
+  logLevel: info
+
+  # To output all logs in json format
+  logAsJson: false
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seLinuxOptions: {}
+  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
+  #seLinuxOptions:
+  #  type: spc_t
+  
+  # resourceScope controls what resources will be processed by helm.
+  # This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
+  # It can be one of:
+  # - all: all resources are processed
+  # - cluster: only cluster-scoped resources are processed
+  # - namespace: only namespace-scoped resources are processed
+  resourceScope: all
+
+  # K8s DaemonSet update strategy.
+  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
diff --git a/resources/v1.28.0/cni-1.28.0.tgz.etag b/resources/v1.28.0/cni-1.28.0.tgz.etag
new file mode 100644
index 000000000..9235e27af
--- /dev/null
+++ b/resources/v1.28.0/cni-1.28.0.tgz.etag
@@ -0,0 +1 @@
+1741dd04379cd554e8e6c432bc239a92
diff --git a/resources/v1.28.0/commit b/resources/v1.28.0/commit
new file mode 100644
index 000000000..cfc730712
--- /dev/null
+++ b/resources/v1.28.0/commit
@@ -0,0 +1 @@
+1.28.0
diff --git a/resources/v1.28.0/gateway-1.28.0.tgz.etag b/resources/v1.28.0/gateway-1.28.0.tgz.etag
new file mode 100644
index 000000000..573482ff7
--- /dev/null
+++ b/resources/v1.28.0/gateway-1.28.0.tgz.etag
@@ -0,0 +1 @@
+2cf540e92003b760d6a99370aee68129
diff --git a/resources/v1.28.0/istiod-1.28.0.tgz.etag b/resources/v1.28.0/istiod-1.28.0.tgz.etag
new file mode 100644
index 000000000..540dc3e24
--- /dev/null
+++ b/resources/v1.28.0/istiod-1.28.0.tgz.etag
@@ -0,0 +1 @@
+b0f9abb423e3def023c9371eaef3a172
diff --git a/resources/v1.24.5/profiles/ambient.yaml b/resources/v1.28.0/profiles/ambient.yaml
similarity index 100%
rename from resources/v1.24.5/profiles/ambient.yaml
rename to resources/v1.28.0/profiles/ambient.yaml
diff --git a/resources/v1.28-alpha.724e2360/profiles/default.yaml b/resources/v1.28.0/profiles/default.yaml
similarity index 100%
rename from resources/v1.28-alpha.724e2360/profiles/default.yaml
rename to resources/v1.28.0/profiles/default.yaml
diff --git a/resources/v1.24.5/profiles/demo.yaml b/resources/v1.28.0/profiles/demo.yaml
similarity index 100%
rename from resources/v1.24.5/profiles/demo.yaml
rename to resources/v1.28.0/profiles/demo.yaml
diff --git a/resources/v1.24.5/profiles/empty.yaml b/resources/v1.28.0/profiles/empty.yaml
similarity index 100%
rename from resources/v1.24.5/profiles/empty.yaml
rename to resources/v1.28.0/profiles/empty.yaml
diff --git a/resources/v1.24.5/profiles/openshift-ambient.yaml b/resources/v1.28.0/profiles/openshift-ambient.yaml
similarity index 100%
rename from resources/v1.24.5/profiles/openshift-ambient.yaml
rename to resources/v1.28.0/profiles/openshift-ambient.yaml
diff --git a/resources/v1.24.5/profiles/openshift.yaml b/resources/v1.28.0/profiles/openshift.yaml
similarity index 100%
rename from resources/v1.24.5/profiles/openshift.yaml
rename to resources/v1.28.0/profiles/openshift.yaml
diff --git a/resources/v1.24.5/profiles/preview.yaml b/resources/v1.28.0/profiles/preview.yaml
similarity index 100%
rename from resources/v1.24.5/profiles/preview.yaml
rename to resources/v1.28.0/profiles/preview.yaml
diff --git a/resources/v1.24.5/profiles/remote.yaml b/resources/v1.28.0/profiles/remote.yaml
similarity index 100%
rename from resources/v1.24.5/profiles/remote.yaml
rename to resources/v1.28.0/profiles/remote.yaml
diff --git a/resources/v1.24.5/profiles/stable.yaml b/resources/v1.28.0/profiles/stable.yaml
similarity index 100%
rename from resources/v1.24.5/profiles/stable.yaml
rename to resources/v1.28.0/profiles/stable.yaml
diff --git a/resources/v1.28.0/ztunnel-1.28.0.tgz.etag b/resources/v1.28.0/ztunnel-1.28.0.tgz.etag
new file mode 100644
index 000000000..c8d4ec788
--- /dev/null
+++ b/resources/v1.28.0/ztunnel-1.28.0.tgz.etag
@@ -0,0 +1 @@
+77b68b902c4286f9d8f8814c14aab329
diff --git a/resources/v1.29-alpha.b2f713a9/base-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz.etag b/resources/v1.29-alpha.b2f713a9/base-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz.etag
new file mode 100644
index 000000000..61a65891d
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/base-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz.etag
@@ -0,0 +1 @@
+eb84ad9042a9cfe0e06b095e2eb48344
diff --git a/resources/v1.29-alpha.b2f713a9/charts/base/Chart.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/Chart.yaml
new file mode 100644
index 000000000..530e36f62
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/base/Chart.yaml
@@ -0,0 +1,10 @@
+apiVersion: v2
+appVersion: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+description: Helm chart for deploying Istio cluster resources and CRDs
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+name: base
+sources:
+- https://github.com/istio/istio
+version: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
diff --git a/resources/v1.24.6/charts/base/README.md b/resources/v1.29-alpha.b2f713a9/charts/base/README.md
similarity index 100%
rename from resources/v1.24.6/charts/base/README.md
rename to resources/v1.29-alpha.b2f713a9/charts/base/README.md
diff --git a/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-ambient.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-compatibility-version-1.25.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..3827ee78f
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,16 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+     # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-compatibility-version-1.26.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..b690d25ca
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-compatibility-version-1.27.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-compatibility-version-1.27.yaml
new file mode 100644
index 000000000..9f9ba7b67
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-compatibility-version-1.27.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-compatibility-version-1.28.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-compatibility-version-1.28.yaml
new file mode 100644
index 000000000..96d9c1f52
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-compatibility-version-1.28.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-demo.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-demo.yaml
new file mode 100644
index 000000000..d6dc36dd0
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-demo.yaml
@@ -0,0 +1,94 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The demo profile enables a variety of things to try out Istio in non-production environments.
+# * Lower resource utilization.
+# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
+# * More ports enabled on the ingress, which is used in some tasks.
+meshConfig:
+  accessLogFile: /dev/stdout
+  extensionProviders:
+    - name: otel
+      envoyOtelAls:
+        service: opentelemetry-collector.observability.svc.cluster.local
+        port: 4317
+    - name: skywalking
+      skywalking:
+        service: tracing.istio-system.svc.cluster.local
+        port: 11800
+    - name: otel-tracing
+      opentelemetry:
+        port: 4317
+        service: opentelemetry-collector.observability.svc.cluster.local
+    - name: jaeger
+      opentelemetry:
+        port: 4317
+        service: jaeger-collector.istio-system.svc.cluster.local        
+
+cni:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 40Mi
+
+ztunnel:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 40Mi
+
+global:
+  proxy:
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+  waypoint:
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+
+pilot:
+  autoscaleEnabled: false
+  traceSampling: 100
+  resources:
+    requests:
+      cpu: 10m
+      memory: 100Mi
+
+gateways:
+  istio-egressgateway:
+    autoscaleEnabled: false
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+  istio-ingressgateway:
+    autoscaleEnabled: false
+    ports:
+    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
+    # Note that AWS ELB will by default perform health checks on the first port
+    # on this list. Setting this to the health check port will ensure that health
+    # checks always work. https://github.com/istio/istio/issues/12503
+    - port: 15021
+      targetPort: 15021
+      name: status-port
+    - port: 80
+      targetPort: 8080
+      name: http2
+    - port: 443
+      targetPort: 8443
+      name: https
+    - port: 31400
+      targetPort: 31400
+      name: tcp
+      # This is the port where sni routing happens
+    - port: 15443
+      targetPort: 15443
+      name: tls
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-platform-gke.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.6/charts/base/files/profile-platform-k3d.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.6/charts/base/files/profile-platform-k3d.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/base/files/profile-platform-k3d.yaml
diff --git a/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-platform-k3s.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-platform-k3s.yaml
new file mode 100644
index 000000000..07820106d
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-platform-k3s.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
+  cniBinDir: /var/lib/rancher/k3s/data/cni
diff --git a/resources/v1.24.6/charts/base/files/profile-platform-microk8s.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.6/charts/base/files/profile-platform-microk8s.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/base/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.6/charts/base/files/profile-platform-minikube.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.6/charts/base/files/profile-platform-minikube.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/base/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.6/charts/base/files/profile-platform-openshift.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.6/charts/base/files/profile-platform-openshift.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/base/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.6/charts/base/files/profile-preview.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.6/charts/base/files/profile-preview.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/base/files/profile-preview.yaml
diff --git a/resources/v1.24.6/charts/base/files/profile-remote.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.6/charts/base/files/profile-remote.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/base/files/profile-remote.yaml
diff --git a/resources/v1.24.6/charts/base/files/profile-stable.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.6/charts/base/files/profile-stable.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/base/files/profile-stable.yaml
diff --git a/resources/v1.24.6/charts/base/templates/NOTES.txt b/resources/v1.29-alpha.b2f713a9/charts/base/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.6/charts/base/templates/NOTES.txt
rename to resources/v1.29-alpha.b2f713a9/charts/base/templates/NOTES.txt
diff --git a/resources/v1.29-alpha.b2f713a9/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
new file mode 100644
index 000000000..30049df98
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/base/templates/defaultrevision-validatingadmissionpolicy.yaml
@@ -0,0 +1,55 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+{{- if and .Values.experimental.stableValidationPolicy (not (eq .Values.defaultRevision "")) }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: "stable-channel-default-policy.istio.io"
+  labels:
+    release: {{ .Release.Name }}
+    istio: istiod
+    istio.io/rev: {{ .Values.defaultRevision }}
+    app.kubernetes.io/name: "istiod"
+    {{ include "istio.labels" . | nindent 4 }}
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+        - security.istio.io
+        - networking.istio.io
+        - telemetry.istio.io
+        - extensions.istio.io
+      apiVersions: ["*"]
+      operations:  ["CREATE", "UPDATE"]
+      resources:   ["*"]
+  variables:
+    - name: isEnvoyFilter
+      expression: "object.kind == 'EnvoyFilter'"
+    - name: isWasmPlugin
+      expression: "object.kind == 'WasmPlugin'"
+    - name: isProxyConfig
+      expression: "object.kind == 'ProxyConfig'"
+    - name: isTelemetry
+      expression: "object.kind == 'Telemetry'"
+  validations:
+    - expression: "!variables.isEnvoyFilter"
+    - expression: "!variables.isWasmPlugin"
+    - expression: "!variables.isProxyConfig"
+    - expression: |
+        !(
+          variables.isTelemetry && (
+            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
+            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
+            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
+          )
+        )
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: "stable-channel-default-policy-binding.istio.io"
+spec:
+  policyName: "stable-channel-default-policy.istio.io"
+  validationActions: [Deny]
+{{- end }}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
new file mode 100644
index 000000000..dcd16e964
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/base/templates/defaultrevision-validatingwebhookconfiguration.yaml
@@ -0,0 +1,58 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+{{- if not (eq .Values.defaultRevision "") }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: istiod-default-validator
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    istio: istiod
+    istio.io/rev: {{ .Values.defaultRevision | quote }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+webhooks:
+  - name: validation.istio.io
+    clientConfig:
+      {{- if .Values.base.validationURL }}
+      url: {{ .Values.base.validationURL }}
+      {{- else }}
+      service:
+        {{- if (eq .Values.defaultRevision "default") }}
+        name: istiod
+        {{- else }}
+        name: istiod-{{ .Values.defaultRevision }}
+        {{- end }}
+        namespace: {{ .Values.global.istioNamespace }}
+        path: "/validate"
+      {{- end }}
+      {{- if .Values.base.validationCABundle }}
+      caBundle: "{{ .Values.base.validationCABundle }}"
+      {{- end }}
+    rules:
+      - operations:
+          - CREATE
+          - UPDATE
+        apiGroups:
+          - security.istio.io
+          - networking.istio.io
+          - telemetry.istio.io
+          - extensions.istio.io
+        apiVersions:
+          - "*"
+        resources:
+          - "*"
+
+    {{- if .Values.base.validationCABundle }}
+    # Disable webhook controller in Pilot to stop patching it
+    failurePolicy: Fail
+    {{- else }}
+    # Fail open until the validation webhook is ready. The webhook controller
+    # will update this to `Fail` and patch in the `caBundle` when the webhook
+    # endpoint is ready.
+    failurePolicy: Ignore
+    {{- end }}
+    sideEffects: None
+    admissionReviewVersions: ["v1"]
+{{- end }}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/base/templates/reader-serviceaccount.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/templates/reader-serviceaccount.yaml
new file mode 100644
index 000000000..bb7a74ff4
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/base/templates/reader-serviceaccount.yaml
@@ -0,0 +1,22 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# This singleton service account aggregates reader permissions for the revisions in a given cluster
+# ATM this is a singleton per cluster with Istio installed, and is not revisioned. It maybe should be,
+# as otherwise compromising the token for this SA would give you access to *every* installed revision.
+# Should be used for remote secret creation.
+apiVersion: v1
+kind: ServiceAccount
+  {{- if .Values.global.imagePullSecrets }}
+imagePullSecrets:
+  {{- range .Values.global.imagePullSecrets }}
+  - name: {{ . }}
+    {{- end }}
+    {{- end }}
+metadata:
+  name: istio-reader-service-account
+  namespace: {{ .Values.global.istioNamespace }}
+  labels:
+    app: istio-reader
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istio-reader"
+    {{- include "istio.labels" . | nindent 4 }}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/base/templates/zzz_profile.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/templates/zzz_profile.yaml
new file mode 100644
index 000000000..3d8495648
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/base/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if false }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/base/values.yaml b/resources/v1.29-alpha.b2f713a9/charts/base/values.yaml
new file mode 100644
index 000000000..8353c57d6
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/base/values.yaml
@@ -0,0 +1,45 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  global:
+
+    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+
+    # Used to locate istiod.
+    istioNamespace: istio-system
+
+    # resourceScope controls what resources will be processed by helm.
+    # This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
+    # It can be one of:
+    # - all: all resources are processed
+    # - cluster: only cluster-scoped resources are processed
+    # - namespace: only namespace-scoped resources are processed
+    resourceScope: all
+  base:
+    # A list of CRDs to exclude. Requires `enableCRDTemplates` to be true.
+    # Example: `excludedCRDs: ["envoyfilters.networking.istio.io"]`.
+    # Note: when installing with `istioctl`, `enableIstioConfigCRDs=false` must also be set.
+    excludedCRDs: []
+    # Helm (as of V3) does not support upgrading CRDs, because it is not universally
+    # safe for them to support this.
+    # Istio as a project enforces certain backwards-compat guarantees that allow us
+    # to safely upgrade CRDs in spite of this, so we default to self-managing CRDs
+    # as standard K8S resources in Helm, and disable Helm's CRD management. See also:
+    # https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#method-2-separate-charts
+    enableCRDTemplates: true
+
+    # Validation webhook configuration url
+    # For example: https://$remotePilotAddress:15017/validate
+    validationURL: ""
+    # Validation webhook caBundle value. Useful when running pilot with a well known cert
+    validationCABundle: ""
+
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  defaultRevision: "default"
+  experimental:
+    stableValidationPolicy: false
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/Chart.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/Chart.yaml
new file mode 100644
index 000000000..285cdb559
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+appVersion: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+description: Helm chart for istio-cni components
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio-cni
+- istio
+name: cni
+sources:
+- https://github.com/istio/istio
+version: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/README.md b/resources/v1.29-alpha.b2f713a9/charts/cni/README.md
new file mode 100644
index 000000000..f7e5cbd37
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/README.md
@@ -0,0 +1,65 @@
+# Istio CNI Helm Chart
+
+This chart installs the Istio CNI Plugin. See the [CNI installation guide](https://istio.io/latest/docs/setup/additional-setup/cni/)
+for more information.
+
+## Setup Repo Info
+
+```console
+helm repo add istio https://istio-release.storage.googleapis.com/charts
+helm repo update
+```
+
+_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
+
+## Installing the Chart
+
+To install the chart with the release name `istio-cni`:
+
+```console
+helm install istio-cni istio/cni -n kube-system
+```
+
+Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
+`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
+'system-node-critical' outside of kube-system.
+
+## Configuration
+
+To view supported configuration options and documentation, run:
+
+```console
+helm show values istio/istio-cni
+```
+
+### Profiles
+
+Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
+These can be set with `--set profile=<profile>`.
+For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
+
+For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
+
+Explicitly set values have highest priority, then profile settings, then chart defaults.
+
+As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
+When configuring the chart, you should not include this.
+That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
+
+### Ambient
+
+To enable ambient, you can use the ambient profile: `--set profile=ambient`.
+
+#### Calico
+
+For Calico, you must also modify the settings to allow source spoofing:
+
+- if deployed by operator,  `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`
+- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )
+
+### GKE notes
+
+On GKE, 'kube-system' is required.
+
+If using `helm template`, `--set cni.cniBinDir=/home/kubernetes/bin` is required - with `helm install`
+it is auto-detected.
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-ambient.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-compatibility-version-1.25.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..3827ee78f
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,16 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+     # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-compatibility-version-1.26.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..b690d25ca
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-compatibility-version-1.27.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-compatibility-version-1.27.yaml
new file mode 100644
index 000000000..9f9ba7b67
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-compatibility-version-1.27.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-compatibility-version-1.28.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-compatibility-version-1.28.yaml
new file mode 100644
index 000000000..96d9c1f52
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-compatibility-version-1.28.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-demo.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-demo.yaml
new file mode 100644
index 000000000..d6dc36dd0
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-demo.yaml
@@ -0,0 +1,94 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The demo profile enables a variety of things to try out Istio in non-production environments.
+# * Lower resource utilization.
+# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
+# * More ports enabled on the ingress, which is used in some tasks.
+meshConfig:
+  accessLogFile: /dev/stdout
+  extensionProviders:
+    - name: otel
+      envoyOtelAls:
+        service: opentelemetry-collector.observability.svc.cluster.local
+        port: 4317
+    - name: skywalking
+      skywalking:
+        service: tracing.istio-system.svc.cluster.local
+        port: 11800
+    - name: otel-tracing
+      opentelemetry:
+        port: 4317
+        service: opentelemetry-collector.observability.svc.cluster.local
+    - name: jaeger
+      opentelemetry:
+        port: 4317
+        service: jaeger-collector.istio-system.svc.cluster.local        
+
+cni:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 40Mi
+
+ztunnel:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 40Mi
+
+global:
+  proxy:
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+  waypoint:
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+
+pilot:
+  autoscaleEnabled: false
+  traceSampling: 100
+  resources:
+    requests:
+      cpu: 10m
+      memory: 100Mi
+
+gateways:
+  istio-egressgateway:
+    autoscaleEnabled: false
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+  istio-ingressgateway:
+    autoscaleEnabled: false
+    ports:
+    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
+    # Note that AWS ELB will by default perform health checks on the first port
+    # on this list. Setting this to the health check port will ensure that health
+    # checks always work. https://github.com/istio/istio/issues/12503
+    - port: 15021
+      targetPort: 15021
+      name: status-port
+    - port: 80
+      targetPort: 8080
+      name: http2
+    - port: 443
+      targetPort: 8443
+      name: https
+    - port: 31400
+      targetPort: 31400
+      name: tcp
+      # This is the port where sni routing happens
+    - port: 15443
+      targetPort: 15443
+      name: tls
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-platform-gke.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.6/charts/cni/files/profile-platform-k3d.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.6/charts/cni/files/profile-platform-k3d.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-platform-k3d.yaml
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-platform-k3s.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-platform-k3s.yaml
new file mode 100644
index 000000000..07820106d
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-platform-k3s.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
+  cniBinDir: /var/lib/rancher/k3s/data/cni
diff --git a/resources/v1.24.6/charts/cni/files/profile-platform-microk8s.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.6/charts/cni/files/profile-platform-microk8s.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.6/charts/cni/files/profile-platform-minikube.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.6/charts/cni/files/profile-platform-minikube.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.6/charts/cni/files/profile-platform-openshift.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.6/charts/cni/files/profile-platform-openshift.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.6/charts/cni/files/profile-preview.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.6/charts/cni/files/profile-preview.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-preview.yaml
diff --git a/resources/v1.24.6/charts/cni/files/profile-remote.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.6/charts/cni/files/profile-remote.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-remote.yaml
diff --git a/resources/v1.24.6/charts/cni/files/profile-stable.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.6/charts/cni/files/profile-stable.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/cni/files/profile-stable.yaml
diff --git a/resources/v1.24.6/charts/cni/templates/NOTES.txt b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.6/charts/cni/templates/NOTES.txt
rename to resources/v1.29-alpha.b2f713a9/charts/cni/templates/NOTES.txt
diff --git a/resources/v1.24.6/charts/cni/templates/_helpers.tpl b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.6/charts/cni/templates/_helpers.tpl
rename to resources/v1.29-alpha.b2f713a9/charts/cni/templates/_helpers.tpl
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/templates/clusterrole.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/clusterrole.yaml
new file mode 100644
index 000000000..51af4ce7f
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/clusterrole.yaml
@@ -0,0 +1,84 @@
+# Created if cluster resources are not omitted
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "name" . }}
+  labels:
+    app: {{ template "name" . }}
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+- apiGroups: ["security.openshift.io"] 
+  resources: ["securitycontextconstraints"] 
+  resourceNames: ["privileged"] 
+  verbs: ["use"]
+- apiGroups: [""]
+  resources: ["pods","nodes","namespaces"]
+  verbs: ["get", "list", "watch"]
+{{- if (eq ((coalesce .Values.platform .Values.global.platform) | default "") "openshift") }}
+- apiGroups: ["security.openshift.io"]
+  resources: ["securitycontextconstraints"]
+  resourceNames: ["privileged"]
+  verbs: ["use"]
+{{- end }}
+---
+{{- if .Values.repair.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "name" . }}-repair-role
+  labels:
+    app: {{ template "name" . }}
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create", "patch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["watch", "get", "list"]
+{{- if .Values.repair.repairPods }}
+{{- /*  No privileges needed*/}}
+{{- else if .Values.repair.deletePods }}
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["delete"]
+{{- else if .Values.repair.labelPods }}
+  - apiGroups: [""]
+    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
+    resources: ["pods/status"]
+    verbs: ["patch", "update"]
+{{- end }}
+{{- end }}
+---
+{{- if .Values.ambient.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "name" . }}-ambient
+  labels:
+    app: {{ template "name" . }}
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+- apiGroups: [""]
+  {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
+  resources: ["pods/status"]
+  verbs: ["patch", "update"]
+- apiGroups: ["apps"]
+  resources: ["daemonsets"]
+  resourceNames: ["{{ template "name" . }}-node"]
+  verbs: ["get"]
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/templates/clusterrolebinding.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/clusterrolebinding.yaml
new file mode 100644
index 000000000..60e3c28be
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/clusterrolebinding.yaml
@@ -0,0 +1,66 @@
+# Created if cluster resources are not omitted
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "name" . }}
+  labels:
+    app: {{ template "name" . }}
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "name" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "name" . }}
+  namespace: {{ .Release.Namespace }}
+---
+{{- if .Values.repair.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "name" . }}-repair-rolebinding
+  labels:
+    k8s-app: {{ template "name" . }}-repair
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "name" . }}
+  namespace: {{ .Release.Namespace}}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "name" . }}-repair-role
+{{- end }}
+---
+{{- if .Values.ambient.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "name" . }}-ambient
+  labels:
+    k8s-app: {{ template "name" . }}-repair
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "name" . }}
+    namespace: {{ .Release.Namespace}}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "name" . }}-ambient
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/templates/configmap-cni.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/configmap-cni.yaml
new file mode 100644
index 000000000..98bc60ac0
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/configmap-cni.yaml
@@ -0,0 +1,43 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: {{ template "name" . }}-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "name" . }}
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+  CURRENT_AGENT_VERSION: {{ .Values.tag | default .Values.global.tag | quote }}
+  AMBIENT_ENABLED: {{ .Values.ambient.enabled | quote }}
+  AMBIENT_ENABLEMENT_SELECTOR: {{ .Values.ambient.enablementSelectors | toYaml | quote }}
+  AMBIENT_DNS_CAPTURE: {{ .Values.ambient.dnsCapture | quote  }}
+  AMBIENT_IPV6: {{ .Values.ambient.ipv6 | quote }}
+  AMBIENT_RECONCILE_POD_RULES_ON_STARTUP: {{ .Values.ambient.reconcileIptablesOnStartup | quote }}
+  {{- if .Values.cniConfFileName }} # K8S < 1.24 doesn't like empty values
+  CNI_CONF_NAME: {{ .Values.cniConfFileName }} # Name of the CNI config file to create. Only override if you know the exact path your CNI requires..
+  {{- end }}
+  ISTIO_OWNED_CNI_CONFIG: {{ .Values.istioOwnedCNIConfig | quote }}
+  {{- if .Values.istioOwnedCNIConfig }}
+  ISTIO_OWNED_CNI_CONF_FILENAME: {{ .Values.istioOwnedCNIConfigFileName | quote }}
+  {{- end }}
+  CHAINED_CNI_PLUGIN: {{ .Values.chained | quote }}
+  EXCLUDE_NAMESPACES: "{{ range $idx, $ns := .Values.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
+  REPAIR_ENABLED: {{ .Values.repair.enabled | quote }}
+  REPAIR_LABEL_PODS: {{ .Values.repair.labelPods | quote }}
+  REPAIR_DELETE_PODS: {{ .Values.repair.deletePods | quote }}
+  REPAIR_REPAIR_PODS: {{ .Values.repair.repairPods | quote }}
+  REPAIR_INIT_CONTAINER_NAME: {{ .Values.repair.initContainerName | quote }}
+  REPAIR_BROKEN_POD_LABEL_KEY: {{ .Values.repair.brokenPodLabelKey | quote }}
+  REPAIR_BROKEN_POD_LABEL_VALUE: {{ .Values.repair.brokenPodLabelValue | quote }}
+  NATIVE_NFTABLES: {{ .Values.global.nativeNftables | quote }}
+  {{- with .Values.env }}
+  {{- range $key, $val := . }}
+  {{ $key }}: "{{ $val }}"
+  {{- end }}
+  {{- end }}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/templates/daemonset.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/daemonset.yaml
new file mode 100644
index 000000000..ffc4332a9
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/daemonset.yaml
@@ -0,0 +1,252 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# This manifest installs the Istio install-cni container, as well
+# as the Istio CNI plugin and config on
+# each master and worker node in a Kubernetes cluster.
+#
+# $detectedBinDir exists to support a GKE-specific platform override,
+# and is deprecated in favor of using the explicit `gke` platform profile.
+{{- $detectedBinDir := (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
+    "/home/kubernetes/bin"
+    "/opt/cni/bin"
+}}
+{{- if .Values.cniBinDir }}
+{{ $detectedBinDir = .Values.cniBinDir }}
+{{- end }}
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  # Note that this is templated but evaluates to a fixed name
+  # which the CNI plugin may fall back onto in some failsafe scenarios.
+  # if this name is changed, CNI plugin logic that checks for this name
+  # format should also be updated.
+  name: {{ template "name" . }}-node
+  namespace: {{ .Release.Namespace }}
+  labels:
+    k8s-app: {{ template "name" . }}-node
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+    {{ with .Values.daemonSetLabels -}}{{ toYaml . | nindent 4}}{{ end }}
+spec:
+  selector:
+    matchLabels:
+      k8s-app: {{ template "name" . }}-node
+  {{- with .Values.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  template:
+    metadata:
+      labels:
+        k8s-app: {{ template "name" . }}-node
+        sidecar.istio.io/inject: "false"
+        istio.io/dataplane-mode: none
+        app.kubernetes.io/name: {{ template "name" . }}
+        {{- include "istio.labels" . | nindent 8 }}
+        {{ with .Values.podLabels -}}{{ toYaml . | nindent 8}}{{ end }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+        # Add Prometheus Scrape annotations
+        prometheus.io/scrape: 'true'
+        prometheus.io/port: "15014"
+        prometheus.io/path: '/metrics'
+        # Add AppArmor annotation
+        # This is required to avoid conflicts with AppArmor profiles which block certain
+        # privileged pod capabilities.
+        # Required for Kubernetes 1.29 which does not support setting appArmorProfile in the
+        # securityContext which is otherwise preferred.
+        container.apparmor.security.beta.kubernetes.io/install-cni: unconfined
+        # Custom annotations
+        {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+        {{- end }}
+    spec:
+{{- if and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace }}
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+{{- end }}
+      nodeSelector:
+        kubernetes.io/os: linux
+      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      priorityClassName: system-node-critical
+      serviceAccountName: {{ template "name" . }}
+      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
+      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
+      terminationGracePeriodSeconds: 5
+      containers:
+        # This container installs the Istio CNI binaries
+        # and CNI network config file on each node.
+        - name: install-cni
+{{- if contains "/" .Values.image }}
+          image: "{{ .Values.image }}"
+{{- else }}
+          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "install-cni" }}:{{ template "istio-tag" . }}"
+{{- end }}
+{{- if or .Values.pullPolicy .Values.global.imagePullPolicy }}
+          imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.imagePullPolicy }}
+{{- end }}
+          ports:
+          - containerPort: 15014
+            name: metrics
+            protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8000
+          securityContext:
+            privileged: false
+            runAsGroup: 0
+            runAsUser: 0
+            runAsNonRoot: false
+            # Both ambient and sidecar repair mode require elevated node privileges to function.
+            # But we don't need _everything_ in `privileged`, so explicitly set it to false and
+            # add capabilities based on feature.
+            capabilities:
+              drop:
+              - ALL
+              add:
+              # CAP_NET_ADMIN is required to allow ipset and route table access
+              - NET_ADMIN
+              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
+              - NET_RAW
+              # CAP_SYS_PTRACE is required for repair and ambient mode to describe
+              # the pod's network namespace.
+              - SYS_PTRACE
+              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
+              # network namespaces in `/proc` to obtain descriptors for entering pod network
+              # namespaces. There does not appear to be a more granular capability for this.
+              - SYS_ADMIN
+              # While we run as a 'root' (UID/GID 0), since we drop all capabilities we lose
+              # the typical ability to read/write to folders owned by others.
+              # This can cause problems if the hostPath mounts we use, which we require write access into,
+              # are owned by non-root. DAC_OVERRIDE bypasses these and gives us write access into any folder.
+              - DAC_OVERRIDE
+{{- if .Values.seLinuxOptions }}
+{{ with (merge .Values.seLinuxOptions (dict "type" "spc_t")) }}
+            seLinuxOptions:
+{{ toYaml . | trim | indent 14 }}
+{{- end }}
+{{- end }}
+{{- if .Values.seccompProfile }}
+            seccompProfile:
+{{ toYaml .Values.seccompProfile | trim | indent 14 }}
+{{- end }}
+          command: ["install-cni"]
+          args:
+            {{- if or .Values.logging.level .Values.global.logging.level }}
+            - --log_output_level={{ coalesce .Values.logging.level .Values.global.logging.level }}
+            {{- end}}
+            {{- if .Values.global.logAsJson }}
+            - --log_as_json
+            {{- end}}
+          envFrom:
+            - configMapRef:
+                name: {{ template "name" . }}-config
+          env:
+            - name: REPAIR_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: REPAIR_RUN_AS_DAEMON
+              value: "true"
+            - name: REPAIR_SIDECAR_ANNOTATION
+              value: "sidecar.istio.io/status"
+            {{- if not (and .Values.ambient.enabled .Values.ambient.shareHostNetworkNamespace) }}
+            - name: ALLOW_SWITCH_TO_HOST_NS
+              value: "true"
+            {{- end }}
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+            - name: GOMEMLIMIT
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.memory
+                  divisor: "1"
+            - name: GOMAXPROCS
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.cpu
+                  divisor: "1"
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            {{- if .Values.env }}
+            {{- range $key, $val := .Values.env }}
+            - name: {{ $key }}
+              value: "{{ $val }}"
+            {{- end }}
+            {{- end }}
+          volumeMounts:
+            - mountPath: /host/opt/cni/bin
+              name: cni-bin-dir
+            {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
+            - mountPath: /host/proc
+              name: cni-host-procfs
+              readOnly: true
+            {{- end }}
+            - mountPath: /host/etc/cni/net.d
+              name: cni-net-dir
+            - mountPath: /var/run/istio-cni
+              name: cni-socket-dir
+            {{- if .Values.ambient.enabled }}
+            - mountPath: /host/var/run/netns
+              mountPropagation: HostToContainer
+              name: cni-netns-dir
+            - mountPath: /var/run/ztunnel
+              name: cni-ztunnel-sock-dir
+            {{ end }}
+          resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 12 }}
+{{- else }}
+{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
+{{- end }}
+      volumes:
+        # Used to install CNI.
+        - name: cni-bin-dir
+          hostPath:
+            path: {{ $detectedBinDir }}
+        {{- if or .Values.repair.repairPods .Values.ambient.enabled }}
+        - name: cni-host-procfs
+          hostPath:
+            path: /proc
+            type: Directory
+        {{- end }}
+        {{- if .Values.ambient.enabled }}
+        - name: cni-ztunnel-sock-dir
+          hostPath:
+            path: /var/run/ztunnel
+            type: DirectoryOrCreate
+        {{- end }}
+        - name: cni-net-dir
+          hostPath:
+            path: {{ .Values.cniConfDir }}
+        # Used for UDS sockets for logging, ambient eventing
+        - name: cni-socket-dir
+          hostPath:
+            path: /var/run/istio-cni
+        - name: cni-netns-dir
+          hostPath:
+            path: {{ .Values.cniNetnsDir }}
+            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
+            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.
+            # Once the CNI does mount this, it will get populated and we're good.
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/templates/network-attachment-definition.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/network-attachment-definition.yaml
new file mode 100644
index 000000000..37ef7c3e6
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/network-attachment-definition.yaml
@@ -0,0 +1,13 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+{{- if eq .Values.provider "multus" }}
+apiVersion: k8s.cni.cncf.io/v1
+kind: NetworkAttachmentDefinition
+metadata:
+  name: {{ template "name" . }}
+  namespace: default
+  labels:
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+{{- end }}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/templates/networkpolicy.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/networkpolicy.yaml
new file mode 100644
index 000000000..a30df776d
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/networkpolicy.yaml
@@ -0,0 +1,36 @@
+{{- if (.Values.global.networkPolicy).enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ template "name" . }}{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    k8s-app: {{ template "name" . }}-node
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      k8s-app: {{ template "name" . }}-node
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  # Metrics endpoint for monitoring/prometheus
+  - from: []
+    ports:
+    - protocol: TCP
+      port: 15014
+  # Readiness probe endpoint
+  - from: []
+    ports:
+    - protocol: TCP
+      port: 8000
+  egress:
+  # Allow DNS resolution and access to Kubernetes API server.
+  # IP/Port of the API server is heavily dependant on k8s distribution, so we allow all egress for now.
+  - {}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/templates/resourcequota.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/resourcequota.yaml
new file mode 100644
index 000000000..2e0be5ab4
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/resourcequota.yaml
@@ -0,0 +1,21 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+{{- if .Values.resourceQuotas.enabled }}
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: {{ template "name" . }}-resource-quota
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  hard:
+    pods: {{ .Values.resourceQuotas.pods | quote }}
+  scopeSelector:
+    matchExpressions:
+    - operator: In
+      scopeName: PriorityClass
+      values:
+      - system-node-critical
+{{- end }}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/templates/serviceaccount.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/serviceaccount.yaml
new file mode 100644
index 000000000..17c8e64a9
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/serviceaccount.yaml
@@ -0,0 +1,20 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+apiVersion: v1
+kind: ServiceAccount
+{{- if .Values.global.imagePullSecrets }}
+imagePullSecrets:
+{{- range .Values.global.imagePullSecrets }}
+  - name: {{ . }}
+{{- end }}
+{{- end }}
+metadata:
+  name: {{ template "name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "name" . }}
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" }}
+    operator.istio.io/component: "Cni"
+    app.kubernetes.io/name: {{ template "name" . }}
+    {{- include "istio.labels" . | nindent 4 }}
+{{- end }}
diff --git a/resources/v1.24.6/charts/cni/templates/zzy_descope_legacy.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/zzy_descope_legacy.yaml
similarity index 100%
rename from resources/v1.24.6/charts/cni/templates/zzy_descope_legacy.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/cni/templates/zzy_descope_legacy.yaml
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/templates/zzz_profile.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/zzz_profile.yaml
new file mode 100644
index 000000000..3d8495648
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if false }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/cni/values.yaml b/resources/v1.29-alpha.b2f713a9/charts/cni/values.yaml
new file mode 100644
index 000000000..d845c67ab
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/cni/values.yaml
@@ -0,0 +1,196 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  hub: ""
+  tag: ""
+  variant: ""
+  image: install-cni
+  pullPolicy: ""
+
+  # Same as `global.logging.level`, but will override it if set
+  logging:
+    level: ""
+
+  # Configuration file to insert istio-cni plugin configuration
+  # by default this will be the first file found in the cni-conf-dir
+  # Example
+  # cniConfFileName: 10-calico.conflist
+
+  # CNI-and-platform specific path defaults.
+  # These may need to be set to platform-specific values, consult
+  # overrides for your platform in `manifests/helm-profiles/platform-*.yaml`
+  cniBinDir: /opt/cni/bin
+  cniConfDir: /etc/cni/net.d
+  cniConfFileName: ""
+  cniNetnsDir: "/var/run/netns"
+
+  # If Istio owned CNI config is enabled, defaults to 02-istio-cni.conflist
+  istioOwnedCNIConfigFileName: ""
+  istioOwnedCNIConfig: false
+
+  excludeNamespaces:
+    - kube-system
+
+  # Allows user to set custom affinity for the DaemonSet
+  affinity: {}
+
+  # Additional labels to apply on the daemonset level
+  daemonSetLabels: {}
+
+  # Custom annotations on pod level, if you need them
+  podAnnotations: {}
+
+  # Additional labels to apply on the pod level
+  podLabels: {}
+
+  # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
+  # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
+  chained: true
+
+  # Custom configuration happens based on the CNI provider.
+  # Possible values: "default", "multus"
+  provider: "default"
+
+  # Configure ambient settings
+  ambient:
+    # If enabled, ambient redirection will be enabled
+    enabled: false
+    # If ambient is enabled, this selector will be used to identify the ambient-enabled pods
+    enablementSelectors: 
+    - podSelector:
+        matchLabels: {istio.io/dataplane-mode: ambient}
+    - podSelector:
+        matchExpressions:
+        - { key: istio.io/dataplane-mode, operator: NotIn, values: [none] }
+      namespaceSelector:
+        matchLabels: {istio.io/dataplane-mode: ambient}
+    # Set ambient config dir path: defaults to /etc/ambient-config
+    configDir: ""
+    # If enabled, and ambient is enabled, DNS redirection will be enabled
+    dnsCapture: true
+    # If enabled, and ambient is enabled, enables ipv6 support
+    ipv6: true
+    # If enabled, and ambient is enabled, the CNI agent will reconcile incompatible iptables rules and chains at startup.
+    # This will eventually be enabled by default
+    reconcileIptablesOnStartup: false
+    # If enabled, and ambient is enabled, the CNI agent will always share the network namespace of the host node it is running on
+    shareHostNetworkNamespace: false
+
+
+  repair:
+    enabled: true
+    hub: ""
+    tag: ""
+
+    # Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
+    # This defines the action the controller will take when a pod is detected as broken.
+
+    # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
+    # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
+    # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
+    labelPods: false
+    # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
+    # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
+    deletePods: false
+    # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
+    # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
+    # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
+    repairPods: true
+
+    initContainerName: "istio-validation"
+
+    brokenPodLabelKey: "cni.istio.io/uninitialized"
+    brokenPodLabelValue: "true"
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
+  seLinuxOptions: {}
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 100Mi
+
+  resourceQuotas:
+    enabled: false
+    pods: 5000
+
+  tolerations:
+    # Make sure istio-cni-node gets scheduled on all nodes.
+    - effect: NoSchedule
+      operator: Exists
+    # Mark the pod as a critical add-on for rescheduling.
+    - key: CriticalAddonsOnly
+      operator: Exists
+    - effect: NoExecute
+      operator: Exists
+
+  # K8s DaemonSet update strategy.
+  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  global:
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-testing
+
+    # Default tag for Istio images.
+    tag: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # change cni scope level to control logging out of istio-cni-node DaemonSet
+    logging:
+      level: info
+
+    logAsJson: false
+
+    # When enabled, default NetworkPolicy resources will be created
+    networkPolicy:
+      enabled: false
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Default resources allocated
+    defaultResources:
+      requests:
+        cpu: 100m
+        memory: 100Mi
+
+    # In order to use native nftable rules instead of iptable rules, set this flag to true.
+    nativeNftables: false
+
+    # resourceScope controls what resources will be processed by helm.
+    # This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
+    # It can be one of:
+    # - all: all resources are processed
+    # - cluster: only cluster-scoped resources are processed
+    # - namespace: only namespace-scoped resources are processed
+    resourceScope: all
+
+  # A `key: value` mapping of environment variables to add to the pod
+  env: {}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/Chart.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/Chart.yaml
new file mode 100644
index 000000000..090241106
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+appVersion: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+description: Helm chart for deploying Istio gateways
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+- gateways
+name: gateway
+sources:
+- https://github.com/istio/istio
+type: application
+version: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/README.md b/resources/v1.29-alpha.b2f713a9/charts/gateway/README.md
new file mode 100644
index 000000000..6344859a2
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/README.md
@@ -0,0 +1,170 @@
+# Istio Gateway Helm Chart
+
+This chart installs an Istio gateway deployment.
+
+## Setup Repo Info
+
+```console
+helm repo add istio https://istio-release.storage.googleapis.com/charts
+helm repo update
+```
+
+_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
+
+## Installing the Chart
+
+To install the chart with the release name `istio-ingressgateway`:
+
+```console
+helm install istio-ingressgateway istio/gateway
+```
+
+## Uninstalling the Chart
+
+To uninstall/delete the `istio-ingressgateway` deployment:
+
+```console
+helm delete istio-ingressgateway
+```
+
+## Configuration
+
+To view supported configuration options and documentation, run:
+
+```console
+helm show values istio/gateway
+```
+
+### Profiles
+
+Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
+These can be set with `--set profile=<profile>`.
+For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
+
+For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
+
+Explicitly set values have highest priority, then profile settings, then chart defaults.
+
+As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
+When configuring the chart, you should not include this.
+That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
+
+### OpenShift
+
+When deploying the gateway in an OpenShift cluster, use the `openshift` profile to override the default values, for example:
+
+```console
+helm install istio-ingressgateway istio/gateway --set profile=openshift
+```
+
+### `image: auto` Information
+
+The image used by the chart, `auto`, may be unintuitive.
+This exists because the pod spec will be automatically populated at runtime, using the same mechanism as [Sidecar Injection](istio.io/latest/docs/setup/additional-setup/sidecar-injection).
+This allows the same configurations and lifecycle to apply to gateways as sidecars.
+
+Note: this does mean that the namespace the gateway is deployed in must not have the `istio-injection=disabled` label.
+See [Controlling the injection policy](https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy) for more info.
+
+### Examples
+
+#### Egress Gateway
+
+Deploying a Gateway to be used as an [Egress Gateway](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/):
+
+```yaml
+service:
+  # Egress gateways do not need an external LoadBalancer IP
+  type: ClusterIP
+```
+
+#### Multi-network/VM Gateway
+
+Deploying a Gateway to be used as a [Multi-network Gateway](https://istio.io/latest/docs/setup/install/multicluster/) for network `network-1`:
+
+```yaml
+networkGateway: network-1
+```
+
+### Migrating from other installation methods
+
+Installations from other installation methods (such as istioctl, Istio Operator, other helm charts, etc) can be migrated to use the new Helm charts
+following the guidance below.
+If you are able to, a clean installation is simpler. However, this often requires an external IP migration which can be challenging.
+
+WARNING: when installing over an existing deployment, the two deployments will be merged together by Helm, which may lead to unexpected results.
+
+#### Legacy Gateway Helm charts
+
+Istio historically offered two different charts - `manifests/charts/gateways/istio-ingress` and `manifests/charts/gateways/istio-egress`.
+These are replaced by this chart.
+While not required, it is recommended all new users use this chart, and existing users migrate when possible.
+
+This chart has the following benefits and differences:
+* Designed with Helm best practices in mind (standardized values options, values schema, values are not all nested under `gateways.istio-ingressgateway.*`, release name and namespace taken into account, etc).
+* Utilizes Gateway injection, simplifying upgrades, allowing gateways to run in any namespace, and avoiding repeating config for sidecars and gateways.
+* Published to official Istio Helm repository.
+* Single chart for all gateways (Ingress, Egress, East West).
+
+#### General concerns
+
+For a smooth migration, the resource names and `Deployment.spec.selector` labels must match.
+
+If you install with `helm install istio-gateway istio/gateway`, resources will be named `istio-gateway` and the `selector` labels set to:
+
+```yaml
+app: istio-gateway
+istio: gateway # the release name with leading istio- prefix stripped
+```
+
+If your existing installation doesn't follow these names, you can override them. For example, if you have resources named `my-custom-gateway` with `selector` labels
+`foo=bar,istio=ingressgateway`:
+
+```yaml
+name: my-custom-gateway # Override the name to match existing resources
+labels:
+  app: "" # Unset default app selector label
+  istio: ingressgateway # override default istio selector label
+  foo: bar # Add the existing custom selector label
+```
+
+#### Migrating an existing Helm release
+
+An existing helm release can be `helm upgrade`d to this chart by using the same release name. For example, if a previous
+installation was done like:
+
+```console
+helm install istio-ingress manifests/charts/gateways/istio-ingress -n istio-system
+```
+
+It could be upgraded with
+
+```console
+helm upgrade istio-ingress manifests/charts/gateway -n istio-system --set name=istio-ingressgateway --set labels.app=istio-ingressgateway --set labels.istio=ingressgateway
+```
+
+Note the name and labels are overridden to match the names of the existing installation.
+
+Warning: the helm charts here default to using port 80 and 443, while the old charts used 8080 and 8443.
+If you have AuthorizationPolicies that reference port these ports, you should update them during this process,
+or customize the ports to match the old defaults.
+See the [security advisory](https://istio.io/latest/news/security/istio-security-2021-002/) for more information.
+
+#### Other migrations
+
+If you see errors like `rendered manifests contain a resource that already exists` during installation, you may need to forcibly take ownership.
+
+The script below can handle this for you. Replace `RELEASE` and `NAMESPACE` with the name and namespace of the release:
+
+```console
+KINDS=(service deployment)
+RELEASE=istio-ingressgateway
+NAMESPACE=istio-system
+for KIND in "${KINDS[@]}"; do
+    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-name=$RELEASE
+    kubectl --namespace $NAMESPACE --overwrite=true annotate $KIND $RELEASE meta.helm.sh/release-namespace=$NAMESPACE
+    kubectl --namespace $NAMESPACE --overwrite=true label $KIND $RELEASE app.kubernetes.io/managed-by=Helm
+done
+```
+
+You may ignore errors about resources not being found.
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-ambient.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-compatibility-version-1.25.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..3827ee78f
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,16 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+     # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-compatibility-version-1.26.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..b690d25ca
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-compatibility-version-1.27.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-compatibility-version-1.27.yaml
new file mode 100644
index 000000000..9f9ba7b67
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-compatibility-version-1.27.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-compatibility-version-1.28.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-compatibility-version-1.28.yaml
new file mode 100644
index 000000000..96d9c1f52
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-compatibility-version-1.28.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-demo.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-demo.yaml
new file mode 100644
index 000000000..d6dc36dd0
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-demo.yaml
@@ -0,0 +1,94 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The demo profile enables a variety of things to try out Istio in non-production environments.
+# * Lower resource utilization.
+# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
+# * More ports enabled on the ingress, which is used in some tasks.
+meshConfig:
+  accessLogFile: /dev/stdout
+  extensionProviders:
+    - name: otel
+      envoyOtelAls:
+        service: opentelemetry-collector.observability.svc.cluster.local
+        port: 4317
+    - name: skywalking
+      skywalking:
+        service: tracing.istio-system.svc.cluster.local
+        port: 11800
+    - name: otel-tracing
+      opentelemetry:
+        port: 4317
+        service: opentelemetry-collector.observability.svc.cluster.local
+    - name: jaeger
+      opentelemetry:
+        port: 4317
+        service: jaeger-collector.istio-system.svc.cluster.local        
+
+cni:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 40Mi
+
+ztunnel:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 40Mi
+
+global:
+  proxy:
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+  waypoint:
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+
+pilot:
+  autoscaleEnabled: false
+  traceSampling: 100
+  resources:
+    requests:
+      cpu: 10m
+      memory: 100Mi
+
+gateways:
+  istio-egressgateway:
+    autoscaleEnabled: false
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+  istio-ingressgateway:
+    autoscaleEnabled: false
+    ports:
+    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
+    # Note that AWS ELB will by default perform health checks on the first port
+    # on this list. Setting this to the health check port will ensure that health
+    # checks always work. https://github.com/istio/istio/issues/12503
+    - port: 15021
+      targetPort: 15021
+      name: status-port
+    - port: 80
+      targetPort: 8080
+      name: http2
+    - port: 443
+      targetPort: 8443
+      name: https
+    - port: 31400
+      targetPort: 31400
+      name: tcp
+      # This is the port where sni routing happens
+    - port: 15443
+      targetPort: 15443
+      name: tls
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-platform-gke.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.6/charts/gateway/files/profile-platform-k3d.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.6/charts/gateway/files/profile-platform-k3d.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-platform-k3d.yaml
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-platform-k3s.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-platform-k3s.yaml
new file mode 100644
index 000000000..07820106d
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-platform-k3s.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
+  cniBinDir: /var/lib/rancher/k3s/data/cni
diff --git a/resources/v1.24.6/charts/gateway/files/profile-platform-microk8s.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.6/charts/gateway/files/profile-platform-microk8s.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.6/charts/gateway/files/profile-platform-minikube.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.6/charts/gateway/files/profile-platform-minikube.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.6/charts/gateway/files/profile-platform-openshift.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.6/charts/gateway/files/profile-platform-openshift.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.6/charts/gateway/files/profile-preview.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.6/charts/gateway/files/profile-preview.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-preview.yaml
diff --git a/resources/v1.24.6/charts/gateway/files/profile-remote.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.6/charts/gateway/files/profile-remote.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-remote.yaml
diff --git a/resources/v1.24.6/charts/gateway/files/profile-stable.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.6/charts/gateway/files/profile-stable.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/gateway/files/profile-stable.yaml
diff --git a/resources/v1.24.6/charts/gateway/templates/NOTES.txt b/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.6/charts/gateway/templates/NOTES.txt
rename to resources/v1.29-alpha.b2f713a9/charts/gateway/templates/NOTES.txt
diff --git a/resources/v1.24.6/charts/gateway/templates/_helpers.tpl b/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.6/charts/gateway/templates/_helpers.tpl
rename to resources/v1.29-alpha.b2f713a9/charts/gateway/templates/_helpers.tpl
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/deployment.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/deployment.yaml
new file mode 100644
index 000000000..1d8f93a47
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/deployment.yaml
@@ -0,0 +1,145 @@
+apiVersion: apps/v1
+kind: {{ .Values.kind | default "Deployment" }}
+metadata:
+  name: {{ include "gateway.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "gateway.name" . }}
+    {{- include "istio.labels" . | nindent 4}}
+    {{- include "gateway.labels" . | nindent 4}}
+  annotations:
+    {{- .Values.annotations | toYaml | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  {{- if and (hasKey .Values "replicaCount") (ne .Values.replicaCount nil) }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  {{- end }}
+  {{- with .Values.strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.minReadySeconds }}
+  minReadySeconds: {{ . }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "gateway.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "gateway.sidecarInjectionLabels" . | nindent 8 }}
+        {{- include "gateway.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/name: {{ include "gateway.name" . }}
+        {{- include "istio.labels" .  | nindent 8}}
+        {{- range $key, $val := .Values.labels }}
+        {{- if and (ne $key "app") (ne $key "istio") }}
+        {{ $key | quote }}: {{ $val | quote }}
+        {{- end }}
+        {{- end }}
+        {{- with .Values.networkGateway }}
+        topology.istio.io/network: "{{.}}"
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
+      securityContext:
+      {{- if .Values.securityContext }}
+        {{- toYaml .Values.securityContext | nindent 8 }}
+      {{- else }}
+        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
+        sysctls:
+        - name: net.ipv4.ip_unprivileged_port_start
+          value: "0"
+      {{- end }}
+      {{- with .Values.volumes }}
+      volumes:
+        {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.initContainers }}
+      initContainers:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: istio-proxy
+          # "auto" will be populated at runtime by the mutating webhook. See https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#customizing-injection
+          image: auto
+          {{- with .Values.imagePullPolicy }}
+          imagePullPolicy: {{ . }}
+          {{- end }}
+          securityContext:
+          {{- if .Values.containerSecurityContext }}
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          {{- else }}
+            capabilities:
+              drop:
+              - ALL
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: true
+            {{- if not (eq (.Values.platform | default "") "openshift") }}
+            runAsUser: 1337
+            runAsGroup: 1337
+            {{- end }}
+            runAsNonRoot: true
+          {{- end }}
+          env:
+          {{- with .Values.networkGateway }}
+          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
+            value: "{{.}}"
+          {{- end }}
+          {{- range $key, $val := .Values.env }}
+          - name: {{ $key }}
+            value: {{ $val | quote }}
+          {{- end }}
+          {{- with .Values.envVarFrom }}
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+          ports:
+          - containerPort: 15090
+            protocol: TCP
+            name: http-envoy-prom
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          {{- with .Values.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.lifecycle }}
+          lifecycle:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      {{- with .Values.additionalContainers }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
+      {{- with .Values.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
diff --git a/resources/v1.24.6/charts/gateway/templates/hpa.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/hpa.yaml
similarity index 100%
rename from resources/v1.24.6/charts/gateway/templates/hpa.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/gateway/templates/hpa.yaml
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/networkpolicy.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/networkpolicy.yaml
new file mode 100644
index 000000000..ea2fab97b
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/networkpolicy.yaml
@@ -0,0 +1,47 @@
+{{- if (.Values.global.networkPolicy).enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "gateway.name" . }}{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ include "gateway.name" . }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Gateway"
+    istio: {{ (.Values.labels.istio | quote) | default (include "gateway.name" . | trimPrefix "istio-") }}
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ include "gateway.name" . }}
+    {{- include "gateway.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "gateway.selectorLabels" . | nindent 6 }}
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  # Status/health check port
+  - from: []
+    ports:
+    - protocol: TCP
+      port: 15021
+  # Metrics endpoints for monitoring/prometheus
+  - from: []
+    ports:
+    - protocol: TCP
+      port: 15020
+    - protocol: TCP
+      port: 15090
+  # Main gateway traffic ports
+{{- if .Values.service.ports }}
+{{- range .Values.service.ports }}
+  - from: []
+    ports:
+    - protocol: {{ .protocol | default "TCP" }}
+      port: {{ .targetPort | default .port }}
+{{- end }}
+{{- end }}
+  egress:
+  # Allow all egress (gateways need to reach external services, istiod, and other cluster services)
+  - {}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/poddisruptionbudget.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/poddisruptionbudget.yaml
new file mode 100644
index 000000000..91869a0ea
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/poddisruptionbudget.yaml
@@ -0,0 +1,21 @@
+{{- if .Values.podDisruptionBudget }}
+# a workaround for https://github.com/kubernetes/kubernetes/issues/93476
+{{- if or (and .Values.autoscaling.enabled  (gt (int .Values.autoscaling.minReplicas) 1)) (and (not .Values.autoscaling.enabled) (gt (int .Values.replicaCount) 1)) }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "gateway.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "gateway.name" . }}
+    {{- include "istio.labels" . | nindent 4}}
+    {{- include "gateway.labels" . | nindent 4}}
+spec:
+  selector:
+    matchLabels:
+  {{- include "gateway.selectorLabels" . | nindent 6 }}
+  {{- with .Values.podDisruptionBudget }}
+    {{- toYaml . | nindent 2 }}
+  {{- end }}
+{{- end }}
+{{- end }}
diff --git a/resources/v1.24.6/charts/gateway/templates/role.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/role.yaml
similarity index 100%
rename from resources/v1.24.6/charts/gateway/templates/role.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/gateway/templates/role.yaml
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/service.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/service.yaml
new file mode 100644
index 000000000..f555e6c63
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/service.yaml
@@ -0,0 +1,75 @@
+{{- if not (eq .Values.service.type "None") }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "gateway.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ include "gateway.name" . }}
+    {{- include "istio.labels" . | nindent 4}}
+    {{- include "gateway.labels" . | nindent 4 }}
+    {{- with .Values.networkGateway }}
+    topology.istio.io/network: "{{.}}"
+    {{- end }}
+  annotations:
+    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
+spec:
+{{- with .Values.service.loadBalancerIP }}
+  loadBalancerIP: "{{ . }}"
+{{- end }}
+{{- if eq .Values.service.type "LoadBalancer" }}
+  {{- if hasKey .Values.service "allocateLoadBalancerNodePorts" }}
+  allocateLoadBalancerNodePorts: {{ .Values.service.allocateLoadBalancerNodePorts }}
+  {{- end }}
+  {{- if hasKey .Values.service "loadBalancerClass" }}
+  loadBalancerClass: {{ .Values.service.loadBalancerClass }}
+  {{- end }}
+{{- end }}
+{{- if .Values.service.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
+{{- end }}
+{{- if .Values.service.ipFamilies }}
+  ipFamilies:
+{{- range .Values.service.ipFamilies }}
+  - {{ . }}
+{{- end }}
+{{- end }}
+{{- with .Values.service.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+{{ toYaml . | indent 4 }}
+{{- end }}
+{{- with .Values.service.externalTrafficPolicy }}
+  externalTrafficPolicy: "{{ . }}"
+{{- end }}
+{{- with .Values.service.internalTrafficPolicy }}
+  internalTrafficPolicy: "{{ . }}"
+{{- end }}
+  type: {{ .Values.service.type }}
+{{- if not (eq .Values.service.clusterIP "") }}
+  clusterIP: {{ .Values.service.clusterIP }}
+{{- end }}
+  ports:
+{{- if .Values.networkGateway }}
+  - name: status-port
+    port: 15021
+    targetPort: 15021
+  - name: tls
+    port: 15443
+    targetPort: 15443
+  - name: tls-istiod
+    port: 15012
+    targetPort: 15012
+  - name: tls-webhook
+    port: 15017
+    targetPort: 15017
+{{- else }}
+{{ .Values.service.ports | toYaml | indent 4 }}
+{{- end }}
+{{- if .Values.service.externalIPs }}
+  externalIPs: {{- range .Values.service.externalIPs }}
+    - {{.}}
+  {{- end }}
+{{- end }}
+  selector:
+    {{- include "gateway.selectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/resources/v1.24.6/charts/gateway/templates/serviceaccount.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/serviceaccount.yaml
similarity index 100%
rename from resources/v1.24.6/charts/gateway/templates/serviceaccount.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/gateway/templates/serviceaccount.yaml
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/zzz_profile.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/zzz_profile.yaml
new file mode 100644
index 000000000..606c55669
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if true }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/values.schema.json b/resources/v1.29-alpha.b2f713a9/charts/gateway/values.schema.json
new file mode 100644
index 000000000..739a67b77
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/values.schema.json
@@ -0,0 +1,353 @@
+{
+  "$schema": "http://json-schema.org/schema#",
+  "$defs": {
+    "values": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "_internal_defaults_do_not_set": {
+          "type": "object"
+        },
+        "global": {
+          "type": "object"
+        },
+        "affinity": {
+          "type": "object"
+        },
+        "securityContext": {
+          "type": [
+            "object",
+            "null"
+          ]
+        },
+        "containerSecurityContext": {
+          "type": [
+            "object",
+            "null"
+          ]
+        },
+        "kind": {
+          "type": "string",
+          "enum": [
+            "Deployment",
+            "DaemonSet"
+          ]
+        },
+        "annotations": {
+          "additionalProperties": {
+            "type": [
+              "string",
+              "integer"
+            ]
+          },
+          "type": "object"
+        },
+        "autoscaling": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            },
+            "maxReplicas": {
+              "type": "integer"
+            },
+            "minReplicas": {
+              "type": "integer"
+            },
+            "targetCPUUtilizationPercentage": {
+              "type": "integer"
+            }
+          }
+        },
+        "env": {
+          "type": "object"
+        },
+        "envVarFrom": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": { "type": "string" },
+              "valueFrom": { "type": "object" }
+            }
+          }
+        },
+        "strategy": {
+          "type": "object"
+        },
+        "minReadySeconds": {
+          "type": [ "null", "integer" ]
+        },
+        "readinessProbe": {
+          "type": [ "null", "object" ]
+        },
+        "labels": {
+          "type": "object"
+        },
+        "name": {
+          "type": "string"
+        },
+        "nodeSelector": {
+          "type": "object"
+        },
+        "podAnnotations": {
+          "type": "object",
+          "properties": {
+            "inject.istio.io/templates": {
+              "type": "string"
+            },
+            "prometheus.io/path": {
+              "type": "string"
+            },
+            "prometheus.io/port": {
+              "type": "string"
+            },
+            "prometheus.io/scrape": {
+              "type": "string"
+            }
+          }
+        },
+        "replicaCount": {
+          "type": [
+            "integer",
+            "null"
+          ]
+        },
+        "resources": {
+          "type": "object",
+          "properties": {
+            "limits": {
+              "type": ["object", "null"],
+              "properties": {
+                "cpu": {
+                  "type": ["string", "null"]
+                },
+                "memory": {
+                  "type": ["string", "null"]
+                }
+              }
+            },
+            "requests": {
+              "type": ["object", "null"],
+              "properties": {
+                "cpu": {
+                  "type": ["string", "null"]
+                },
+                "memory": {
+                  "type": ["string", "null"]
+                }
+              }
+            }
+          }
+        },
+        "revision": {
+          "type": "string"
+        },
+        "defaultRevision": {
+          "type": "string"
+        },
+        "compatibilityVersion": {
+          "type": "string"
+        },
+        "profile": {
+          "type": "string"
+        },
+        "platform": {
+          "type": "string"
+        },
+        "pilot": {
+          "type": "object"
+        },
+        "runAsRoot": {
+          "type": "boolean"
+        },
+        "unprivilegedPort": {
+          "type": [
+            "string",
+            "boolean"
+          ],
+          "enum": [
+            true,
+            false,
+            "auto"
+          ]
+        },
+        "service": {
+          "type": "object",
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "externalTrafficPolicy": {
+              "type": "string"
+            },
+            "loadBalancerIP": {
+              "type": "string"
+            },
+            "loadBalancerSourceRanges": {
+              "type": "array"
+            },
+            "ipFamilies": {
+              "items": {
+                "type": "string",
+                "enum": [
+                  "IPv4",
+                  "IPv6"
+                ]
+              }
+            },
+            "ipFamilyPolicy": {
+              "type": "string",
+              "enum": [
+                "",
+                "SingleStack",
+                "PreferDualStack",
+                "RequireDualStack"
+              ]
+            },
+            "ports": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": {
+                    "type": "string"
+                  },
+                  "port": {
+                    "type": "integer"
+                  },
+                  "protocol": {
+                    "type": "string"
+                  },
+                  "targetPort": {
+                    "type": "integer"
+                  }
+                }
+              }
+            },
+            "type": {
+              "type": "string"
+            }
+          }
+        },
+        "serviceAccount": {
+          "type": "object",
+          "properties": {
+            "annotations": {
+              "type": "object"
+            },
+            "name": {
+              "type": "string"
+            },
+            "create": {
+              "type": "boolean"
+            }
+          }
+        },
+        "rbac": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            }
+          }
+        },
+        "tolerations": {
+          "type": "array"
+        },
+        "topologySpreadConstraints": {
+          "type": "array"
+        },
+        "networkGateway": {
+          "type": "string"
+        },
+        "imagePullPolicy": {
+          "type": "string",
+          "enum": [
+            "",
+            "Always",
+            "IfNotPresent",
+            "Never"
+          ]
+        },
+        "imagePullSecrets": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "name": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "podDisruptionBudget": {
+          "type": "object",
+          "properties": {
+            "minAvailable": {
+              "type": [
+                "integer",
+                "string"
+              ]
+            },
+            "maxUnavailable": {
+              "type": [
+                "integer",
+                "string"
+              ]
+            },
+            "unhealthyPodEvictionPolicy": {
+              "type": "string",
+              "enum": [
+                "",
+                "IfHealthyBudget",
+                "AlwaysAllow"
+              ]
+            }
+          }
+        },
+        "terminationGracePeriodSeconds": {
+          "type": "number"
+        },
+        "volumes": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "volumeMounts": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "initContainers": {
+          "type": "array",
+          "items": { "type": "object" }
+        },
+        "additionalContainers": {
+          "type": "array",
+          "items": { "type": "object" }
+        },
+        "priorityClassName": {
+          "type": "string"
+        },
+        "lifecycle": {
+          "type": "object",
+          "properties": {
+            "postStart": {
+              "type": "object"
+            },
+            "preStop": {
+              "type": "object"
+            }
+          }
+        }
+      }
+    }
+  },
+  "defaults": {
+    "$ref": "#/$defs/values"
+  },
+  "$ref": "#/$defs/values"
+}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/gateway/values.yaml b/resources/v1.29-alpha.b2f713a9/charts/gateway/values.yaml
new file mode 100644
index 000000000..9975f9285
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/gateway/values.yaml
@@ -0,0 +1,202 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  # Name allows overriding the release name. Generally this should not be set
+  name: ""
+  # revision declares which revision this gateway is a part of
+  revision: ""
+
+  # Controls the spec.replicas setting for the Gateway deployment if set.
+  # Otherwise defaults to Kubernetes Deployment default (1).
+  replicaCount:
+
+  kind: Deployment
+
+  rbac:
+    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
+    # when using http://gateway-api.org/.
+    enabled: true
+
+  serviceAccount:
+    # If set, a service account will be created. Otherwise, the default is used
+    create: true
+    # Annotations to add to the service account
+    annotations: {}
+    # The name of the service account to use.
+    # If not set, the release name is used
+    name: ""
+
+  podAnnotations:
+    prometheus.io/port: "15020"
+    prometheus.io/scrape: "true"
+    prometheus.io/path: "/stats/prometheus"
+    inject.istio.io/templates: "gateway"
+    sidecar.istio.io/inject: "true"
+
+  # Define the security context for the pod.
+  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+  securityContext: {}
+  containerSecurityContext: {}
+
+  service:
+    # Type of service. Set to "None" to disable the service entirely
+    type: LoadBalancer
+    # Set to a specific ClusterIP, or "" for automatic assignment
+    clusterIP: ""
+    ports:
+    - name: status-port
+      port: 15021
+      protocol: TCP
+      targetPort: 15021
+    - name: http2
+      port: 80
+      protocol: TCP
+      targetPort: 80
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 443
+    annotations: {}
+    loadBalancerIP: ""
+    loadBalancerSourceRanges: []
+    externalTrafficPolicy: ""
+    externalIPs: []
+    ipFamilyPolicy: ""
+    ipFamilies: []
+    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
+    # allocateLoadBalancerNodePorts: false
+    ## Set LoadBalancer class (only for LoadBalancers).
+    # loadBalancerClass: ""
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 2000m
+      memory: 1024Mi
+
+  autoscaling:
+    enabled: true
+    minReplicas: 1
+    maxReplicas: 5
+    targetCPUUtilizationPercentage: 80
+    targetMemoryUtilizationPercentage: {}
+    autoscaleBehavior: {}
+
+  # Pod environment variables
+  env: {}
+
+  # Use envVarFrom to define full environment variable entries with complex sources,
+  # such as valueFrom.secretKeyRef, valueFrom.configMapKeyRef. Each item must include a `name` and `valueFrom`.
+  #
+  # Example:
+  # envVarFrom:
+  #   - name: EXAMPLE_SECRET
+  #     valueFrom:
+  #       secretKeyRef:
+  #         name: example-name
+  #         key: example-key
+  envVarFrom: []
+
+  # Deployment Update strategy
+  strategy: {}
+  
+  # Sets the Deployment minReadySeconds value
+  minReadySeconds:
+  
+  # Optionally configure a custom readinessProbe. By default the control plane
+  # automatically injects the readinessProbe. If you wish to override that
+  # behavior, you may define your own readinessProbe here.
+  readinessProbe: {}
+
+  # Labels to apply to all resources
+  labels:
+    # By default, don't enroll gateways into the ambient dataplane
+    "istio.io/dataplane-mode": none
+
+  # Annotations to apply to all resources
+  annotations: {}
+
+  nodeSelector: {}
+
+  tolerations: []
+
+  topologySpreadConstraints: []
+
+  affinity: {}
+
+  # If specified, the gateway will act as a network gateway for the given network.
+  networkGateway: ""
+
+  # Specify image pull policy if default behavior isn't desired.
+  # Default behavior: latest images will be Always else IfNotPresent
+  imagePullPolicy: ""
+
+  imagePullSecrets: []
+
+  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
+  #
+  # By default, the `podDisruptionBudget` is disabled (set to `{}`),
+  # which means that no PodDisruptionBudget resource will be created.
+  #
+  # The PodDisruptionBudget can be only enabled if autoscaling is enabled
+  # with minReplicas > 1 or if autoscaling is disabled but replicaCount > 1.
+  #
+  # To enable the PodDisruptionBudget, configure it by specifying the
+  # `minAvailable` or `maxUnavailable`. For example, to set the
+  # minimum number of available replicas to 1, you can update this value as follows:
+  #
+  # podDisruptionBudget:
+  #   minAvailable: 1
+  #
+  # Or, to allow a maximum of 1 unavailable replica, you can set:
+  #
+  # podDisruptionBudget:
+  #   maxUnavailable: 1
+  #
+  # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`.
+  # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows:
+  #
+  # podDisruptionBudget:
+  #   minAvailable: 1
+  #   unhealthyPodEvictionPolicy: AlwaysAllow
+  #
+  # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`:
+  #
+  # podDisruptionBudget: {}
+  #
+  podDisruptionBudget: {}
+
+  # Sets the per-pod terminationGracePeriodSeconds setting.
+  terminationGracePeriodSeconds: 30
+
+  # A list of `Volumes` added into the Gateway Pods. See
+  # https://kubernetes.io/docs/concepts/storage/volumes/.
+  volumes: []
+
+  # A list of `VolumeMounts` added into the Gateway Pods. See
+  # https://kubernetes.io/docs/concepts/storage/volumes/.
+  volumeMounts: []
+
+  # Inject initContainers into the Gateway Pods.
+  initContainers: []
+
+  # Inject additional containers into the Gateway Pods.
+  additionalContainers: []
+
+  # Configure this to a higher priority class in order to make sure your Istio gateway pods
+  # will not be killed because of low priority class.
+  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+  # for more detail.
+  priorityClassName: ""
+
+  # Configure the lifecycle hooks for the gateway. See
+  # https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/.
+  lifecycle: {}
+
+  # When enabled, a default NetworkPolicy for gateways will be created
+  global:
+    networkPolicy:
+      enabled: false
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/Chart.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/Chart.yaml
new file mode 100644
index 000000000..6258afec3
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v2
+appVersion: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+description: Helm chart for istio control plane
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio
+- istiod
+- istio-discovery
+name: istiod
+sources:
+- https://github.com/istio/istio
+version: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/README.md b/resources/v1.29-alpha.b2f713a9/charts/istiod/README.md
new file mode 100644
index 000000000..44f7b1d8c
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/README.md
@@ -0,0 +1,73 @@
+# Istiod Helm Chart
+
+This chart installs an Istiod deployment.
+
+## Setup Repo Info
+
+```console
+helm repo add istio https://istio-release.storage.googleapis.com/charts
+helm repo update
+```
+
+_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
+
+## Installing the Chart
+
+Before installing, ensure CRDs are installed in the cluster (from the `istio/base` chart).
+
+To install the chart with the release name `istiod`:
+
+```console
+kubectl create namespace istio-system
+helm install istiod istio/istiod --namespace istio-system
+```
+
+## Uninstalling the Chart
+
+To uninstall/delete the `istiod` deployment:
+
+```console
+helm delete istiod --namespace istio-system
+```
+
+## Configuration
+
+To view supported configuration options and documentation, run:
+
+```console
+helm show values istio/istiod
+```
+
+### Profiles
+
+Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
+These can be set with `--set profile=<profile>`.
+For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
+
+For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
+
+Explicitly set values have highest priority, then profile settings, then chart defaults.
+
+As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
+When configuring the chart, you should not include this.
+That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
+
+### Examples
+
+#### Configuring mesh configuration settings
+
+Any [Mesh Config](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/) options can be configured like below:
+
+```yaml
+meshConfig:
+  accessLogFile: /dev/stdout
+```
+
+#### Revisions
+
+Control plane revisions allow deploying multiple versions of the control plane in the same cluster.
+This allows safe [canary upgrades](https://istio.io/latest/docs/setup/upgrade/canary/)
+
+```yaml
+revision: my-revision-name
+```
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/files/gateway-injection-template.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/gateway-injection-template.yaml
new file mode 100644
index 000000000..3b7c71cfa
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/gateway-injection-template.yaml
@@ -0,0 +1,277 @@
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations:
+    istio.io/rev: {{ .Revision | default "default" | quote }}
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}"
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}"
+    {{- end }}
+    {{- end }}
+spec:
+  securityContext:
+  {{- if .Values.gateways.securityContext }}
+    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
+  {{- else }}
+    sysctls:
+    - name: net.ipv4.ip_unprivileged_port_start
+      value: "0"
+  {{- end }}
+  containers:
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    ports:
+    - containerPort: 15090
+      protocol: TCP
+      name: http-envoy-prom
+    args:
+    - proxy
+    - router
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+  {{- if .Values.global.proxy.lifecycle }}
+    lifecycle:
+      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
+  {{- end }}
+    securityContext:
+      runAsUser: {{ .ProxyUID | default "1337" }}
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+    env:
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: ISTIO_CPU_LIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+          divisor: "1"
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: GOMEMLIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.memory
+          divisor: "1"
+    - name: GOMAXPROCS
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+          divisor: "1"
+    {{- if .CompliancePolicy }}
+    - name: COMPLIANCE_POLICY
+      value: "{{ .CompliancePolicy }}"
+    {{- end }}
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    - name: ISTIO_META_INTERCEPTION_MODE
+      value: "{{ .ProxyConfig.InterceptionMode.String }}"
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- if .DeploymentMeta.Name }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ .DeploymentMeta.Name }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - name: ISTIO_BOOTSTRAP_OVERRIDE
+      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
+    {{- end }}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    - name: credential-socket
+      mountPath: /var/run/secrets/credential-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - mountPath: /etc/istio/custom-bootstrap
+      name: custom-bootstrap-volume
+    {{- end }}
+    # SDS channel between istioagent and Envoy
+    - mountPath: /etc/istio/proxy
+      name: istio-envoy
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+  volumes:
+  - emptyDir:
+    name: workload-socket
+  - emptyDir: {}
+    name: credential-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else}}
+  - emptyDir: {}
+    name: workload-certs
+  {{- end }}
+  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+  - name: custom-bootstrap-volume
+    configMap:
+      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-envoy
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+          name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+          path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/files/grpc-agent.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/grpc-agent.yaml
new file mode 100644
index 000000000..6e3102e4c
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/grpc-agent.yaml
@@ -0,0 +1,318 @@
+{{- define "resources"  }}
+  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
+      requests:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
+        {{ end }}
+    {{- end }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+      limits:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
+        {{ end }}
+    {{- end }}
+  {{- else }}
+    {{- if .Values.global.proxy.resources }}
+      {{ toYaml .Values.global.proxy.resources | indent 6 }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations: {
+    istio.io/rev: {{ .Revision | default "default" | quote }},
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- end }}
+    sidecar.istio.io/rewriteAppHTTPProbers: "false",
+  }
+spec:
+  containers:
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    ports:
+    - containerPort: 15020
+      protocol: TCP
+      name: mesh-metrics
+    args:
+    - proxy
+    - sidecar
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+    lifecycle:
+      postStart:
+        exec:
+          command:
+          - pilot-agent
+          - wait
+          - --url=http://localhost:15020/healthz/ready
+    env:
+    - name: ISTIO_META_GENERATOR
+      value: grpc
+    - name: OUTPUT_CERTS
+      value: /var/lib/istio/data
+    {{- if eq .InboundTrafficPolicyMode "localhost" }}
+    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
+      value: "true"
+    {{- end }}
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- if .DeploymentMeta.Name }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ .DeploymentMeta.Name }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    # grpc uses xds:/// to resolve – no need to resolve VIP
+    - name: ISTIO_META_DNS_CAPTURE
+      value: "false"
+    - name: DISABLE_ENVOY
+      value: "true"
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15020
+      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
+    resources:
+  {{ template "resources" . }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    # UDS channel between istioagent and gRPC client for XDS/SDS
+    - mountPath: /etc/istio/proxy
+      name: istio-xds
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+    {{- end }}
+      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
+      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
+    - name: "{{  $index }}"
+      {{ toYaml $value | indent 6 }}
+      {{ end }}
+      {{- end }}
+{{- range $index, $container := .Spec.Containers  }}
+{{ if not (eq $container.Name "istio-proxy") }}
+  - name: {{ $container.Name }}
+    env:
+      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
+        value: "true"
+      - name: "GRPC_XDS_BOOTSTRAP"
+        value: "/etc/istio/proxy/grpc-bootstrap.json"
+    volumeMounts:
+      - mountPath: /var/lib/istio/data
+        name: istio-data
+      # UDS channel between istioagent and gRPC client for XDS/SDS
+      - mountPath: /etc/istio/proxy
+        name: istio-xds
+      {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }}
+      - name: gke-workload-certificate
+        mountPath: /var/run/secrets/workload-spiffe-credentials
+        readOnly: true
+      {{- else }}
+      - name: workload-certs
+        mountPath: /var/run/secrets/workload-spiffe-credentials
+      {{- end }}
+{{- end }}
+{{- end }}
+  volumes:
+  - emptyDir:
+    name: workload-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else }}
+  - emptyDir:
+    name: workload-certs
+  {{- end }}
+  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+  - name: custom-bootstrap-volume
+    configMap:
+      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-xds
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+          name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+          path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
+    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
+  - name: "{{ $index }}"
+    {{ toYaml $value | indent 4 }}
+    {{ end }}
+    {{ end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.24.6/charts/istiod/files/grpc-simple.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/grpc-simple.yaml
similarity index 100%
rename from resources/v1.24.6/charts/istiod/files/grpc-simple.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/istiod/files/grpc-simple.yaml
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/files/injection-template.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/injection-template.yaml
new file mode 100644
index 000000000..39210a5e2
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/injection-template.yaml
@@ -0,0 +1,552 @@
+{{- define "resources"  }}
+  {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }}
+      requests:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` }}"
+        {{ end }}
+    {{- end }}
+    {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }}
+      limits:
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}}
+        cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` }}"
+        {{ end }}
+        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
+        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
+        {{ end }}
+    {{- end }}
+  {{- else }}
+    {{- if .Values.global.proxy.resources }}
+      {{ toYaml .Values.global.proxy.resources | indent 6 }}
+    {{- end }}
+  {{- end }}
+{{- end }}
+{{ $tproxy := (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) }}
+{{ $capNetBindService := (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) }}
+{{ $nativeSidecar := ne (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar` | default (printf "%t" .NativeSidecars)) "false" }}
+{{- $containers := list }}
+{{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}}
+metadata:
+  labels:
+    security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio"  | quote }}
+    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
+    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
+    {{- end }}
+    service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | trunc 63 | trimSuffix "-" | quote }}
+    service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest"  | quote }}
+  annotations: {
+    istio.io/rev: {{ .Revision | default "default" | quote }},
+    {{- if ge (len $containers) 1 }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
+    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
+    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
+    {{- end }}
+    {{- end }}
+{{- if .Values.pilot.cni.enabled }}
+    {{- if eq .Values.pilot.cni.provider "multus" }}
+    k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}',
+    {{- end }}
+    sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}",
+    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }}
+    {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }}
+    traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}",
+    traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}",
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }}
+    traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}",
+    {{- end }}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }}
+    traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}",
+    {{- end }}
+    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
+    {{ with index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}istio.io/reroute-virtual-interfaces: "{{.}}",{{ end }}
+    {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
+{{- end }}
+  }
+spec:
+  {{- $holdProxy := and
+      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
+      (not $nativeSidecar) }}
+  {{- $noInitContainer := and
+      (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE`)
+      (not $nativeSidecar) }}
+  {{ if $noInitContainer }}
+  initContainers: []
+  {{ else -}}
+  initContainers:
+  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
+  {{ if .Values.pilot.cni.enabled -}}
+  - name: istio-validation
+  {{ else -}}
+  - name: istio-init
+  {{ end -}}
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    args:
+    - istio-iptables
+    - "-p"
+    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
+    - "-z"
+    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
+    - "-u"
+    - {{ if $tproxy }} "1337" {{ else }} {{ .ProxyUID | default "1337" | quote }} {{ end }}
+    - "-m"
+    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"
+    - "-i"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}"
+    - "-x"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}"
+    - "-b"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}"
+    - "-d"
+  {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}
+    - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}"
+  {{- else }}
+    - "15090,15021"
+  {{- end }}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}}
+    - "-q"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}"
+    {{ end -}}
+    {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}}
+    - "-o"
+    - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}"
+    {{ end -}}
+    {{ if (isset .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces`) -}}
+    - "-k"
+    - "{{ index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}"
+    {{ else if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}}
+    - "-k"
+    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}"
+    {{ end -}}
+     {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}}
+    - "-c"
+    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
+    {{ end -}}
+    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
+    {{ if .Values.global.logAsJson -}}
+    - "--log_as_json"
+    {{ end -}}
+    {{ if .Values.pilot.cni.enabled -}}
+    - "--run-validation"
+    - "--skip-rule-apply"
+    {{ else if .Values.global.proxy_init.forceApplyIptables -}}
+    - "--force-apply"
+    {{ end -}}
+    {{ if .Values.global.nativeNftables -}}
+    - "--native-nftables"
+    {{ end -}}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+  {{- if .ProxyConfig.ProxyMetadata }}
+    env:
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+  {{- end }}
+    resources:
+  {{ template "resources" . }}
+    securityContext:
+      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
+      privileged: {{ .Values.global.proxy.privileged }}
+      capabilities:
+    {{- if not .Values.pilot.cni.enabled }}
+        add:
+        - NET_ADMIN
+        - NET_RAW
+    {{- end }}
+        drop:
+        - ALL
+    {{- if not .Values.pilot.cni.enabled }}
+      readOnlyRootFilesystem: false
+      runAsGroup: 0
+      runAsNonRoot: false
+      runAsUser: 0
+    {{- else }}
+      readOnlyRootFilesystem: true
+      runAsGroup: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyGID | default "1337" }} {{ end }}
+      runAsUser: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyUID | default "1337" }} {{ end }}
+      runAsNonRoot: true
+    {{- end }}
+    {{- if .Values.global.proxy.seccompProfile }}
+      seccompProfile:
+    {{- toYaml .Values.global.proxy.seccompProfile | nindent 8 }}
+    {{- end }}
+  {{ end -}}
+  {{ end -}}
+  {{ if not $nativeSidecar }}
+  containers:
+  {{ end }}
+  - name: istio-proxy
+  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+  {{- else }}
+    image: "{{ .ProxyImage }}"
+  {{- end }}
+    {{ if $nativeSidecar }}restartPolicy: Always{{end}}
+    ports:
+    - containerPort: 15090
+      protocol: TCP
+      name: http-envoy-prom
+    args:
+    - proxy
+    - sidecar
+    - --domain
+    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}
+    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
+    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
+  {{- if .Values.global.sts.servicePort }}
+    - --stsPort={{ .Values.global.sts.servicePort }}
+  {{- end }}
+  {{- if .Values.global.logAsJson }}
+    - --log_as_json
+  {{- end }}
+  {{- if .Values.global.proxy.outlierLogPath }}
+    - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
+  {{- end}}
+  {{- if .Values.global.proxy.lifecycle }}
+    lifecycle:
+      {{ toYaml .Values.global.proxy.lifecycle | indent 6 }}
+  {{- else if $holdProxy }}
+    lifecycle:
+      postStart:
+        exec:
+          command:
+          - pilot-agent
+          - wait
+  {{- else if $nativeSidecar }}
+    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
+    lifecycle:
+      preStop:
+        exec:
+          command:
+          - pilot-agent
+          - request
+          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
+          - POST
+          - drain
+  {{- end }}
+    env:
+    {{- if eq .InboundTrafficPolicyMode "localhost" }}
+    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
+      value: "true"
+    {{- end }}
+    - name: PILOT_CERT_PROVIDER
+      value: {{ .Values.global.pilotCertProvider }}
+    - name: CA_ADDR
+    {{- if .Values.global.caAddress }}
+      value: {{ .Values.global.caAddress }}
+    {{- else }}
+      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+    {{- end }}
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: ISTIO_CPU_LIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+          divisor: "1"
+    - name: PROXY_CONFIG
+      value: |
+             {{ protoToJSON .ProxyConfig }}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+        {{- $first := true }}
+        {{- range $index1, $c := .Spec.Containers }}
+          {{- range $index2, $p := $c.Ports }}
+            {{- if (structToJSON $p) }}
+            {{if not $first}},{{end}}{{ structToJSON $p }}
+            {{- $first = false }}
+            {{- end }}
+          {{- end}}
+        {{- end}}
+        ]
+    - name: ISTIO_META_APP_CONTAINERS
+      value: "{{ $containers | join "," }}"
+    - name: GOMEMLIMIT
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.memory
+          divisor: "1"
+    - name: GOMAXPROCS
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.cpu
+          divisor: "1"
+    {{- if .CompliancePolicy }}
+    - name: COMPLIANCE_POLICY
+      value: "{{ .CompliancePolicy }}"
+    {{- end }}
+    - name: ISTIO_META_CLUSTER_ID
+      value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    - name: ISTIO_META_INTERCEPTION_MODE
+      value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
+    {{- if .Values.global.network }}
+    - name: ISTIO_META_NETWORK
+      value: "{{ .Values.global.network }}"
+    {{- end }}
+    {{- with (index .ObjectMeta.Labels `service.istio.io/workload-name` | default .DeploymentMeta.Name) }}
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: "{{ . }}"
+    {{ end }}
+    {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }}
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }}
+    {{- end}}
+    {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - name: ISTIO_BOOTSTRAP_OVERRIDE
+      value: "/etc/istio/custom-bootstrap/custom_bootstrap.json"
+    {{- end }}
+    {{- if .Values.global.meshID }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ .Values.global.meshID }}"
+    {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+    - name: ISTIO_META_MESH_ID
+      value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+    {{- end }}
+    {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+    - name: TRUST_DOMAIN
+      value: "{{ . }}"
+    {{- end }}
+    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
+    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{- end }}
+    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+    - name: {{ $key }}
+      value: "{{ $value }}"
+    {{- end }}
+    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+    {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }}
+  {{ if .Values.global.proxy.startupProbe.enabled }}
+    startupProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: 0
+      periodSeconds: 1
+      timeoutSeconds: 3
+      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
+  {{ end }}
+    readinessProbe:
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }}
+      periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }}
+      timeoutSeconds: 3
+      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
+    {{ end -}}
+    securityContext:
+      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
+      allowPrivilegeEscalation: true
+      capabilities:
+        add:
+        - NET_ADMIN
+        drop:
+        - ALL
+      privileged: true
+      readOnlyRootFilesystem: true
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+      runAsNonRoot: false
+      runAsUser: 0
+      {{- else }}
+      allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
+      capabilities:
+        {{ if or $tproxy $capNetBindService -}}
+        add:
+        {{ if $tproxy -}}
+        - NET_ADMIN
+        {{- end }}
+        {{ if $capNetBindService -}}
+        - NET_BIND_SERVICE
+        {{- end }}
+        {{- end }}
+        drop:
+        - ALL
+      privileged: {{ .Values.global.proxy.privileged }}
+      readOnlyRootFilesystem: true
+      {{ if or $tproxy $capNetBindService -}}
+      runAsNonRoot: false
+      runAsUser: 0
+      runAsGroup: 1337
+      {{- else -}}
+      runAsNonRoot: true
+      runAsUser: {{ .ProxyUID | default "1337" }}
+      runAsGroup: {{ .ProxyGID | default "1337" }}
+      {{- end }}
+      {{- end }}
+    {{- if .Values.global.proxy.seccompProfile }}
+      seccompProfile:
+    {{- toYaml .Values.global.proxy.seccompProfile | nindent 8 }}
+    {{- end }}
+    resources:
+  {{ template "resources" . }}
+    volumeMounts:
+    - name: workload-socket
+      mountPath: /var/run/secrets/workload-spiffe-uds
+    - name: credential-socket
+      mountPath: /var/run/secrets/credential-uds
+    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+    - name: gke-workload-certificate
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+      readOnly: true
+    {{- else }}
+    - name: workload-certs
+      mountPath: /var/run/secrets/workload-spiffe-credentials
+    {{- end }}
+    {{- if eq .Values.global.pilotCertProvider "istiod" }}
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    - mountPath: /var/run/secrets/istio/crl
+      name: istio-ca-crl
+    {{- end }}
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+    - mountPath: /etc/istio/custom-bootstrap
+      name: custom-bootstrap-volume
+    {{- end }}
+    # SDS channel between istioagent and Envoy
+    - mountPath: /etc/istio/proxy
+      name: istio-envoy
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    {{- if .Values.global.mountMtlsCerts }}
+    # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+    - mountPath: /etc/certs/
+      name: istio-certs
+      readOnly: true
+    {{- end }}
+    - name: istio-podinfo
+      mountPath: /etc/istio/pod
+     {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
+    - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }}
+      name: lightstep-certs
+      readOnly: true
+    {{- end }}
+      {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }}
+      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
+    - name: "{{  $index }}"
+      {{ toYaml $value | indent 6 }}
+      {{ end }}
+      {{- end }}
+  volumes:
+  - emptyDir:
+    name: workload-socket
+  - emptyDir:
+    name: credential-socket
+  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+  - name: gke-workload-certificate
+    csi:
+      driver: workloadcertificates.security.cloud.google.com
+  {{- else }}
+  - emptyDir:
+    name: workload-certs
+  {{- end }}
+  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
+  - name: custom-bootstrap-volume
+    configMap:
+      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
+  {{- end }}
+  # SDS channel between istioagent and Envoy
+  - emptyDir:
+      medium: Memory
+    name: istio-envoy
+  - name: istio-data
+    emptyDir: {}
+  - name: istio-podinfo
+    downwardAPI:
+      items:
+        - path: "labels"
+          fieldRef:
+            fieldPath: metadata.labels
+        - path: "annotations"
+          fieldRef:
+            fieldPath: metadata.annotations
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          path: istio-token
+          expirationSeconds: 43200
+          audience: {{ .Values.global.sds.token.aud }}
+  {{- if eq .Values.global.pilotCertProvider "istiod" }}
+  - name: istiod-ca-cert
+  {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+    projected:
+      sources:
+      - clusterTrustBundle:
+          name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+          path: root-cert.pem
+  {{- else }}
+    configMap:
+      name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+  {{- end }}
+  {{- end }}
+  - name: istio-ca-crl
+    configMap:
+      name: {{ .Values.pilot.crlConfigMapName | default "istio-ca-crl" }}
+      optional: true
+  {{- if .Values.global.mountMtlsCerts }}
+  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
+  - name: istio-certs
+    secret:
+      optional: true
+      {{ if eq .Spec.ServiceAccountName "" }}
+      secretName: istio.default
+      {{ else -}}
+      secretName: {{  printf "istio.%s" .Spec.ServiceAccountName }}
+      {{  end -}}
+  {{- end }}
+    {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }}
+    {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }}
+  - name: "{{ $index }}"
+    {{ toYaml $value | indent 4 }}
+    {{ end }}
+    {{ end }}
+  {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }}
+  - name: lightstep-certs
+    secret:
+      optional: true
+      secretName: lightstep.cacert
+  {{- end }}
+  {{- if .Values.global.imagePullSecrets }}
+  imagePullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . }}
+    {{- end }}
+  {{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/files/kube-gateway.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/kube-gateway.yaml
new file mode 100644
index 000000000..2ddb473fd
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/kube-gateway.yaml
@@ -0,0 +1,410 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{.ServiceAccount | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.networking.k8s.io/gateway-class-name" .GatewayClass
+      ) | nindent 4 }}
+  {{- if ge .KubeVersion 128 }}
+  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+  {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.networking.k8s.io/gateway-class-name" .GatewayClass
+        "gateway.istio.io/managed" "istio.io-gateway-controller"
+      ) | nindent 4 }}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: {{.Name}}
+    uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      "{{.GatewayNameLabel}}": {{.Name}}
+  template:
+    metadata:
+      annotations:
+        {{- toJsonMap
+          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
+          (strdict "istio.io/rev" (.Revision | default "default"))
+          (strdict
+            "prometheus.io/path" "/stats/prometheus"
+            "prometheus.io/port" "15020"
+            "prometheus.io/scrape" "true"
+          ) | nindent 8 }}
+      labels:
+        {{- toJsonMap
+          (strdict
+            "sidecar.istio.io/inject" "false"
+            "service.istio.io/canonical-name" .DeploymentName
+            "service.istio.io/canonical-revision" "latest"
+           )
+          .InfrastructureLabels
+          (strdict
+            "gateway.networking.k8s.io/gateway-name" .Name
+            "gateway.networking.k8s.io/gateway-class-name" .GatewayClass
+            "gateway.istio.io/managed" "istio.io-gateway-controller"
+          ) | nindent 8 }}
+    spec:
+      securityContext:
+      {{- if .Values.gateways.securityContext }}
+        {{- toYaml .Values.gateways.securityContext | nindent 8 }}
+      {{- else }}
+        sysctls:
+        - name: net.ipv4.ip_unprivileged_port_start
+          value: "0"
+      {{- if .Values.gateways.seccompProfile }}
+        seccompProfile:
+      {{- toYaml .Values.gateways.seccompProfile | nindent 10 }}
+      {{- end }}
+      {{- end }}
+      serviceAccountName: {{.ServiceAccount | quote}}
+      containers:
+      - name: istio-proxy
+      {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+      {{- else }}
+        image: "{{ .ProxyImage }}"
+      {{- end }}
+        {{- if .Values.global.proxy.resources }}
+        resources:
+          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
+        {{- end }}
+        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
+          allowPrivilegeEscalation: false
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsUser: {{ .ProxyUID | default "1337" }}
+          runAsGroup: {{ .ProxyGID | default "1337" }}
+          runAsNonRoot: true
+        ports:
+        - containerPort: 15020
+          name: metrics
+          protocol: TCP
+        - containerPort: 15021
+          name: status-port
+          protocol: TCP
+        - containerPort: 15090
+          protocol: TCP
+          name: http-envoy-prom
+        args:
+        - proxy
+        - router
+        - --domain
+        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+        - --proxyLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
+        - --proxyComponentLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
+        - --log_output_level
+        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
+      {{- if .Values.global.sts.servicePort }}
+        - --stsPort={{ .Values.global.sts.servicePort }}
+      {{- end }}
+      {{- if .Values.global.logAsJson }}
+        - --log_as_json
+      {{- end }}
+      {{- if .Values.global.proxy.lifecycle }}
+        lifecycle:
+          {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }}
+      {{- end }}
+        env:
+        - name: PILOT_CERT_PROVIDER
+          value: {{ .Values.global.pilotCertProvider }}
+        - name: CA_ADDR
+        {{- if .Values.global.caAddress }}
+          value: {{ .Values.global.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        - name: ISTIO_CPU_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+              divisor: "1"
+        - name: PROXY_CONFIG
+          value: |
+                 {{ protoToJSON .ProxyConfig }}
+        - name: ISTIO_META_POD_PORTS
+          value: "[]"
+        - name: ISTIO_META_APP_CONTAINERS
+          value: ""
+        - name: GOMEMLIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.memory
+              divisor: "1"
+        - name: GOMAXPROCS
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+              divisor: "1"
+        - name: ISTIO_META_CLUSTER_ID
+          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
+        - name: ISTIO_META_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: ISTIO_META_INTERCEPTION_MODE
+          value: "{{ .ProxyConfig.InterceptionMode.String }}"
+        {{- with (valueOrDefault  (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }}
+        - name: ISTIO_META_NETWORK
+          value: {{.|quote}}
+        {{- end }}
+        - name: ISTIO_META_WORKLOAD_NAME
+          value: {{.DeploymentName|quote}}
+        - name: ISTIO_META_OWNER
+          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
+        {{- if .Values.global.meshID }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ .Values.global.meshID }}"
+        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+        {{- end }}
+        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
+        - name: TRUST_DOMAIN
+          value: "{{ . }}"
+        {{- end }}
+        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
+        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
+          value: {{.|quote}}
+        {{- end }}
+        startupProbe:
+          failureThreshold: 30
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 1
+          periodSeconds: 1
+          successThreshold: 1
+          timeoutSeconds: 1
+        readinessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 0
+          periodSeconds: 15
+          successThreshold: 1
+          timeoutSeconds: 1
+        volumeMounts:
+        - name: workload-socket
+          mountPath: /var/run/secrets/workload-spiffe-uds
+        - name: credential-socket
+          mountPath: /var/run/secrets/credential-uds
+        {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+        - name: gke-workload-certificate
+          mountPath: /var/run/secrets/workload-spiffe-credentials
+          readOnly: true
+        {{- else }}
+        - name: workload-certs
+          mountPath: /var/run/secrets/workload-spiffe-credentials
+        {{- end }}
+        {{- if eq .Values.global.pilotCertProvider "istiod" }}
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        {{- end }}
+        - mountPath: /var/lib/istio/data
+          name: istio-data
+        # SDS channel between istioagent and Envoy
+        - mountPath: /etc/istio/proxy
+          name: istio-envoy
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - name: istio-podinfo
+          mountPath: /etc/istio/pod
+      volumes:
+      - emptyDir: {}
+        name: workload-socket
+      - emptyDir: {}
+        name: credential-socket
+      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
+      - name: gke-workload-certificate
+        csi:
+          driver: workloadcertificates.security.cloud.google.com
+      {{- else}}
+      - emptyDir: {}
+        name: workload-certs
+      {{- end }}
+      # SDS channel between istioagent and Envoy
+      - emptyDir:
+          medium: Memory
+        name: istio-envoy
+      - name: istio-data
+        emptyDir: {}
+      - name: istio-podinfo
+        downwardAPI:
+          items:
+            - path: "labels"
+              fieldRef:
+                fieldPath: metadata.labels
+            - path: "annotations"
+              fieldRef:
+                fieldPath: metadata.annotations
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: istio-token
+              expirationSeconds: 43200
+              audience: {{ .Values.global.sds.token.aud }}
+      {{- if eq .Values.global.pilotCertProvider "istiod" }}
+      - name: istiod-ca-cert
+      {{- if eq ((.Values.pilot).env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+              path: root-cert.pem
+      {{- else }}
+        configMap:
+          name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+      {{- end }}
+      {{- end }}
+      {{- if .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.networking.k8s.io/gateway-class-name" .GatewayClass
+      ) | nindent 4 }}
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: {{.Name}}
+    uid: {{.UID}}
+spec:
+  ipFamilyPolicy: PreferDualStack
+  ports:
+  {{- range $key, $val := .Ports }}
+  - name: {{ $val.Name | quote }}
+    port: {{ $val.Port }}
+    protocol: TCP
+    appProtocol: {{ $val.AppProtocol }}
+  {{- end }}
+  selector:
+    "{{.GatewayNameLabel}}": {{.Name}}
+  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
+  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
+  {{- end }}
+  type: {{ .ServiceType | quote }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          "gateway.networking.k8s.io/gateway-class-name" .GatewayClass
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name:  {{.DeploymentName | quote}}
+  maxReplicas: 1
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          "gateway.networking.k8s.io/gateway-class-name" .GatewayClass
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
+
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-ambient.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-compatibility-version-1.25.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..3827ee78f
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,16 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+     # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-compatibility-version-1.26.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..b690d25ca
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-compatibility-version-1.27.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-compatibility-version-1.27.yaml
new file mode 100644
index 000000000..9f9ba7b67
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-compatibility-version-1.27.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-compatibility-version-1.28.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-compatibility-version-1.28.yaml
new file mode 100644
index 000000000..96d9c1f52
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-compatibility-version-1.28.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-demo.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-demo.yaml
new file mode 100644
index 000000000..d6dc36dd0
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-demo.yaml
@@ -0,0 +1,94 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The demo profile enables a variety of things to try out Istio in non-production environments.
+# * Lower resource utilization.
+# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
+# * More ports enabled on the ingress, which is used in some tasks.
+meshConfig:
+  accessLogFile: /dev/stdout
+  extensionProviders:
+    - name: otel
+      envoyOtelAls:
+        service: opentelemetry-collector.observability.svc.cluster.local
+        port: 4317
+    - name: skywalking
+      skywalking:
+        service: tracing.istio-system.svc.cluster.local
+        port: 11800
+    - name: otel-tracing
+      opentelemetry:
+        port: 4317
+        service: opentelemetry-collector.observability.svc.cluster.local
+    - name: jaeger
+      opentelemetry:
+        port: 4317
+        service: jaeger-collector.istio-system.svc.cluster.local        
+
+cni:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 40Mi
+
+ztunnel:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 40Mi
+
+global:
+  proxy:
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+  waypoint:
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+
+pilot:
+  autoscaleEnabled: false
+  traceSampling: 100
+  resources:
+    requests:
+      cpu: 10m
+      memory: 100Mi
+
+gateways:
+  istio-egressgateway:
+    autoscaleEnabled: false
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+  istio-ingressgateway:
+    autoscaleEnabled: false
+    ports:
+    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
+    # Note that AWS ELB will by default perform health checks on the first port
+    # on this list. Setting this to the health check port will ensure that health
+    # checks always work. https://github.com/istio/istio/issues/12503
+    - port: 15021
+      targetPort: 15021
+      name: status-port
+    - port: 80
+      targetPort: 8080
+      name: http2
+    - port: 443
+      targetPort: 8443
+      name: https
+    - port: 31400
+      targetPort: 31400
+      name: tcp
+      # This is the port where sni routing happens
+    - port: 15443
+      targetPort: 15443
+      name: tls
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-platform-gke.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.6/charts/istiod/files/profile-platform-k3d.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.6/charts/istiod/files/profile-platform-k3d.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-platform-k3d.yaml
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-platform-k3s.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-platform-k3s.yaml
new file mode 100644
index 000000000..07820106d
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-platform-k3s.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
+  cniBinDir: /var/lib/rancher/k3s/data/cni
diff --git a/resources/v1.24.6/charts/istiod/files/profile-platform-microk8s.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.6/charts/istiod/files/profile-platform-microk8s.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.6/charts/istiod/files/profile-platform-minikube.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.6/charts/istiod/files/profile-platform-minikube.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.6/charts/istiod/files/profile-platform-openshift.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.6/charts/istiod/files/profile-platform-openshift.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.6/charts/istiod/files/profile-preview.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.6/charts/istiod/files/profile-preview.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-preview.yaml
diff --git a/resources/v1.24.6/charts/istiod/files/profile-remote.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.6/charts/istiod/files/profile-remote.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-remote.yaml
diff --git a/resources/v1.24.6/charts/istiod/files/profile-stable.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.6/charts/istiod/files/profile-stable.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/istiod/files/profile-stable.yaml
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/files/waypoint.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/waypoint.yaml
new file mode 100644
index 000000000..967897b36
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/files/waypoint.yaml
@@ -0,0 +1,408 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{.ServiceAccount | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.networking.k8s.io/gateway-class-name" .GatewayClass
+      ) | nindent 4 }}
+  {{- if ge .KubeVersion 128 }}
+  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+  {{- end }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.networking.k8s.io/gateway-class-name" .GatewayClass
+        "gateway.istio.io/managed" .ControllerLabel
+      ) | nindent 4 }}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      "{{.GatewayNameLabel}}": "{{.Name}}"
+  template:
+    metadata:
+      annotations:
+        {{- toJsonMap
+          (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version")
+          (strdict "istio.io/rev" (.Revision | default "default"))
+          (strdict
+            "prometheus.io/path" "/stats/prometheus"
+            "prometheus.io/port" "15020"
+            "prometheus.io/scrape" "true"
+          ) | nindent 8 }}
+      labels:
+        {{- toJsonMap
+          (strdict
+            "sidecar.istio.io/inject" "false"
+            "istio.io/dataplane-mode" "none"
+            "service.istio.io/canonical-name" .DeploymentName
+            "service.istio.io/canonical-revision" "latest"
+           )
+          .InfrastructureLabels
+          (strdict
+            "gateway.networking.k8s.io/gateway-name" .Name
+            "gateway.networking.k8s.io/gateway-class-name" .GatewayClass
+            "gateway.istio.io/managed" .ControllerLabel
+          ) | nindent 8}}
+    spec:
+      {{- if .Values.global.waypoint.affinity }}
+      affinity:
+      {{- toYaml .Values.global.waypoint.affinity | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.topologySpreadConstraints }}
+      topologySpreadConstraints:
+      {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.nodeSelector }}
+      nodeSelector:
+      {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- if .Values.global.waypoint.tolerations }}
+      tolerations:
+      {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{.ServiceAccount | quote}}
+      containers:
+      - name: istio-proxy
+        ports:
+        - containerPort: 15020
+          name: metrics
+          protocol: TCP
+        - containerPort: 15021
+          name: status-port
+          protocol: TCP
+        - containerPort: 15090
+          protocol: TCP
+          name: http-envoy-prom
+        {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }}
+        image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}"
+        {{- else }}
+        image: "{{ .ProxyImage }}"
+        {{- end }}
+        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
+        args:
+        - proxy
+        - waypoint
+        - --domain
+        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
+        - --serviceCluster
+        - {{.ServiceAccount}}.$(POD_NAMESPACE)
+        - --proxyLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
+        - --proxyComponentLogLevel
+        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
+        - --log_output_level
+        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}
+        {{- if .Values.global.logAsJson }}
+        - --log_as_json
+        {{- end }}
+        {{- if .Values.global.proxy.outlierLogPath }}
+        - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }}
+        {{- end}}
+        env:
+        - name: ISTIO_META_SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: ISTIO_META_NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: PILOT_CERT_PROVIDER
+          value: {{ .Values.global.pilotCertProvider }}
+        - name: CA_ADDR
+        {{- if .Values.global.caAddress }}
+          value: {{ .Values.global.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        - name: ISTIO_CPU_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+              divisor: "1"
+        - name: PROXY_CONFIG
+          value: |
+                 {{ protoToJSON .ProxyConfig }}
+        {{- if .ProxyConfig.ProxyMetadata }}
+        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- end }}
+        - name: GOMEMLIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.memory
+              divisor: "1"
+        - name: GOMAXPROCS
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+              divisor: "1"
+        - name: ISTIO_META_CLUSTER_ID
+          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"
+        {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }}
+        {{- if $network }}
+        - name: ISTIO_META_NETWORK
+          value: "{{ $network }}"
+        {{- if eq .ControllerLabel "istio.io-eastwest-controller" }}
+        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
+          value: "{{ $network }}"
+        {{- end }}
+        {{- end }}
+        - name: ISTIO_META_INTERCEPTION_MODE
+          value: REDIRECT
+        - name: ISTIO_META_WORKLOAD_NAME
+          value: {{.DeploymentName}}
+        - name: ISTIO_META_OWNER
+          value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}
+        {{- if .Values.global.meshID }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ .Values.global.meshID }}"
+        {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: ISTIO_META_MESH_ID
+          value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}"
+        {{- end }}
+        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}
+        - name: TRUST_DOMAIN
+          value: "{{ . }}"
+        {{- end }}
+        {{- if .Values.global.waypoint.resources }}
+        resources:
+        {{- toYaml .Values.global.waypoint.resources | nindent 10 }}
+        {{- end }}
+        startupProbe:
+          failureThreshold: 30
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 1
+          periodSeconds: 1
+          successThreshold: 1
+          timeoutSeconds: 1
+        readinessProbe:
+          failureThreshold: 4
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: 0
+          periodSeconds: 15
+          successThreshold: 1
+          timeoutSeconds: 1
+        securityContext:
+          privileged: false
+        {{- if not (eq .Values.global.platform "openshift") }}
+          runAsGroup: 1337
+          runAsUser: 1337
+        {{- end }}
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          capabilities:
+            drop:
+            - ALL
+{{- if .Values.gateways.seccompProfile }}
+          seccompProfile:
+{{- toYaml .Values.gateways.seccompProfile | nindent 12 }}
+{{- end }}
+        volumeMounts:
+        - mountPath: /var/run/secrets/workload-spiffe-uds
+          name: workload-socket
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        - mountPath: /var/lib/istio/data
+          name: istio-data
+        - mountPath: /etc/istio/proxy
+          name: istio-envoy
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - mountPath: /etc/istio/pod
+          name: istio-podinfo
+      volumes:
+      - emptyDir: {}
+        name: workload-socket
+      - emptyDir:
+          medium: Memory
+        name: istio-envoy
+      - emptyDir:
+          medium: Memory
+        name: go-proxy-envoy
+      - emptyDir: {}
+        name: istio-data
+      - emptyDir: {}
+        name: go-proxy-data
+      - downwardAPI:
+          items:
+          - fieldRef:
+              fieldPath: metadata.labels
+            path: labels
+          - fieldRef:
+              fieldPath: metadata.annotations
+            path: annotations
+        name: istio-podinfo
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              audience: istio-ca
+              expirationSeconds: 43200
+              path: istio-token
+      - name: istiod-ca-cert
+      {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+              path: root-cert.pem
+      {{- else }}
+        configMap:
+          name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+      {{- end }}
+      {{- if .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    {{ toJsonMap
+      (strdict "networking.istio.io/traffic-distribution" "PreferClose")
+      (omit .InfrastructureAnnotations
+        "kubectl.kubernetes.io/last-applied-configuration"
+        "gateway.istio.io/name-override"
+        "gateway.istio.io/service-account"
+        "gateway.istio.io/controller-version"
+      ) | nindent 4 }}
+  labels:
+    {{- toJsonMap
+      .InfrastructureLabels
+      (strdict
+        "gateway.networking.k8s.io/gateway-name" .Name
+        "gateway.networking.k8s.io/gateway-class-name" .GatewayClass
+      ) | nindent 4 }}
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  ownerReferences:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    name: "{{.Name}}"
+    uid: "{{.UID}}"
+spec:
+  ipFamilyPolicy: PreferDualStack
+  ports:
+  {{- range $key, $val := .Ports }}
+  - name: {{ $val.Name | quote }}
+    port: {{ $val.Port }}
+    protocol: TCP
+    appProtocol: {{ $val.AppProtocol }}
+  {{- end }}
+  selector:
+    "{{.GatewayNameLabel}}": "{{.Name}}"
+  {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }}
+  loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}}
+  {{- end }}
+  type: {{ .ServiceType | quote }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          "gateway.networking.k8s.io/gateway-class-name" .GatewayClass
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name:  {{.DeploymentName | quote}}
+  maxReplicas: 1
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{.DeploymentName | quote}}
+  namespace: {{.Namespace | quote}}
+  annotations:
+    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
+  labels:
+    {{- toJsonMap
+          .InfrastructureLabels
+          (strdict
+          "gateway.networking.k8s.io/gateway-name" .Name
+          "gateway.networking.k8s.io/gateway-class-name" .GatewayClass
+          ) | nindent 4 }}
+  ownerReferences:
+    - apiVersion: gateway.networking.k8s.io/v1beta1
+      kind: Gateway
+      name: {{.Name}}
+      uid: "{{.UID}}"
+spec:
+  selector:
+    matchLabels:
+      gateway.networking.k8s.io/gateway-name: {{.Name|quote}}
+
diff --git a/resources/v1.24.6/charts/istiod/templates/NOTES.txt b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.6/charts/istiod/templates/NOTES.txt
rename to resources/v1.29-alpha.b2f713a9/charts/istiod/templates/NOTES.txt
diff --git a/resources/v1.24.6/charts/istiod/templates/_helpers.tpl b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/_helpers.tpl
similarity index 100%
rename from resources/v1.24.6/charts/istiod/templates/_helpers.tpl
rename to resources/v1.29-alpha.b2f713a9/charts/istiod/templates/_helpers.tpl
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/autoscale.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/autoscale.yaml
new file mode 100644
index 000000000..9ab43b5bf
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/autoscale.yaml
@@ -0,0 +1,45 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+{{- if and .Values.autoscaleEnabled .Values.autoscaleMin .Values.autoscaleMax }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  maxReplicas: {{ .Values.autoscaleMax }}
+  minReplicas: {{ .Values.autoscaleMin }}
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: {{ .Values.cpu.targetAverageUtilization }}
+  {{- if .Values.memory.targetAverageUtilization }}
+  - type: Resource
+    resource:
+      name: memory
+      target:
+        type: Utilization
+        averageUtilization: {{ .Values.memory.targetAverageUtilization }}
+  {{- end }}
+  {{- if .Values.autoscaleBehavior }}
+  behavior: {{ toYaml .Values.autoscaleBehavior | nindent 4 }}
+  {{- end }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/clusterrole.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/clusterrole.yaml
new file mode 100644
index 000000000..3280c96b5
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/clusterrole.yaml
@@ -0,0 +1,216 @@
+# Created if cluster resources are not omitted
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  # sidecar injection controller
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+
+  # configuration validation webhook controller
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update"]
+
+  # istio configuration
+  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
+  # please proceed with caution
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["get", "watch", "list"]
+    resources: ["*"]
+{{- if .Values.global.istiod.enableAnalysis }}
+  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
+    verbs: ["update", "patch"]
+    resources:
+    - authorizationpolicies/status
+    - destinationrules/status
+    - envoyfilters/status
+    - gateways/status
+    - peerauthentications/status
+    - proxyconfigs/status
+    - requestauthentications/status
+    - serviceentries/status
+    - sidecars/status
+    - telemetries/status
+    - virtualservices/status
+    - wasmplugins/status
+    - workloadentries/status
+    - workloadgroups/status
+{{- end }}
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "workloadentries" ]
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "workloadentries/status",  "serviceentries/status" ]
+  - apiGroups: ["security.istio.io"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "authorizationpolicies/status" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "services/status" ]
+
+  # auto-detect installed CRD definitions
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+
+  # discovery and routing
+  - apiGroups: [""]
+    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+
+{{- if .Values.taint.enabled }}
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["patch"]
+{{- end }}
+
+  # ingress controller
+{{- if .Values.global.istiod.enableAnalysis }}
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["*"]
+{{- end}}
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses", "ingressclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["*"]
+
+  # required for CA's namespace controller
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create", "get", "list", "watch", "update"]
+
+  # Istiod and bootstrap.
+{{- $omitCertProvidersForClusterRole := list "istiod" "custom" "none"}}
+{{- if or .Values.env.EXTERNAL_CA (not (has .Values.global.pilotCertProvider $omitCertProvidersForClusterRole)) }}
+  - apiGroups: ["certificates.k8s.io"]
+    resources:
+      - "certificatesigningrequests"
+      - "certificatesigningrequests/approval"
+      - "certificatesigningrequests/status"
+    verbs: ["update", "create", "get", "delete", "watch"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources:
+      - "signers"
+    resourceNames:
+{{- range .Values.global.certSigners }}
+    - {{ . | quote }}
+{{- end }}
+    verbs: ["approve"]
+{{- end}}
+{{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["clustertrustbundles"]
+    verbs: ["update", "create", "delete", "list", "watch", "get"]
+  - apiGroups: ["certificates.k8s.io"]
+    resources: ["signers"]
+    resourceNames: ["istio.io/istiod-ca"]
+    verbs: ["attest"]
+{{- end }}
+
+  # Used by Istiod to verify the JWT tokens
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]
+
+  # Used by Istiod to verify gateway SDS
+  - apiGroups: ["authorization.k8s.io"]
+    resources: ["subjectaccessreviews"]
+    verbs: ["create"]
+
+  # Use for Kubernetes Service APIs
+  - apiGroups: ["gateway.networking.k8s.io", "gateway.networking.x-k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["gateway.networking.x-k8s.io"]
+    resources:
+    - xbackendtrafficpolicies/status
+    - xlistenersets/status
+    verbs: ["update", "patch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources:
+    - backendtlspolicies/status
+    - gatewayclasses/status
+    - gateways/status
+    - grpcroutes/status
+    - httproutes/status
+    - referencegrants/status
+    - tcproutes/status
+    - tlsroutes/status
+    - udproutes/status
+    verbs: ["update", "patch"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources: ["gatewayclasses"]
+    verbs: ["create", "update", "patch", "delete"]
+  - apiGroups: ["inference.networking.k8s.io"]
+    resources: ["inferencepools"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["inference.networking.k8s.io"]
+    resources: ["inferencepools/status"]
+    verbs: ["update", "patch"]
+
+  # Needed for multicluster secret reading, possibly ingress certs in the future
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "watch", "list"]
+
+  # Used for MCS serviceexport management
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceexports"]
+    verbs: [ "get", "watch", "list", "create", "delete"]
+
+  # Used for MCS serviceimport management
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceimports"]
+    verbs: ["get", "watch", "list"]
+---
+{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["apps"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "deployments" ]
+  - apiGroups: ["autoscaling"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "horizontalpodautoscalers" ]
+  - apiGroups: ["policy"]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "poddisruptionbudgets" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "services" ]
+  - apiGroups: [""]
+    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
+    resources: [ "serviceaccounts"]
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/clusterrolebinding.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/clusterrolebinding.yaml
new file mode 100644
index 000000000..0ca21b957
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/clusterrolebinding.yaml
@@ -0,0 +1,43 @@
+# Created if cluster resources are not omitted
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istiod-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
+    namespace: {{ .Values.global.istioNamespace }}
+---
+{{- if not (eq (toString .Values.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+subjects:
+- kind: ServiceAccount
+  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Values.global.istioNamespace }}
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/configmap-jwks.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/configmap-jwks.yaml
new file mode 100644
index 000000000..45943d383
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/configmap-jwks.yaml
@@ -0,0 +1,20 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+{{- if .Values.jwksResolverExtraRootCA }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    release: {{ .Release.Name }}
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+  extra.pem: {{ .Values.jwksResolverExtraRootCA | quote }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/configmap-values.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/configmap-values.yaml
new file mode 100644
index 000000000..dcd1e3530
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/configmap-values.yaml
@@ -0,0 +1,21 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: values{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect.
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+  original-values: |-
+{{ .Values._original | toPrettyJson | indent 4 }}
+{{- $_ := unset $.Values "_original" }}
+  merged-values: |-
+{{ .Values | toPrettyJson | indent 4 }}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/configmap.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/configmap.yaml
new file mode 100644
index 000000000..a24ff9ee2
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/configmap.yaml
@@ -0,0 +1,113 @@
+{{- define "mesh" }}
+    # The trust domain corresponds to the trust root of a system.
+    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
+    trustDomain: "cluster.local"
+
+    # The namespace to treat as the administrative root namespace for Istio configuration.
+    # When processing a leaf namespace Istio will search for declarations in that namespace first
+    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
+    # is processed as if it were declared in the leaf namespace.
+    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}
+
+  {{ $prom := include "default-prometheus" . | eq "true" }}
+  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
+  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
+  {{- if or $prom $sdMetrics $sdLogs }}
+    defaultProviders:
+    {{- if or $prom $sdMetrics }}
+      metrics:
+      {{ if $prom }}- prometheus{{ end }}
+      {{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
+    {{- end }}
+    {{- if and $sdMetrics $sdLogs }}
+      accessLogging:
+      - stackdriver
+    {{- end }}
+  {{- end }}
+
+    defaultConfig:
+      {{- if .Values.global.meshID }}
+      meshId: "{{ .Values.global.meshID }}"
+      {{- end }}
+      {{- with (.Values.global.proxy.variant | default .Values.global.variant) }}
+      image:
+        imageType: {{. | quote}}
+      {{- end }}
+      {{- if not (eq .Values.global.proxy.tracer "none") }}
+      tracing:
+      {{- if eq .Values.global.proxy.tracer "lightstep" }}
+        lightstep:
+          # Address of the LightStep Satellite pool
+          address: {{ .Values.global.tracer.lightstep.address }}
+          # Access Token used to communicate with the Satellite pool
+          accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
+      {{- else if eq .Values.global.proxy.tracer "zipkin" }}
+        zipkin:
+          # Address of the Zipkin collector
+          address: {{ ((.Values.global.tracer).zipkin).address | default (print "zipkin." .Values.global.istioNamespace ":9411") }}
+      {{- else if eq .Values.global.proxy.tracer "datadog" }}
+        datadog:
+          # Address of the Datadog Agent
+          address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
+      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
+        stackdriver:
+          # enables trace output to stdout.
+          debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}
+          # The global default max number of attributes per span.
+          maxNumberOfAttributes: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAttributes | default "200" }}
+          # The global default max number of annotation events per span.
+          maxNumberOfAnnotations: {{ (($.Values.global.tracer).stackdriver).maxNumberOfAnnotations | default "200" }}
+          # The global default max number of message events per span.
+          maxNumberOfMessageEvents: {{ (($.Values.global.tracer).stackdriver).maxNumberOfMessageEvents | default "200" }}
+      {{- end }}
+      {{- end }}
+      {{- if .Values.global.remotePilotAddress }}
+      {{- if and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod }}
+      #  only primary `istiod` to xds and local `istiod` injection installs.
+      discoveryAddress: {{ printf "istiod-remote.%s.svc" .Release.Namespace }}:15012
+      {{- else }}
+      discoveryAddress: {{ printf "istiod.%s.svc" .Release.Namespace }}:15012
+      {{- end }}
+      {{- else }}
+      discoveryAddress: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{.Release.Namespace}}.svc:15012
+      {{- end }}
+{{- end }}
+
+{{/* We take the mesh config above, defined with individual values.yaml, and merge with .Values.meshConfig */}}
+{{/* The intent here is that meshConfig.foo becomes the API, rather than re-inventing the API in values.yaml */}}
+{{- $originalMesh := include "mesh" . | fromYaml }}
+{{- $mesh := mergeOverwrite $originalMesh .Values.meshConfig }}
+
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+{{- if .Values.configMap }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+
+  # Configuration file for the mesh networks to be used by the Split Horizon EDS.
+  meshNetworks: |-
+  {{- if .Values.global.meshNetworks }}
+    networks:
+{{ toYaml .Values.global.meshNetworks | trim | indent 6 }}
+  {{- else }}
+    networks: {}
+  {{- end }}
+
+  mesh: |-
+{{- if .Values.meshConfig }}
+{{ $mesh | toYaml | indent 4 }}
+{{- else }}
+{{- include "mesh" . }}
+{{- end }}
+---
+{{- end }}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/deployment.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/deployment.yaml
new file mode 100644
index 000000000..676ab9a5c
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/deployment.yaml
@@ -0,0 +1,318 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istiod
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    istio: pilot
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+{{- range $key, $val := .Values.deploymentLabels }}
+    {{ $key }}: "{{ $val }}"
+{{- end }}
+  {{- if .Values.deploymentAnnotations }}
+  annotations:
+{{ toYaml .Values.deploymentAnnotations | indent 4 }}
+  {{- end }}
+spec:
+{{- if not .Values.autoscaleEnabled }}
+{{- if .Values.replicaCount }}
+  replicas: {{ .Values.replicaCount }}
+{{- end }}
+{{- end }}
+  strategy:
+    rollingUpdate:
+      maxSurge: {{ .Values.rollingMaxSurge }}
+      maxUnavailable: {{ .Values.rollingMaxUnavailable }}
+  selector:
+    matchLabels:
+      {{- if ne .Values.revision "" }}
+      app: istiod
+      istio.io/rev: {{ .Values.revision | default "default" | quote }}
+      {{- else }}
+      istio: pilot
+      {{- end }}
+  template:
+    metadata:
+      labels:
+        app: istiod
+        istio.io/rev: {{ .Values.revision | default "default" | quote }}
+        sidecar.istio.io/inject: "false"
+        operator.istio.io/component: "Pilot"
+        {{- if ne .Values.revision "" }}
+        istio: istiod
+        {{- else }}
+        istio: pilot
+        {{- end }}
+        {{- range $key, $val := .Values.podLabels }}
+        {{ $key }}: "{{ $val }}"
+        {{- end }}
+        istio.io/dataplane-mode: none
+        app.kubernetes.io/name: "istiod"
+        {{- include "istio.labels" . | nindent 8 }}
+      annotations:
+        prometheus.io/port: "15014"
+        prometheus.io/scrape: "true"
+        sidecar.istio.io/inject: "false"
+        {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+        {{- end }}
+    spec:
+{{- if .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 8 }}
+{{- end }}
+{{- with .Values.affinity }}
+      affinity:
+{{- toYaml . | nindent 8 }}
+{{- end }}
+      tolerations:
+        - key: cni.istio.io/not-ready
+          operator: "Exists"
+{{- with .Values.tolerations }}
+{{- toYaml . | nindent 8 }}
+{{- end }}
+{{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+{{- toYaml . | nindent 8 }}
+{{- end }}
+      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+{{- if .Values.global.priorityClassName }}
+      priorityClassName: "{{ .Values.global.priorityClassName }}"
+{{- end }}
+{{- with .Values.initContainers }}
+      initContainers:
+        {{- tpl (toYaml .) $ | nindent 8 }}
+{{- end }}
+      containers:
+        - name: discovery
+{{- if contains "/" .Values.image }}
+          image: "{{ .Values.image }}"
+{{- else }}
+          image: "{{ .Values.hub | default .Values.global.hub }}/{{ .Values.image | default "pilot" }}:{{ .Values.tag | default .Values.global.tag }}{{with (.Values.variant | default .Values.global.variant)}}-{{.}}{{end}}"
+{{- end }}
+{{- if .Values.global.imagePullPolicy }}
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+{{- end }}
+          args:
+          - "discovery"
+          - --monitoringAddr=:15014
+{{- if .Values.global.logging.level }}
+          - --log_output_level={{ .Values.global.logging.level }}
+{{- end}}
+{{- if .Values.global.logAsJson }}
+          - --log_as_json
+{{- end }}
+          - --domain
+          - {{ .Values.global.proxy.clusterDomain }}
+{{- if .Values.taint.namespace }}
+          - --cniNamespace={{ .Values.taint.namespace }}
+{{- end }}
+          - --keepaliveMaxServerConnectionAge
+          - "{{ .Values.keepaliveMaxServerConnectionAge }}"
+{{- if .Values.extraContainerArgs }}
+          {{- with .Values.extraContainerArgs }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+{{- end }}
+          ports:
+          - containerPort: 8080
+            protocol: TCP
+            name: http-debug
+          - containerPort: 15010
+            protocol: TCP
+            name: grpc-xds
+          - containerPort: 15012
+            protocol: TCP
+            name: tls-xds
+          - containerPort: 15017
+            protocol: TCP
+            name: https-webhooks
+          - containerPort: 15014
+            protocol: TCP
+            name: http-monitoring
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8080
+            initialDelaySeconds: 1
+            periodSeconds: 3
+            timeoutSeconds: 5
+          env:
+          - name: REVISION
+            value: "{{ .Values.revision | default `default` }}"
+          - name: PILOT_CERT_PROVIDER
+            value: {{ .Values.global.pilotCertProvider }}
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.name
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+          - name: SERVICE_ACCOUNT
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: spec.serviceAccountName
+          - name: KUBECONFIG
+            value: /var/run/secrets/remote/config
+          # If you explicitly told us where ztunnel lives, use that.
+          # Otherwise, assume it lives in our namespace
+          # Also, check for an explicit ENV override (legacy approach) and prefer that
+          # if present
+          {{ $ztTrustedNS := or .Values.trustedZtunnelNamespace .Release.Namespace }}
+          {{ $ztTrustedName := or .Values.trustedZtunnelName "ztunnel" }}
+          {{- if not .Values.env.CA_TRUSTED_NODE_ACCOUNTS }}
+          - name: CA_TRUSTED_NODE_ACCOUNTS
+            value: "{{ $ztTrustedNS }}/{{ $ztTrustedName }}"
+          {{- end }}
+          {{- if .Values.env }}
+          {{- range $key, $val := .Values.env }}
+          - name: {{ $key }}
+            value: "{{ $val }}"
+          {{- end }}
+          {{- end }}
+          {{- with .Values.envVarFrom }}
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+{{- if .Values.traceSampling }}
+          - name: PILOT_TRACE_SAMPLING
+            value: "{{ .Values.traceSampling }}"
+{{- end }}
+# If externalIstiod is set via Values.Global, then enable the pilot env variable. However, if it's set via Values.pilot.env, then
+# don't set it here to avoid duplication.
+# TODO (nshankar13): Move from Helm chart to code: https://github.com/istio/istio/issues/52449
+{{- if and .Values.global.externalIstiod (not (and .Values.env .Values.env.EXTERNAL_ISTIOD)) }}
+          - name: EXTERNAL_ISTIOD
+            value: "{{ .Values.global.externalIstiod }}"
+{{- end }}
+{{- if .Values.global.trustBundleName }}
+          - name: PILOT_CA_CERT_CONFIGMAP
+            value: "{{ .Values.global.trustBundleName }}"
+{{- end }}
+{{- if .Values.crlConfigMapName }}
+          - name: PILOT_CRL_CONFIGMAP
+            value: "{{ .Values.crlConfigMapName }}"
+{{- end }}
+          - name: PILOT_ENABLE_ANALYSIS
+            value: "{{ .Values.global.istiod.enableAnalysis }}"
+          - name: CLUSTER_ID
+            value: "{{ $.Values.global.multiCluster.clusterName | default `Kubernetes` }}"
+          - name: GOMEMLIMIT
+            valueFrom:
+              resourceFieldRef:
+                resource: limits.memory
+                divisor: "1"
+          - name: GOMAXPROCS
+            valueFrom:
+              resourceFieldRef:
+                resource: limits.cpu
+                divisor: "1"
+          - name: PLATFORM
+            value: "{{ coalesce .Values.global.platform .Values.platform }}"
+          resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 12 }}
+{{- else }}
+{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
+{{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+              - ALL
+{{- if .Values.seccompProfile }}
+            seccompProfile:
+{{ toYaml .Values.seccompProfile | trim | indent 14 }}
+{{- end }}
+          volumeMounts:
+          - name: istio-token
+            mountPath: /var/run/secrets/tokens
+            readOnly: true
+          - name: local-certs
+            mountPath: /var/run/secrets/istio-dns
+          - name: cacerts
+            mountPath: /etc/cacerts
+            readOnly: true
+          - name: istio-kubeconfig
+            mountPath: /var/run/secrets/remote
+            readOnly: true
+          {{- if .Values.jwksResolverExtraRootCA }}
+          - name: extracacerts
+            mountPath: /cacerts
+          {{- end }}
+          - name: istio-csr-dns-cert
+            mountPath: /var/run/secrets/istiod/tls
+            readOnly: true
+          - name: istio-csr-ca-configmap
+            mountPath: /var/run/secrets/istiod/ca
+            readOnly: true
+          {{- with .Values.volumeMounts }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+      volumes:
+      # Technically not needed on this pod - but it helps debugging/testing SDS
+      # Should be removed after everything works.
+      - emptyDir:
+          medium: Memory
+        name: local-certs
+      - name: istio-token
+        projected:
+          sources:
+            - serviceAccountToken:
+                audience: {{ .Values.global.sds.token.aud }}
+                expirationSeconds: 43200
+                path: istio-token
+      # Optional: user-generated root
+      - name: cacerts
+        secret:
+          secretName: cacerts
+          optional: true
+      - name: istio-kubeconfig
+        secret:
+          secretName: istio-kubeconfig
+          optional: true
+      # Optional: istio-csr dns pilot certs
+      - name: istio-csr-dns-cert
+        secret:
+          secretName: istiod-tls
+          optional: true
+      - name: istio-csr-ca-configmap
+  {{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }}
+              path: root-cert.pem
+              optional: true
+  {{- else }}
+        configMap:
+          name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }}
+          defaultMode: 420
+          optional: true
+  {{- end }}
+  {{- if .Values.jwksResolverExtraRootCA }}
+      - name: extracacerts
+        configMap:
+          name: pilot-jwks-extra-cacerts{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  {{- end }}
+      {{- with .Values.volumes }}
+        {{- toYaml . | nindent 6}}
+      {{- end }}
+
+---
+{{- end }}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/gateway-class-configmap.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/gateway-class-configmap.yaml
new file mode 100644
index 000000000..9f7cdb01d
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/gateway-class-configmap.yaml
@@ -0,0 +1,22 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+{{ range $key, $value := .Values.gatewayClasses }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-{{ $.Values.revision | default "default"  }}-gatewayclass-{{$key}}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    gateway.istio.io/defaults-for-class: {{$key|quote}}
+    {{- include "istio.labels" $ | nindent 4 }}
+data:
+{{ range $kind, $overlay := $value }}
+  {{$kind}}: |
+{{$overlay|toYaml|trim|indent 4}}
+{{ end }}
+---
+{{ end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/istiod-injector-configmap.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/istiod-injector-configmap.yaml
new file mode 100644
index 000000000..a5a6cf9ae
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/istiod-injector-configmap.yaml
@@ -0,0 +1,83 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+{{- if not .Values.global.omitSidecarInjectorConfigMap }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+data:
+{{/* Scope the values to just top level fields used in the template, to reduce the size. */}}
+  values: |-
+{{ $vals := pick .Values "global" "sidecarInjectorWebhook" "revision" -}}
+{{ $pilotVals := pick .Values "cni" "env" -}}
+{{ $vals = set $vals "pilot" $pilotVals -}}
+{{ $gatewayVals := pick .Values.gateways "securityContext" "seccompProfile" -}}
+{{ $vals = set $vals "gateways" $gatewayVals -}}
+{{ $vals | toPrettyJson | indent 4 }}
+
+  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
+  # and istiod webhook functionality.
+  #
+  # New fields should not use Values - it is a 'primary' config object, users should be able
+  # to fine tune it or use it with kube-inject.
+  config: |-
+    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
+    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
+    defaultTemplates:
+{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
+    - {{ . }}
+{{- end }}
+    {{- else }}
+    defaultTemplates: [sidecar]
+    {{- end }}
+    policy: {{ .Values.global.proxy.autoInject }}
+    alwaysInjectSelector:
+{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
+    neverInjectSelector:
+{{ toYaml .Values.sidecarInjectorWebhook.neverInjectSelector | trim | indent 6 }}
+    injectedAnnotations:
+      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
+      "{{ $key }}": {{ $val | quote }}
+      {{- end }}
+    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
+         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
+         This should make it obvious that their installation is broken.
+     */}}
+    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}
+    templates:
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "sidecar") }}
+      sidecar: |
+{{ .Files.Get "files/injection-template.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
+      gateway: |
+{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
+      grpc-simple: |
+{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
+      grpc-agent: |
+{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
+      waypoint: |
+{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}
+{{- end }}
+{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "kube-gateway") }}
+      kube-gateway: |
+{{ .Files.Get "files/kube-gateway.yaml" | trim | indent 8 }}
+{{- end }}
+{{- with .Values.sidecarInjectorWebhook.templates }}
+{{ toYaml . | trim | indent 6 }}
+{{- end }}
+
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/mutatingwebhook.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/mutatingwebhook.yaml
new file mode 100644
index 000000000..26a6c8f00
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/mutatingwebhook.yaml
@@ -0,0 +1,167 @@
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- /* Core defines the common configuration used by all webhook segments */}}
+{{/* Copy just what we need to avoid expensive deepCopy */}}
+{{- $whv := dict
+"revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "caBundle" .Values.istiodRemote.injectionCABundle
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+    {{- if .caBundle }}
+    caBundle: "{{ .caBundle }}"
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
+{{- if not .Values.global.operatorManageWebhooks }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq .Release.Namespace "istio-system"}}
+  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+{{- else }}
+  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}
+
+{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
+{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      {{- if (eq .Values.revision "") }}
+      - "default"
+      {{- else }}
+      - "{{ .Values.revision }}"
+      {{- end }}
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: No namespace selector, but object selects our revision (and doesn't disable) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      {{- if (eq .Values.revision "") }}
+      - "default"
+      {{- else }}
+      - "{{ .Values.revision }}"
+      {{- end }}
+
+
+{{- /* Webhooks for default revision */}}
+{{- if (eq .Values.revision "") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if .Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/networkpolicy.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/networkpolicy.yaml
new file mode 100644
index 000000000..e844d5e5d
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/networkpolicy.yaml
@@ -0,0 +1,47 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+{{- if (.Values.global.networkPolicy).enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istiod
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    istio: pilot
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      app: istiod
+      istio.io/rev: {{ .Values.revision | default "default" | quote }}
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  # Webhook from kube-apiserver
+  - from: []
+    ports:
+    - protocol: TCP
+      port: 15017
+  # xDS from potentially anywhere
+  - from: []
+    ports:
+    - protocol: TCP
+      port: 15010
+    - protocol: TCP
+      port: 15011
+    - protocol: TCP
+      port: 15012
+    - protocol: TCP
+      port: 8080
+    - protocol: TCP
+      port: 15014
+  # Allow all egress (needed because features like JWKS require connections to user-defined endpoints)
+  egress:
+  - {}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/poddisruptionbudget.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/poddisruptionbudget.yaml
new file mode 100644
index 000000000..0ac37d1cd
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/poddisruptionbudget.yaml
@@ -0,0 +1,41 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
+# a workaround for https://github.com/kubernetes/kubernetes/issues/93476
+{{- if or (and .Values.autoscaleEnabled  (gt (int .Values.autoscaleMin) 1)) (and (not .Values.autoscaleEnabled) (gt (int .Values.replicaCount) 1)) }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: istiod
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    release: {{ .Release.Name }}
+    istio: pilot
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  {{- if and .Values.pdb.minAvailable (not (hasKey .Values.pdb "maxUnavailable")) }}
+  minAvailable: {{ .Values.pdb.minAvailable }}
+  {{- else if .Values.pdb.maxUnavailable }}
+  maxUnavailable: {{ .Values.pdb.maxUnavailable }}
+  {{- end }}
+  {{- if .Values.pdb.unhealthyPodEvictionPolicy }}
+  unhealthyPodEvictionPolicy: {{ .Values.pdb.unhealthyPodEvictionPolicy }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app: istiod
+      {{- if ne .Values.revision "" }}
+      istio.io/rev: {{ .Values.revision | quote }}
+      {{- else }}
+      istio: pilot
+      {{- end }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/reader-clusterrole.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/reader-clusterrole.yaml
new file mode 100644
index 000000000..e0b0ff42a
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/reader-clusterrole.yaml
@@ -0,0 +1,65 @@
+# Created if cluster resources are not omitted
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+{{ $mcsAPIGroup := or .Values.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istio-reader
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istio-reader"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - "config.istio.io"
+      - "security.istio.io"
+      - "networking.istio.io"
+      - "authentication.istio.io"
+      - "rbac.istio.io"
+      - "telemetry.istio.io"
+      - "extensions.istio.io"
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.istio.io"]
+    verbs: [ "get", "watch", "list" ]
+    resources: [ "workloadentries" ]
+  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
+    resources: ["gateways"]
+    verbs: ["get", "watch", "list"]
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceexports"]
+    verbs: ["get", "list", "watch", "create", "delete"]
+  - apiGroups: ["{{ $mcsAPIGroup }}"]
+    resources: ["serviceimports"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]
+  - apiGroups: ["authorization.k8s.io"]
+    resources: ["subjectaccessreviews"]
+    verbs: ["create"]
+{{- if .Values.istiodRemote.enabled }}
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create", "get", "list", "watch", "update"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch", "update"]
+{{- end}}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/reader-clusterrolebinding.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/reader-clusterrolebinding.yaml
new file mode 100644
index 000000000..624f00dce
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/reader-clusterrolebinding.yaml
@@ -0,0 +1,20 @@
+# Created if cluster resources are not omitted
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+  labels:
+    app: istio-reader
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istio-reader"
+    {{- include "istio.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: istio-reader-service-account
+    namespace: {{ .Values.global.istioNamespace }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/remote-istiod-endpointslices.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/remote-istiod-endpointslices.yaml
new file mode 100644
index 000000000..e2f4ff03b
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/remote-istiod-endpointslices.yaml
@@ -0,0 +1,42 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+{{- if and .Values.global.remotePilotAddress .Values.istiodRemote.enabled }}
+# if the remotePilotAddress is an IP addr
+{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  {{- if .Values.istiodRemote.enabledLocalInjectorIstiod }}
+  # This file is only used for remote `istiod` installs.
+  # only primary `istiod` to xds and local `istiod` injection installs.
+  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
+  {{- else }}
+  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
+  {{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- if .Values.istiodRemote.enabledLocalInjectorIstiod }}
+    # only primary `istiod` to xds and local `istiod` injection installs.
+    kubernetes.io/service-name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
+    {{- else }}
+    kubernetes.io/service-name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
+    {{- end }}
+    {{- if .Release.Service }}
+    endpointslice.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+    {{- end }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+addressType: IPv4
+endpoints:
+- addresses:
+  - {{ .Values.global.remotePilotAddress }}
+ports:
+- port: 15012
+  name: tcp-istiod
+  protocol: TCP
+- port: 15017
+  name: tcp-webhook
+  protocol: TCP
+---
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/remote-istiod-service.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/remote-istiod-service.yaml
new file mode 100644
index 000000000..ab14497ba
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/remote-istiod-service.yaml
@@ -0,0 +1,43 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# This file is only used for remote
+{{- if and .Values.global.remotePilotAddress .Values.istiodRemote.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  {{- if .Values.istiodRemote.enabledLocalInjectorIstiod }}
+  # only primary `istiod` to xds and local `istiod` injection installs.
+  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
+  {{- else }}
+  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
+  {{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    app.kubernetes.io/name: "istiod"
+    {{ include "istio.labels" . | nindent 4 }}
+spec:
+  ports:
+  - port: 15012
+    name: tcp-istiod
+    protocol: TCP
+  - port: 443
+    targetPort: 15017
+    name: tcp-webhook
+    protocol: TCP
+  {{- if and .Values.global.remotePilotAddress (not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress)) }}
+  # if the remotePilotAddress is not an IP addr, we use ExternalName
+  type: ExternalName
+  externalName: {{ .Values.global.remotePilotAddress }}
+  {{- end }}
+{{- if .Values.global.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
+{{- end }}
+{{- if .Values.global.ipFamilies }}
+  ipFamilies:
+{{- range .Values.global.ipFamilies }}
+  - {{ . }}
+{{- end }}
+{{- end }}
+---
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/revision-tags-mwc.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/revision-tags-mwc.yaml
new file mode 100644
index 000000000..556bb2f1e
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/revision-tags-mwc.yaml
@@ -0,0 +1,154 @@
+# Adapted from istio-discovery/templates/mutatingwebhook.yaml
+# Removed paths for legacy and default selectors since a revision tag
+# is inherently created from a specific revision
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- $whv := dict
+"revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "caBundle" .Values.istiodRemote.injectionCABundle
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+{{- if not .Values.global.operatorManageWebhooks }}
+{{- range $tagName := $.Values.revisionTags }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq $.Release.Namespace "istio-system"}}
+  name: istio-revision-tag-{{ $tagName }}
+{{- else }}
+  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/tag: {{ $tagName }}
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+
+{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
+{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
+{{- if (eq $tagName "default") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/revision-tags-svc.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/revision-tags-svc.yaml
new file mode 100644
index 000000000..5c4826d23
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/revision-tags-svc.yaml
@@ -0,0 +1,57 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Adapted from istio-discovery/templates/service.yaml
+{{- range $tagName := .Values.revisionTags }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: istiod-revision-tag-{{ $tagName }}
+  namespace: {{ $.Release.Namespace }}
+  {{- if $.Values.serviceAnnotations }}
+  annotations:
+{{ toYaml $.Values.serviceAnnotations | indent 4 }}
+  {{- end }}
+  labels:
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    istio.io/tag: {{ $tagName }}
+    operator.istio.io/component: "Pilot"
+    app: istiod
+    istio: pilot
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+spec:
+  ports:
+    - port: 15010
+      name: grpc-xds # plaintext
+      protocol: TCP
+    - port: 15012
+      name: https-dns # mTLS with k8s-signed cert
+      protocol: TCP
+    - port: 443
+      name: https-webhook # validation and injection
+      targetPort: 15017
+      protocol: TCP
+    - port: 15014
+      name: http-monitoring # prometheus stats
+      protocol: TCP
+  selector:
+    app: istiod
+    {{- if ne $.Values.revision "" }}
+    istio.io/rev: {{ $.Values.revision | quote }}
+    {{- else }}
+    # Label used by the 'default' service. For versioned deployments we match with app and version.
+    # This avoids default deployment picking the canary
+    istio: pilot
+    {{- end }}
+  {{- if $.Values.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ $.Values.ipFamilyPolicy }}
+  {{- end }}
+  {{- if $.Values.ipFamilies }}
+  ipFamilies:
+  {{- range $.Values.ipFamilies }}
+  - {{ . }}
+  {{- end }}
+  {{- end }}
+---
+{{- end -}}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/role.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/role.yaml
new file mode 100644
index 000000000..8abe608b6
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/role.yaml
@@ -0,0 +1,37 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Values.global.istioNamespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+rules:
+# permissions to verify the webhook is ready and rejecting
+# invalid config. We use --server-dry-run so no config is persisted.
+- apiGroups: ["networking.istio.io"]
+  verbs: ["create"]
+  resources: ["gateways"]
+
+# For storing CA secret
+- apiGroups: [""]
+  resources: ["secrets"]
+  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
+  verbs: ["create", "get", "watch", "list", "update", "delete"]
+
+# For status controller, so it can delete the distribution report configmap
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["delete"]
+
+# For gateway deployment controller
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  verbs: ["get", "update", "patch", "create"]
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/rolebinding.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/rolebinding.yaml
new file mode 100644
index 000000000..731964f04
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/rolebinding.yaml
@@ -0,0 +1,23 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Values.global.istioNamespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
+subjects:
+  - kind: ServiceAccount
+    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+    namespace: {{ .Values.global.istioNamespace }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/service.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/service.yaml
new file mode 100644
index 000000000..c3aade8a4
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/service.yaml
@@ -0,0 +1,59 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Not created if istiod is running remotely
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled .Values.istiodRemote.enabledLocalInjectorIstiod) }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  {{- if .Values.serviceAnnotations }}
+  annotations:
+{{ toYaml .Values.serviceAnnotations | indent 4 }}
+  {{- end }}
+  labels:
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: istiod
+    istio: pilot
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  ports:
+    - port: 15010
+      name: grpc-xds # plaintext
+      protocol: TCP
+    - port: 15012
+      name: https-dns # mTLS with k8s-signed cert
+      protocol: TCP
+    - port: 443
+      name: https-webhook # validation and injection
+      targetPort: 15017
+      protocol: TCP
+    - port: 15014
+      name: http-monitoring # prometheus stats
+      protocol: TCP
+  selector:
+    app: istiod
+    {{- if ne .Values.revision "" }}
+    istio.io/rev: {{ .Values.revision | quote }}
+    {{- else }}
+    # Label used by the 'default' service. For versioned deployments we match with app and version.
+    # This avoids default deployment picking the canary
+    istio: pilot
+    {{- end }}
+  {{- if .Values.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.ipFamilyPolicy }}
+  {{- end }}
+  {{- if .Values.ipFamilies }}
+  ipFamilies:
+  {{- range .Values.ipFamilies }}
+  - {{ . }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.trafficDistribution }}
+  trafficDistribution: {{ .Values.trafficDistribution }}
+  {{- end }}
+---
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/serviceaccount.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/serviceaccount.yaml
new file mode 100644
index 000000000..ee40eedf8
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/serviceaccount.yaml
@@ -0,0 +1,26 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+apiVersion: v1
+kind: ServiceAccount
+  {{- if .Values.global.imagePullSecrets }}
+imagePullSecrets:
+  {{- range .Values.global.imagePullSecrets }}
+  - name: {{ . }}
+  {{- end }}
+  {{- end }}
+metadata:
+  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Values.global.istioNamespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+  {{- if .Values.serviceAccountAnnotations }}
+  annotations:
+{{- toYaml .Values.serviceAccountAnnotations | nindent 4 }}
+  {{- end }}
+{{- end }}
+---
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/validatingadmissionpolicy.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/validatingadmissionpolicy.yaml
new file mode 100644
index 000000000..838d9fbaf
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/validatingadmissionpolicy.yaml
@@ -0,0 +1,65 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+{{- if .Values.experimental.stableValidationPolicy }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
+  labels:
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:
+        - security.istio.io
+        - networking.istio.io
+        - telemetry.istio.io
+        - extensions.istio.io
+      apiVersions: ["*"]
+      operations:  ["CREATE", "UPDATE"]
+      resources:   ["*"]
+    objectSelector:
+      matchExpressions:
+        - key: istio.io/rev
+          operator: In
+          values:
+          {{- if (eq .Values.revision "") }}
+          - "default"
+          {{- else }}
+          - "{{ .Values.revision }}"
+          {{- end }}
+  variables:
+    - name: isEnvoyFilter
+      expression: "object.kind == 'EnvoyFilter'"
+    - name: isWasmPlugin
+      expression: "object.kind == 'WasmPlugin'"
+    - name: isProxyConfig
+      expression: "object.kind == 'ProxyConfig'"
+    - name: isTelemetry
+      expression: "object.kind == 'Telemetry'"
+  validations:
+    - expression: "!variables.isEnvoyFilter"
+    - expression: "!variables.isWasmPlugin"
+    - expression: "!variables.isProxyConfig"
+    - expression: |
+        !(
+          variables.isTelemetry && (
+            (has(object.spec.tracing) ? object.spec.tracing : {}).exists(t, has(t.useRequestIdForTraceSampling)) ||
+            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
+            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
+          )
+        )
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: "stable-channel-policy-binding{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
+spec:
+  policyName: "stable-channel-policy{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}.istio.io"
+  validationActions: [Deny]
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/validatingwebhookconfiguration.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/validatingwebhookconfiguration.yaml
new file mode 100644
index 000000000..6903b29b5
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/validatingwebhookconfiguration.yaml
@@ -0,0 +1,70 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+# Created if this is not a remote istiod, OR if it is and is also a config cluster
+{{- if or (not .Values.istiodRemote.enabled) (and .Values.istiodRemote.enabled (or .Values.global.configCluster .Values.istiodRemote.enabledLocalInjectorIstiod)) }}
+{{- if .Values.global.configValidation }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
+  labels:
+    app: istiod
+    release: {{ .Release.Name }}
+    istio: istiod
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" . | nindent 4 }}
+webhooks:
+  # Webhook handling per-revision validation. Mostly here so we can determine whether webhooks
+  # are rejecting invalid configs on a per-revision basis.
+  - name: rev.validation.istio.io
+    clientConfig:
+      # Should change from base but cannot for API compat
+      {{- if .Values.base.validationURL }}
+      url: {{ .Values.base.validationURL }}
+      {{- else }}
+      service:
+        name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+        namespace: {{ .Values.global.istioNamespace }}
+        path: "/validate"
+      {{- end }}
+      {{- if .Values.base.validationCABundle }}
+      caBundle: "{{ .Values.base.validationCABundle }}"
+      {{- end }}
+    rules:
+      - operations:
+          - CREATE
+          - UPDATE
+        apiGroups:
+          - security.istio.io
+          - networking.istio.io
+          - telemetry.istio.io
+          - extensions.istio.io
+        apiVersions:
+          - "*"
+        resources:
+          - "*"
+    {{- if .Values.base.validationCABundle }}
+    # Disable webhook controller in Pilot to stop patching it
+    failurePolicy: Fail
+    {{- else }}
+    # Fail open until the validation webhook is ready. The webhook controller
+    # will update this to `Fail` and patch in the `caBundle` when the webhook
+    # endpoint is ready.
+    failurePolicy: Ignore
+    {{- end }}
+    sideEffects: None
+    admissionReviewVersions: ["v1"]
+    objectSelector:
+      matchExpressions:
+        - key: istio.io/rev
+          operator: In
+          values:
+          {{- if (eq .Values.revision "") }}
+          - "default"
+          {{- else }}
+          - "{{ .Values.revision }}"
+          {{- end }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/zzy_descope_legacy.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/zzy_descope_legacy.yaml
new file mode 100644
index 000000000..73202418c
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/zzy_descope_legacy.yaml
@@ -0,0 +1,3 @@
+{{/* Copy anything under `.pilot` to `.`, to avoid the need to specify a redundant prefix.
+Due to the file naming, this always happens after zzz_profile.yaml */}}
+{{- $_ := mustMergeOverwrite $.Values (index $.Values "pilot") }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/zzz_profile.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/zzz_profile.yaml
new file mode 100644
index 000000000..3d8495648
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if false }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/istiod/values.yaml b/resources/v1.29-alpha.b2f713a9/charts/istiod/values.yaml
new file mode 100644
index 000000000..9394f353f
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/istiod/values.yaml
@@ -0,0 +1,583 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  autoscaleBehavior: {}
+  replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+
+  hub: ""
+  tag: ""
+  variant: ""
+
+  # Can be a full hub/image:tag
+  image: pilot
+  traceSampling: 1.0
+
+  # Resources for a small pilot install
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2048Mi
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # Whether to use an existing CNI installation
+  cni:
+    enabled: false
+    provider: default
+
+  # Additional container arguments
+  extraContainerArgs: []
+
+  env: {}
+
+  envVarFrom: []
+
+  # Settings related to the untaint controller
+  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
+  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
+  taint:
+    # Controls whether or not the untaint controller is active
+    enabled: false
+    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
+    namespace: ""
+
+  affinity: {}
+
+  tolerations: []
+
+  cpu:
+    targetAverageUtilization: 80
+  memory: {}
+    # targetAverageUtilization: 80
+
+  # Additional volumeMounts to the istiod container
+  volumeMounts: []
+
+  # Additional volumes to the istiod pod
+  volumes: []
+
+  # Inject initContainers into the istiod pod
+  initContainers: []
+
+  nodeSelector: {}
+  podAnnotations: {}
+  serviceAnnotations: {}
+  serviceAccountAnnotations: {}
+  sidecarInjectorWebhookAnnotations: {}
+
+  topologySpreadConstraints: []
+
+  # You can use jwksResolverExtraRootCA to provide a root certificate
+  # in PEM format. This will then be trusted by pilot when resolving
+  # JWKS URIs.
+  jwksResolverExtraRootCA: ""
+
+  # The following is used to limit how long a sidecar can be connected
+  # to a pilot. It balances out load across pilot instances at the cost of
+  # increasing system churn.
+  keepaliveMaxServerConnectionAge: 30m
+
+  # Additional labels to apply to the deployment.
+  deploymentLabels: {}
+
+  # Annotations to apply to the istiod deployment.
+  deploymentAnnotations: {}
+
+  ## Mesh config settings
+
+  # Install the mesh config map, generated from values.yaml.
+  # If false, pilot wil use default values (by default) or user-supplied values.
+  configMap: true
+
+  # Additional labels to apply on the pod level for monitoring and logging configuration.
+  podLabels: {}
+
+  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
+  ipFamilyPolicy: ""
+  ipFamilies: []
+
+  # Ambient mode only.
+  # Set this if you install ztunnel to a different namespace from `istiod`.
+  # If set, `istiod` will allow connections from trusted node proxy ztunnels
+  # in the provided namespace.
+  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
+  # in the same namespace as itself.
+  trustedZtunnelNamespace: ""
+  # Set this if you install ztunnel with a name different from the default.
+  trustedZtunnelName: ""
+
+  sidecarInjectorWebhook:
+    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
+    # always skip the injection on pods that match that label selector, regardless of the global policy.
+    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
+    neverInjectSelector: []
+    alwaysInjectSelector: []
+
+    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
+    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
+    #
+    # annotations:
+    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+    #
+    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
+    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
+    # injectedAnnotations:
+    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
+    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
+    injectedAnnotations: {}
+
+    # This enables injection of sidecar in all namespaces,
+    # with the exception of namespaces with "istio-injection:disabled" annotation
+    # Only one environment should have this enabled.
+    enableNamespacesByDefault: false
+
+    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
+    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
+    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
+    reinvocationPolicy: Never
+
+    rewriteAppHTTPProbe: true
+
+    # Templates defines a set of custom injection templates that can be used. For example, defining:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
+    # being injected with the hello=world labels.
+    # This is intended for advanced configuration only; most users should use the built in template
+    templates: {}
+
+    # Default templates specifies a set of default templates that are used in sidecar injection.
+    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
+    # To inject other additional templates, define it using the `templates` option, and add it to
+    # the default templates list.
+    # For example:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # defaultTemplates: ["sidecar", "hello"]
+    defaultTemplates: []
+  istiodRemote:
+    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
+    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
+    # to utilize a remote instance.
+    enabled: false
+
+    # If `true`, indicates that this cluster/install should consume a "local istiod" installation,
+    # local istiod inject sidecars
+    enabledLocalInjectorIstiod: false
+
+    # Sidecar injector mutating webhook configuration clientConfig.url value.
+    # For example: https://$remotePilotAddress:15017/inject
+    # The host should not refer to a service running in the cluster; use a service reference by specifying
+    # the clientConfig.service field instead.
+    injectionURL: ""
+
+    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
+    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
+    injectionPath: "/inject"
+
+    injectionCABundle: ""
+  telemetry:
+    enabled: true
+    v2:
+      # For Null VM case now.
+      # This also enables metadata exchange.
+      enabled: true
+      # Indicate if prometheus stats filter is enabled or not
+      prometheus:
+        enabled: true
+      # stackdriver filter settings.
+      stackdriver:
+        enabled: false
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # Revision tags are aliases to Istio control plane revisions
+  revisionTags: []
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
+  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
+  meshConfig:
+    enablePrometheusMerge: true
+
+  experimental:
+    stableValidationPolicy: false
+
+  global:
+    # Used to locate istiod.
+    istioNamespace: istio-system
+    # List of cert-signers to allow "approve" action in the istio cluster role
+    #
+    # certSigners:
+    #   - clusterissuers.cert-manager.io/istio-ca
+    certSigners: []
+    # enable pod disruption budget for the control plane, which is used to
+    # ensure Istio control plane components are gradually upgraded or recovered.
+    defaultPodDisruptionBudget:
+      enabled: true
+      # The values aren't mutable due to a current PodDisruptionBudget limitation
+      # minAvailable: 1
+
+    # A minimal set of requested resources to applied to all deployments so that
+    # Horizontal Pod Autoscaler will be able to function (if set).
+    # Each component can overwrite these default values by adding its own resources
+    # block in the relevant section below and setting the desired resources values.
+    defaultResources:
+      requests:
+        cpu: 10m
+      #   memory: 128Mi
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-testing
+    # Default tag for Istio images.
+    tag: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Enabled by default in master for maximising testing.
+    istiod:
+      enableAnalysis: false
+
+    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
+    logAsJson: false
+
+    # In order to use native nftable rules instead of iptable rules, set this flag to true.
+    nativeNftables: false
+
+    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+    # The control plane has different scopes depending on component, but can configure default log level across all components
+    # If empty, default scope and level will be used as configured in code
+    logging:
+      level: "default:info"
+
+    # When enabled, default NetworkPolicy resources will be created
+    networkPolicy:
+      enabled: false
+
+    omitSidecarInjectorConfigMap: false
+
+    # resourceScope controls what resources will be processed by helm.
+    # This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
+    # It can be one of:
+    # - all: all resources are processed
+    # - cluster: only cluster-scoped resources are processed
+    # - namespace: only namespace-scoped resources are processed
+    resourceScope: all
+
+    # Configure whether Operator manages webhook configurations. The current behavior
+    # of Istiod is to manage its own webhook configurations.
+    # When this option is set as true, Istio Operator, instead of webhooks, manages the
+    # webhook configurations. When this option is set as false, webhooks manage their
+    # own webhook configurations.
+    operatorManageWebhooks: false
+
+    # Custom DNS config for the pod to resolve names of services in other
+    # clusters. Use this to add additional search domains, and other settings.
+    # see
+    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
+    # This does not apply to gateway pods as they typically need a different
+    # set of DNS settings than the normal application pods (e.g., in
+    # multicluster scenarios).
+    # NOTE: If using templates, follow the pattern in the commented example below.
+    #podDNSSearchNamespaces:
+    #- global
+    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
+
+    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
+    # system-node-critical, it is better to configure this in order to make sure your Istio pods
+    # will not be killed because of low priority class.
+    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+    # for more detail.
+    priorityClassName: ""
+
+    proxy:
+      image: proxyv2
+
+      # This controls the 'policy' in the sidecar injector.
+      autoInject: enabled
+
+      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
+      # cluster domain. Default value is "cluster.local".
+      clusterDomain: "cluster.local"
+
+      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
+      # not set, then the global "logLevel" will be used.
+      componentLogLevel: "misc:error"
+
+      # istio ingress capture allowlist
+      # examples:
+      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
+      excludeInboundPorts: ""
+      includeInboundPorts: "*"
+
+      # istio egress capture allowlist
+      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
+      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
+      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
+      # be allowed by the sidecar
+      includeIPRanges: "*"
+      excludeIPRanges: ""
+      includeOutboundPorts: ""
+      excludeOutboundPorts: ""
+
+      # Log level for proxy, applies to gateways and sidecars.
+      # Expected values are: trace|debug|info|warning|error|critical|off
+      logLevel: warning
+
+      # Specify the path to the outlier event log.
+      # Example: /dev/stdout
+      outlierLogPath: ""
+
+      #If set to true, istio-proxy container will have privileged securityContext
+      privileged: false
+      
+      seccompProfile: {}
+
+      # The number of successive failed probes before indicating readiness failure.
+      readinessFailureThreshold: 4
+
+      # The initial delay for readiness probes in seconds.
+      readinessInitialDelaySeconds: 0
+
+      # The period between readiness probes.
+      readinessPeriodSeconds: 15
+
+      # Enables or disables a startup probe.
+      # For optimal startup times, changing this should be tied to the readiness probe values.
+      #
+      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
+      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
+      # and doesn't spam the readiness endpoint too much
+      #
+      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
+      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
+      startupProbe:
+        enabled: true
+        failureThreshold: 600 # 10 minutes
+
+      # Resources for the sidecar.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: 2000m
+          memory: 1024Mi
+
+      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
+      statusPort: 15020
+
+      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
+      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
+      tracer: "none"
+
+    proxy_init:
+      # Base name for the proxy_init container, used to configure iptables.
+      image: proxyv2
+      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
+      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
+      forceApplyIptables: false
+
+    # configure remote pilot and istiod service and endpoint
+    remotePilotAddress: ""
+
+    ##############################################################################################
+    # The following values are found in other charts. To effectively modify these values, make   #
+    # make sure they are consistent across your Istio helm charts                                #
+    ##############################################################################################
+
+    # The customized CA address to retrieve certificates for the pods in the cluster.
+    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+    # If not set explicitly, default to the Istio discovery address.
+    caAddress: ""
+
+    # Enable control of remote clusters.
+    externalIstiod: false
+
+    # Configure a remote cluster as the config cluster for an external istiod.
+    configCluster: false
+
+    # configValidation enables the validation webhook for Istio configuration.
+    configValidation: true
+
+    # Mesh ID means Mesh Identifier. It should be unique within the scope where
+    # meshes will interact with each other, but it is not required to be
+    # globally/universally unique. For example, if any of the following are true,
+    # then two meshes must have different Mesh IDs:
+    # - Meshes will have their telemetry aggregated in one place
+    # - Meshes will be federated together
+    # - Policy will be written referencing one mesh from the other
+    #
+    # If an administrator expects that any of these conditions may become true in
+    # the future, they should ensure their meshes have different Mesh IDs
+    # assigned.
+    #
+    # Within a multicluster mesh, each cluster must be (manually or auto)
+    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
+    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
+    # of migration TBD, and it may be a disruptive operation to change the Mesh
+    # ID post-install.
+    #
+    # If the mesh admin does not specify a value, Istio will use the value of the
+    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
+    # value.
+    meshID: ""
+
+    # Configure the mesh networks to be used by the Split Horizon EDS.
+    #
+    # The following example defines two networks with different endpoints association methods.
+    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
+    # mapped to network1. The gateway for this network example is specified by its public IP
+    # address and port.
+    # The second network, `network2`, in this example is defined differently with all endpoints
+    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
+    # gateway is also defined differently with the name of the gateway service on the remote
+    # cluster. The public IP for the gateway will be determined from that remote service (only
+    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
+    # it still need to be configured manually).
+    #
+    # meshNetworks:
+    #   network1:
+    #     endpoints:
+    #     - fromCidr: "192.168.0.1/24"
+    #     gateways:
+    #     - address: 1.1.1.1
+    #       port: 80
+    #   network2:
+    #     endpoints:
+    #     - fromRegistry: reg1
+    #     gateways:
+    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
+    #       port: 443
+    #
+    meshNetworks: {}
+
+    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
+    mountMtlsCerts: false
+
+    multiCluster:
+      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
+      # to properly label proxies
+      clusterName: ""
+
+    # Network defines the network this cluster belong to. This name
+    # corresponds to the networks in the map of mesh networks.
+    network: ""
+
+    # Configure the certificate provider for control plane communication.
+    # Currently, two providers are supported: "kubernetes" and "istiod".
+    # As some platforms may not have kubernetes signing APIs,
+    # Istiod is the default
+    pilotCertProvider: istiod
+
+    sds:
+      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
+      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
+      # JWT is intended for the CA.
+      token:
+        aud: istio-ca
+
+    sts:
+      # The service port used by Security Token Service (STS) server to handle token exchange requests.
+      # Setting this port to a non-zero value enables STS server.
+      servicePort: 0
+
+    # The name of the CA for workload certificates.
+    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
+    # will be used as the certificates for workloads.
+    # The default value is "" and when caName="", the CA will be configured by other
+    # mechanisms (e.g., environmental variable CA_PROVIDER).
+    caName: ""
+
+    waypoint:
+      # Resources for the waypoint proxy.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: "2"
+          memory: 1Gi
+
+      # If specified, affinity defines the scheduling constraints of waypoint pods.
+      affinity: {}
+
+      # Topology Spread Constraints for the waypoint proxy.
+      topologySpreadConstraints: []
+
+      # Node labels for the waypoint proxy.
+      nodeSelector: {}
+
+      # Tolerations for the waypoint proxy.
+      tolerations: []
+
+  base:
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  # Gateway Settings
+  gateways:
+    # Define the security context for the pod.
+    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+    securityContext: {}
+
+    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
+    seccompProfile: {}
+
+  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
+  # For example:
+  # gatewayClasses:
+  #   istio:
+  #     service:
+  #       spec:
+  #         type: ClusterIP
+  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
+  gatewayClasses: {}
+  
+  pdb:
+    # -- Minimum available pods set in PodDisruptionBudget.
+    # Define either 'minAvailable' or 'maxUnavailable', never both.
+    minAvailable: 1
+    # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
+    # maxUnavailable: 1
+    # -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.
+    # Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/
+    unhealthyPodEvictionPolicy: ""
diff --git a/resources/v1.29-alpha.b2f713a9/charts/revisiontags/Chart.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/Chart.yaml
new file mode 100644
index 000000000..0eb75bc90
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/Chart.yaml
@@ -0,0 +1,8 @@
+apiVersion: v2
+appVersion: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+description: Helm chart for istio revision tags
+name: revisiontags
+sources:
+- https://github.com/istio-ecosystem/sail-operator
+version: 0.1.0
+
diff --git a/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-ambient.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-compatibility-version-1.25.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..3827ee78f
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,16 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+     # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-compatibility-version-1.26.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..b690d25ca
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-compatibility-version-1.27.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-compatibility-version-1.27.yaml
new file mode 100644
index 000000000..9f9ba7b67
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-compatibility-version-1.27.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-compatibility-version-1.28.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-compatibility-version-1.28.yaml
new file mode 100644
index 000000000..96d9c1f52
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-compatibility-version-1.28.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-demo.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-demo.yaml
new file mode 100644
index 000000000..d6dc36dd0
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-demo.yaml
@@ -0,0 +1,94 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The demo profile enables a variety of things to try out Istio in non-production environments.
+# * Lower resource utilization.
+# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
+# * More ports enabled on the ingress, which is used in some tasks.
+meshConfig:
+  accessLogFile: /dev/stdout
+  extensionProviders:
+    - name: otel
+      envoyOtelAls:
+        service: opentelemetry-collector.observability.svc.cluster.local
+        port: 4317
+    - name: skywalking
+      skywalking:
+        service: tracing.istio-system.svc.cluster.local
+        port: 11800
+    - name: otel-tracing
+      opentelemetry:
+        port: 4317
+        service: opentelemetry-collector.observability.svc.cluster.local
+    - name: jaeger
+      opentelemetry:
+        port: 4317
+        service: jaeger-collector.istio-system.svc.cluster.local        
+
+cni:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 40Mi
+
+ztunnel:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 40Mi
+
+global:
+  proxy:
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+  waypoint:
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+
+pilot:
+  autoscaleEnabled: false
+  traceSampling: 100
+  resources:
+    requests:
+      cpu: 10m
+      memory: 100Mi
+
+gateways:
+  istio-egressgateway:
+    autoscaleEnabled: false
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+  istio-ingressgateway:
+    autoscaleEnabled: false
+    ports:
+    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
+    # Note that AWS ELB will by default perform health checks on the first port
+    # on this list. Setting this to the health check port will ensure that health
+    # checks always work. https://github.com/istio/istio/issues/12503
+    - port: 15021
+      targetPort: 15021
+      name: status-port
+    - port: 80
+      targetPort: 8080
+      name: http2
+    - port: 443
+      targetPort: 8443
+      name: https
+    - port: 31400
+      targetPort: 31400
+      name: tcp
+      # This is the port where sni routing happens
+    - port: 15443
+      targetPort: 15443
+      name: tls
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-platform-gke.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.6/charts/revisiontags/files/profile-platform-k3d.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.6/charts/revisiontags/files/profile-platform-k3d.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-platform-k3d.yaml
diff --git a/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-platform-k3s.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-platform-k3s.yaml
new file mode 100644
index 000000000..07820106d
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-platform-k3s.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
+  cniBinDir: /var/lib/rancher/k3s/data/cni
diff --git a/resources/v1.24.6/charts/revisiontags/files/profile-platform-microk8s.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.6/charts/revisiontags/files/profile-platform-microk8s.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.6/charts/revisiontags/files/profile-platform-minikube.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.6/charts/revisiontags/files/profile-platform-minikube.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.6/charts/revisiontags/files/profile-platform-openshift.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.6/charts/revisiontags/files/profile-platform-openshift.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.6/charts/revisiontags/files/profile-preview.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.6/charts/revisiontags/files/profile-preview.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-preview.yaml
diff --git a/resources/v1.24.6/charts/revisiontags/files/profile-remote.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.6/charts/revisiontags/files/profile-remote.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-remote.yaml
diff --git a/resources/v1.24.6/charts/revisiontags/files/profile-stable.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.6/charts/revisiontags/files/profile-stable.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/revisiontags/files/profile-stable.yaml
diff --git a/resources/v1.29-alpha.b2f713a9/charts/revisiontags/templates/revision-tags-mwc.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/templates/revision-tags-mwc.yaml
new file mode 100644
index 000000000..556bb2f1e
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/templates/revision-tags-mwc.yaml
@@ -0,0 +1,154 @@
+# Adapted from istio-discovery/templates/mutatingwebhook.yaml
+# Removed paths for legacy and default selectors since a revision tag
+# is inherently created from a specific revision
+# TODO BML istiodRemote.injectionURL is invalid to set if `istiodRemote.enabled` is false, we should express that.
+{{- $whv := dict
+"revision" .Values.revision
+  "injectionPath" .Values.istiodRemote.injectionPath
+  "injectionURL" .Values.istiodRemote.injectionURL
+  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
+  "caBundle" .Values.istiodRemote.injectionCABundle
+  "namespace" .Release.Namespace }}
+{{- define "core" }}
+{{- /* Kubernetes unfortunately requires a unique name for the webhook in some newer versions, so we assign
+a unique prefix to each. */}}
+- name: {{.Prefix}}sidecar-injector.istio.io
+  clientConfig:
+    {{- if .injectionURL }}
+    url: "{{ .injectionURL }}"
+    {{- else }}
+    service:
+      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
+      namespace: {{ .namespace }}
+      path: "{{ .injectionPath }}"
+      port: 443
+    {{- end }}
+  sideEffects: None
+  rules:
+  - operations: [ "CREATE" ]
+    apiGroups: [""]
+    apiVersions: ["v1"]
+    resources: ["pods"]
+  failurePolicy: Fail
+  reinvocationPolicy: "{{ .reinvocationPolicy }}"
+  admissionReviewVersions: ["v1"]
+{{- end }}
+
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "cluster") }}
+{{- if not .Values.global.operatorManageWebhooks }}
+{{- range $tagName := $.Values.revisionTags }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+{{- if eq $.Release.Namespace "istio-system"}}
+  name: istio-revision-tag-{{ $tagName }}
+{{- else }}
+  name: istio-revision-tag-{{ $tagName }}-{{ $.Release.Namespace }}
+{{- end }}
+  labels:
+    istio.io/tag: {{ $tagName }}
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Pilot"
+    app: sidecar-injector
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+{{- if $.Values.sidecarInjectorWebhookAnnotations }}
+  annotations:
+{{ toYaml $.Values.sidecarInjectorWebhookAnnotations | indent 4 }}
+{{- end }}
+webhooks:
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: istio-injection
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+    - key: istio.io/rev
+      operator: In
+      values:
+      - "{{ $tagName }}"
+
+{{- /* When the tag is "default" we want to create webhooks for the default revision */}}
+{{- /* These webhooks should be kept in sync with istio-discovery/templates/mutatingwebhook.yaml */}}
+{{- if (eq $tagName "default") }}
+
+{{- /* Case 1: Namespace selector enabled, and object selector is not injected */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "namespace.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: In
+      values:
+      - enabled
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: NotIn
+      values:
+      - "false"
+
+{{- /* Case 2: no namespace label, but object selector is enabled (and revision label is not, which has priority) */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "object.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: In
+      values:
+      - "true"
+    - key: istio.io/rev
+      operator: DoesNotExist
+
+{{- if $.Values.sidecarInjectorWebhook.enableNamespacesByDefault }}
+{{- /* Special case 3: no labels at all */}}
+{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "auto.") ) }}
+  namespaceSelector:
+    matchExpressions:
+    - key: istio-injection
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+    - key: "kubernetes.io/metadata.name"
+      operator: "NotIn"
+      values: ["kube-system","kube-public","kube-node-lease","local-path-storage"]
+  objectSelector:
+    matchExpressions:
+    - key: sidecar.istio.io/inject
+      operator: DoesNotExist
+    - key: istio.io/rev
+      operator: DoesNotExist
+{{- end }}
+
+{{- end }}
+---
+{{- end }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/revisiontags/templates/revision-tags-svc.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/templates/revision-tags-svc.yaml
new file mode 100644
index 000000000..5c4826d23
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/templates/revision-tags-svc.yaml
@@ -0,0 +1,57 @@
+{{- if or (eq .Values.global.resourceScope "all") (eq .Values.global.resourceScope "namespace") }}
+# Adapted from istio-discovery/templates/service.yaml
+{{- range $tagName := .Values.revisionTags }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: istiod-revision-tag-{{ $tagName }}
+  namespace: {{ $.Release.Namespace }}
+  {{- if $.Values.serviceAnnotations }}
+  annotations:
+{{ toYaml $.Values.serviceAnnotations | indent 4 }}
+  {{- end }}
+  labels:
+    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
+    istio.io/tag: {{ $tagName }}
+    operator.istio.io/component: "Pilot"
+    app: istiod
+    istio: pilot
+    release: {{ $.Release.Name }}
+    app.kubernetes.io/name: "istiod"
+    {{- include "istio.labels" $ | nindent 4 }}
+spec:
+  ports:
+    - port: 15010
+      name: grpc-xds # plaintext
+      protocol: TCP
+    - port: 15012
+      name: https-dns # mTLS with k8s-signed cert
+      protocol: TCP
+    - port: 443
+      name: https-webhook # validation and injection
+      targetPort: 15017
+      protocol: TCP
+    - port: 15014
+      name: http-monitoring # prometheus stats
+      protocol: TCP
+  selector:
+    app: istiod
+    {{- if ne $.Values.revision "" }}
+    istio.io/rev: {{ $.Values.revision | quote }}
+    {{- else }}
+    # Label used by the 'default' service. For versioned deployments we match with app and version.
+    # This avoids default deployment picking the canary
+    istio: pilot
+    {{- end }}
+  {{- if $.Values.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ $.Values.ipFamilyPolicy }}
+  {{- end }}
+  {{- if $.Values.ipFamilies }}
+  ipFamilies:
+  {{- range $.Values.ipFamilies }}
+  - {{ . }}
+  {{- end }}
+  {{- end }}
+---
+{{- end -}}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/revisiontags/templates/zzz_profile.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/templates/zzz_profile.yaml
new file mode 100644
index 000000000..3d8495648
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if false }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/revisiontags/values.yaml b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/values.yaml
new file mode 100644
index 000000000..9394f353f
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/revisiontags/values.yaml
@@ -0,0 +1,583 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 5
+  autoscaleBehavior: {}
+  replicaCount: 1
+  rollingMaxSurge: 100%
+  rollingMaxUnavailable: 25%
+
+  hub: ""
+  tag: ""
+  variant: ""
+
+  # Can be a full hub/image:tag
+  image: pilot
+  traceSampling: 1.0
+
+  # Resources for a small pilot install
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2048Mi
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seccompProfile: {}
+
+  # Whether to use an existing CNI installation
+  cni:
+    enabled: false
+    provider: default
+
+  # Additional container arguments
+  extraContainerArgs: []
+
+  env: {}
+
+  envVarFrom: []
+
+  # Settings related to the untaint controller
+  # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
+  # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
+  taint:
+    # Controls whether or not the untaint controller is active
+    enabled: false
+    # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
+    namespace: ""
+
+  affinity: {}
+
+  tolerations: []
+
+  cpu:
+    targetAverageUtilization: 80
+  memory: {}
+    # targetAverageUtilization: 80
+
+  # Additional volumeMounts to the istiod container
+  volumeMounts: []
+
+  # Additional volumes to the istiod pod
+  volumes: []
+
+  # Inject initContainers into the istiod pod
+  initContainers: []
+
+  nodeSelector: {}
+  podAnnotations: {}
+  serviceAnnotations: {}
+  serviceAccountAnnotations: {}
+  sidecarInjectorWebhookAnnotations: {}
+
+  topologySpreadConstraints: []
+
+  # You can use jwksResolverExtraRootCA to provide a root certificate
+  # in PEM format. This will then be trusted by pilot when resolving
+  # JWKS URIs.
+  jwksResolverExtraRootCA: ""
+
+  # The following is used to limit how long a sidecar can be connected
+  # to a pilot. It balances out load across pilot instances at the cost of
+  # increasing system churn.
+  keepaliveMaxServerConnectionAge: 30m
+
+  # Additional labels to apply to the deployment.
+  deploymentLabels: {}
+
+  # Annotations to apply to the istiod deployment.
+  deploymentAnnotations: {}
+
+  ## Mesh config settings
+
+  # Install the mesh config map, generated from values.yaml.
+  # If false, pilot wil use default values (by default) or user-supplied values.
+  configMap: true
+
+  # Additional labels to apply on the pod level for monitoring and logging configuration.
+  podLabels: {}
+
+  # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
+  ipFamilyPolicy: ""
+  ipFamilies: []
+
+  # Ambient mode only.
+  # Set this if you install ztunnel to a different namespace from `istiod`.
+  # If set, `istiod` will allow connections from trusted node proxy ztunnels
+  # in the provided namespace.
+  # If unset, `istiod` will assume the trusted node proxy ztunnel resides
+  # in the same namespace as itself.
+  trustedZtunnelNamespace: ""
+  # Set this if you install ztunnel with a name different from the default.
+  trustedZtunnelName: ""
+
+  sidecarInjectorWebhook:
+    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
+    # always skip the injection on pods that match that label selector, regardless of the global policy.
+    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
+    neverInjectSelector: []
+    alwaysInjectSelector: []
+
+    # injectedAnnotations are additional annotations that will be added to the pod spec after injection
+    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
+    #
+    # annotations:
+    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+    #
+    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
+    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
+    # injectedAnnotations:
+    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
+    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
+    injectedAnnotations: {}
+
+    # This enables injection of sidecar in all namespaces,
+    # with the exception of namespaces with "istio-injection:disabled" annotation
+    # Only one environment should have this enabled.
+    enableNamespacesByDefault: false
+
+    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
+    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
+    # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
+    reinvocationPolicy: Never
+
+    rewriteAppHTTPProbe: true
+
+    # Templates defines a set of custom injection templates that can be used. For example, defining:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
+    # being injected with the hello=world labels.
+    # This is intended for advanced configuration only; most users should use the built in template
+    templates: {}
+
+    # Default templates specifies a set of default templates that are used in sidecar injection.
+    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
+    # To inject other additional templates, define it using the `templates` option, and add it to
+    # the default templates list.
+    # For example:
+    #
+    # templates:
+    #   hello: |
+    #     metadata:
+    #       labels:
+    #         hello: world
+    #
+    # defaultTemplates: ["sidecar", "hello"]
+    defaultTemplates: []
+  istiodRemote:
+    # If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
+    # and istiod itself will NOT be installed in this cluster - only the support resources necessary
+    # to utilize a remote instance.
+    enabled: false
+
+    # If `true`, indicates that this cluster/install should consume a "local istiod" installation,
+    # local istiod inject sidecars
+    enabledLocalInjectorIstiod: false
+
+    # Sidecar injector mutating webhook configuration clientConfig.url value.
+    # For example: https://$remotePilotAddress:15017/inject
+    # The host should not refer to a service running in the cluster; use a service reference by specifying
+    # the clientConfig.service field instead.
+    injectionURL: ""
+
+    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
+    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
+    injectionPath: "/inject"
+
+    injectionCABundle: ""
+  telemetry:
+    enabled: true
+    v2:
+      # For Null VM case now.
+      # This also enables metadata exchange.
+      enabled: true
+      # Indicate if prometheus stats filter is enabled or not
+      prometheus:
+        enabled: true
+      # stackdriver filter settings.
+      stackdriver:
+        enabled: false
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  revision: ""
+
+  # Revision tags are aliases to Istio control plane revisions
+  revisionTags: []
+
+  # For Helm compatibility.
+  ownerName: ""
+
+  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
+  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
+  meshConfig:
+    enablePrometheusMerge: true
+
+  experimental:
+    stableValidationPolicy: false
+
+  global:
+    # Used to locate istiod.
+    istioNamespace: istio-system
+    # List of cert-signers to allow "approve" action in the istio cluster role
+    #
+    # certSigners:
+    #   - clusterissuers.cert-manager.io/istio-ca
+    certSigners: []
+    # enable pod disruption budget for the control plane, which is used to
+    # ensure Istio control plane components are gradually upgraded or recovered.
+    defaultPodDisruptionBudget:
+      enabled: true
+      # The values aren't mutable due to a current PodDisruptionBudget limitation
+      # minAvailable: 1
+
+    # A minimal set of requested resources to applied to all deployments so that
+    # Horizontal Pod Autoscaler will be able to function (if set).
+    # Each component can overwrite these default values by adding its own resources
+    # block in the relevant section below and setting the desired resources values.
+    defaultResources:
+      requests:
+        cpu: 10m
+      #   memory: 128Mi
+      # limits:
+      #   cpu: 100m
+      #   memory: 128Mi
+
+    # Default hub for Istio images.
+    # Releases are published to docker hub under 'istio' project.
+    # Dev builds from prow are on gcr.io
+    hub: gcr.io/istio-testing
+    # Default tag for Istio images.
+    tag: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+    # Variant of the image to use.
+    # Currently supported are: [debug, distroless]
+    variant: ""
+
+    # Specify image pull policy if default behavior isn't desired.
+    # Default behavior: latest images will be Always else IfNotPresent.
+    imagePullPolicy: ""
+
+    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
+    # to use for pulling any images in pods that reference this ServiceAccount.
+    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
+    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
+    # Must be set for any cluster configured with private docker registry.
+    imagePullSecrets: []
+    # - private-registry-key
+
+    # Enabled by default in master for maximising testing.
+    istiod:
+      enableAnalysis: false
+
+    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
+    logAsJson: false
+
+    # In order to use native nftable rules instead of iptable rules, set this flag to true.
+    nativeNftables: false
+
+    # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
+    # The control plane has different scopes depending on component, but can configure default log level across all components
+    # If empty, default scope and level will be used as configured in code
+    logging:
+      level: "default:info"
+
+    # When enabled, default NetworkPolicy resources will be created
+    networkPolicy:
+      enabled: false
+
+    omitSidecarInjectorConfigMap: false
+
+    # resourceScope controls what resources will be processed by helm.
+    # This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
+    # It can be one of:
+    # - all: all resources are processed
+    # - cluster: only cluster-scoped resources are processed
+    # - namespace: only namespace-scoped resources are processed
+    resourceScope: all
+
+    # Configure whether Operator manages webhook configurations. The current behavior
+    # of Istiod is to manage its own webhook configurations.
+    # When this option is set as true, Istio Operator, instead of webhooks, manages the
+    # webhook configurations. When this option is set as false, webhooks manage their
+    # own webhook configurations.
+    operatorManageWebhooks: false
+
+    # Custom DNS config for the pod to resolve names of services in other
+    # clusters. Use this to add additional search domains, and other settings.
+    # see
+    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
+    # This does not apply to gateway pods as they typically need a different
+    # set of DNS settings than the normal application pods (e.g., in
+    # multicluster scenarios).
+    # NOTE: If using templates, follow the pattern in the commented example below.
+    #podDNSSearchNamespaces:
+    #- global
+    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
+
+    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
+    # system-node-critical, it is better to configure this in order to make sure your Istio pods
+    # will not be killed because of low priority class.
+    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
+    # for more detail.
+    priorityClassName: ""
+
+    proxy:
+      image: proxyv2
+
+      # This controls the 'policy' in the sidecar injector.
+      autoInject: enabled
+
+      # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
+      # cluster domain. Default value is "cluster.local".
+      clusterDomain: "cluster.local"
+
+      # Per Component log level for proxy, applies to gateways and sidecars. If a component level is
+      # not set, then the global "logLevel" will be used.
+      componentLogLevel: "misc:error"
+
+      # istio ingress capture allowlist
+      # examples:
+      #     Redirect only selected ports:            --includeInboundPorts="80,8080"
+      excludeInboundPorts: ""
+      includeInboundPorts: "*"
+
+      # istio egress capture allowlist
+      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
+      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
+      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
+      # be allowed by the sidecar
+      includeIPRanges: "*"
+      excludeIPRanges: ""
+      includeOutboundPorts: ""
+      excludeOutboundPorts: ""
+
+      # Log level for proxy, applies to gateways and sidecars.
+      # Expected values are: trace|debug|info|warning|error|critical|off
+      logLevel: warning
+
+      # Specify the path to the outlier event log.
+      # Example: /dev/stdout
+      outlierLogPath: ""
+
+      #If set to true, istio-proxy container will have privileged securityContext
+      privileged: false
+      
+      seccompProfile: {}
+
+      # The number of successive failed probes before indicating readiness failure.
+      readinessFailureThreshold: 4
+
+      # The initial delay for readiness probes in seconds.
+      readinessInitialDelaySeconds: 0
+
+      # The period between readiness probes.
+      readinessPeriodSeconds: 15
+
+      # Enables or disables a startup probe.
+      # For optimal startup times, changing this should be tied to the readiness probe values.
+      #
+      # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
+      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
+      # and doesn't spam the readiness endpoint too much
+      #
+      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
+      # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
+      startupProbe:
+        enabled: true
+        failureThreshold: 600 # 10 minutes
+
+      # Resources for the sidecar.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: 2000m
+          memory: 1024Mi
+
+      # Default port for Pilot agent health checks. A value of 0 will disable health checking.
+      statusPort: 15020
+
+      # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
+      # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
+      tracer: "none"
+
+    proxy_init:
+      # Base name for the proxy_init container, used to configure iptables.
+      image: proxyv2
+      # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
+      # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
+      forceApplyIptables: false
+
+    # configure remote pilot and istiod service and endpoint
+    remotePilotAddress: ""
+
+    ##############################################################################################
+    # The following values are found in other charts. To effectively modify these values, make   #
+    # make sure they are consistent across your Istio helm charts                                #
+    ##############################################################################################
+
+    # The customized CA address to retrieve certificates for the pods in the cluster.
+    # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+    # If not set explicitly, default to the Istio discovery address.
+    caAddress: ""
+
+    # Enable control of remote clusters.
+    externalIstiod: false
+
+    # Configure a remote cluster as the config cluster for an external istiod.
+    configCluster: false
+
+    # configValidation enables the validation webhook for Istio configuration.
+    configValidation: true
+
+    # Mesh ID means Mesh Identifier. It should be unique within the scope where
+    # meshes will interact with each other, but it is not required to be
+    # globally/universally unique. For example, if any of the following are true,
+    # then two meshes must have different Mesh IDs:
+    # - Meshes will have their telemetry aggregated in one place
+    # - Meshes will be federated together
+    # - Policy will be written referencing one mesh from the other
+    #
+    # If an administrator expects that any of these conditions may become true in
+    # the future, they should ensure their meshes have different Mesh IDs
+    # assigned.
+    #
+    # Within a multicluster mesh, each cluster must be (manually or auto)
+    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
+    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
+    # of migration TBD, and it may be a disruptive operation to change the Mesh
+    # ID post-install.
+    #
+    # If the mesh admin does not specify a value, Istio will use the value of the
+    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
+    # value.
+    meshID: ""
+
+    # Configure the mesh networks to be used by the Split Horizon EDS.
+    #
+    # The following example defines two networks with different endpoints association methods.
+    # For `network1` all endpoints that their IP belongs to the provided CIDR range will be
+    # mapped to network1. The gateway for this network example is specified by its public IP
+    # address and port.
+    # The second network, `network2`, in this example is defined differently with all endpoints
+    # retrieved through the specified Multi-Cluster registry being mapped to network2. The
+    # gateway is also defined differently with the name of the gateway service on the remote
+    # cluster. The public IP for the gateway will be determined from that remote service (only
+    # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
+    # it still need to be configured manually).
+    #
+    # meshNetworks:
+    #   network1:
+    #     endpoints:
+    #     - fromCidr: "192.168.0.1/24"
+    #     gateways:
+    #     - address: 1.1.1.1
+    #       port: 80
+    #   network2:
+    #     endpoints:
+    #     - fromRegistry: reg1
+    #     gateways:
+    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
+    #       port: 443
+    #
+    meshNetworks: {}
+
+    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
+    mountMtlsCerts: false
+
+    multiCluster:
+      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
+      # to properly label proxies
+      clusterName: ""
+
+    # Network defines the network this cluster belong to. This name
+    # corresponds to the networks in the map of mesh networks.
+    network: ""
+
+    # Configure the certificate provider for control plane communication.
+    # Currently, two providers are supported: "kubernetes" and "istiod".
+    # As some platforms may not have kubernetes signing APIs,
+    # Istiod is the default
+    pilotCertProvider: istiod
+
+    sds:
+      # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
+      # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
+      # JWT is intended for the CA.
+      token:
+        aud: istio-ca
+
+    sts:
+      # The service port used by Security Token Service (STS) server to handle token exchange requests.
+      # Setting this port to a non-zero value enables STS server.
+      servicePort: 0
+
+    # The name of the CA for workload certificates.
+    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates
+    # will be used as the certificates for workloads.
+    # The default value is "" and when caName="", the CA will be configured by other
+    # mechanisms (e.g., environmental variable CA_PROVIDER).
+    caName: ""
+
+    waypoint:
+      # Resources for the waypoint proxy.
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          cpu: "2"
+          memory: 1Gi
+
+      # If specified, affinity defines the scheduling constraints of waypoint pods.
+      affinity: {}
+
+      # Topology Spread Constraints for the waypoint proxy.
+      topologySpreadConstraints: []
+
+      # Node labels for the waypoint proxy.
+      nodeSelector: {}
+
+      # Tolerations for the waypoint proxy.
+      tolerations: []
+
+  base:
+    # For istioctl usage to disable istio config crds in base
+    enableIstioConfigCRDs: true
+
+  # Gateway Settings
+  gateways:
+    # Define the security context for the pod.
+    # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
+    # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
+    securityContext: {}
+
+    # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
+    seccompProfile: {}
+
+  # gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
+  # For example:
+  # gatewayClasses:
+  #   istio:
+  #     service:
+  #       spec:
+  #         type: ClusterIP
+  # Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
+  gatewayClasses: {}
+  
+  pdb:
+    # -- Minimum available pods set in PodDisruptionBudget.
+    # Define either 'minAvailable' or 'maxUnavailable', never both.
+    minAvailable: 1
+    # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
+    # maxUnavailable: 1
+    # -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.
+    # Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/
+    unhealthyPodEvictionPolicy: ""
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/Chart.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/Chart.yaml
new file mode 100644
index 000000000..f77456ff8
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+appVersion: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+description: Helm chart for istio ztunnel components
+icon: https://istio.io/latest/favicons/android-192x192.png
+keywords:
+- istio-ztunnel
+- istio
+name: ztunnel
+sources:
+- https://github.com/istio/istio
+version: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/README.md b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/README.md
new file mode 100644
index 000000000..72ea6892e
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/README.md
@@ -0,0 +1,50 @@
+# Istio Ztunnel Helm Chart
+
+This chart installs an Istio ztunnel.
+
+## Setup Repo Info
+
+```console
+helm repo add istio https://istio-release.storage.googleapis.com/charts
+helm repo update
+```
+
+_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
+
+## Installing the Chart
+
+To install the chart:
+
+```console
+helm install ztunnel istio/ztunnel
+```
+
+## Uninstalling the Chart
+
+To uninstall/delete the chart:
+
+```console
+helm delete ztunnel
+```
+
+## Configuration
+
+To view supported configuration options and documentation, run:
+
+```console
+helm show values istio/ztunnel
+```
+
+### Profiles
+
+Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
+These can be set with `--set profile=<profile>`.
+For example, the `demo` profile offers a preset configuration to try out Istio in a test environment, with additional features enabled and lowered resource requirements.
+
+For consistency, the same profiles are used across each chart, even if they do not impact a given chart.
+
+Explicitly set values have highest priority, then profile settings, then chart defaults.
+
+As an implementation detail of profiles, the default values for the chart are all nested under `defaults`.
+When configuring the chart, you should not include this.
+That is, `--set some.field=true` should be passed, not `--set defaults.some.field=true`.
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-ambient.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-ambient.yaml
new file mode 100644
index 000000000..495fbcd43
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-ambient.yaml
@@ -0,0 +1,24 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
+meshConfig:
+  defaultConfig:
+    proxyMetadata:
+      ISTIO_META_ENABLE_HBONE: "true"
+  serviceScopeConfigs:
+    - servicesSelector:
+        matchExpressions:
+          - key: istio.io/global
+            operator: In
+            values: ["true"]
+      scope: GLOBAL
+global:
+  variant: distroless
+pilot:
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+cni:
+  ambient:
+    enabled: true
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-compatibility-version-1.25.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-compatibility-version-1.25.yaml
new file mode 100644
index 000000000..3827ee78f
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-compatibility-version-1.25.yaml
@@ -0,0 +1,16 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+     # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
+ambient:
+  # 1.26 behavioral changes
+  shareHostNetworkNamespace: true
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-compatibility-version-1.26.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-compatibility-version-1.26.yaml
new file mode 100644
index 000000000..b690d25ca
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-compatibility-version-1.26.yaml
@@ -0,0 +1,13 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.27 behavioral changes
+    ENABLE_NATIVE_SIDECARS: "false"
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-compatibility-version-1.27.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-compatibility-version-1.27.yaml
new file mode 100644
index 000000000..9f9ba7b67
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-compatibility-version-1.27.yaml
@@ -0,0 +1,11 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.28 behavioral changes
+    DISABLE_SHADOW_HOST_SUFFIX: "false"
+    PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY: "false"
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-compatibility-version-1.28.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-compatibility-version-1.28.yaml
new file mode 100644
index 000000000..96d9c1f52
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-compatibility-version-1.28.yaml
@@ -0,0 +1,8 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+pilot:
+  env:
+    # 1.29 behavioral changes
+    DISABLE_TRACK_REMAINING_CB_METRICS: "false"
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-demo.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-demo.yaml
new file mode 100644
index 000000000..d6dc36dd0
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-demo.yaml
@@ -0,0 +1,94 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+# The demo profile enables a variety of things to try out Istio in non-production environments.
+# * Lower resource utilization.
+# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.
+# * More ports enabled on the ingress, which is used in some tasks.
+meshConfig:
+  accessLogFile: /dev/stdout
+  extensionProviders:
+    - name: otel
+      envoyOtelAls:
+        service: opentelemetry-collector.observability.svc.cluster.local
+        port: 4317
+    - name: skywalking
+      skywalking:
+        service: tracing.istio-system.svc.cluster.local
+        port: 11800
+    - name: otel-tracing
+      opentelemetry:
+        port: 4317
+        service: opentelemetry-collector.observability.svc.cluster.local
+    - name: jaeger
+      opentelemetry:
+        port: 4317
+        service: jaeger-collector.istio-system.svc.cluster.local        
+
+cni:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 40Mi
+
+ztunnel:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 40Mi
+
+global:
+  proxy:
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+  waypoint:
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+
+pilot:
+  autoscaleEnabled: false
+  traceSampling: 100
+  resources:
+    requests:
+      cpu: 10m
+      memory: 100Mi
+
+gateways:
+  istio-egressgateway:
+    autoscaleEnabled: false
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
+  istio-ingressgateway:
+    autoscaleEnabled: false
+    ports:
+    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
+    # Note that AWS ELB will by default perform health checks on the first port
+    # on this list. Setting this to the health check port will ensure that health
+    # checks always work. https://github.com/istio/istio/issues/12503
+    - port: 15021
+      targetPort: 15021
+      name: status-port
+    - port: 80
+      targetPort: 8080
+      name: http2
+    - port: 443
+      targetPort: 8443
+      name: https
+    - port: 31400
+      targetPort: 31400
+      name: tcp
+      # This is the port where sni routing happens
+    - port: 15443
+      targetPort: 15443
+      name: tls
+    resources:
+      requests:
+        cpu: 10m
+        memory: 40Mi
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-platform-gke.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-platform-gke.yaml
new file mode 100644
index 000000000..dfe8a7d74
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-platform-gke.yaml
@@ -0,0 +1,10 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniBinDir: "" # intentionally unset for gke to allow template-based autodetection to work
+  resourceQuotas:
+    enabled: true
+resourceQuotas:
+  enabled: true
diff --git a/resources/v1.24.6/charts/ztunnel/files/profile-platform-k3d.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-platform-k3d.yaml
similarity index 100%
rename from resources/v1.24.6/charts/ztunnel/files/profile-platform-k3d.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-platform-k3d.yaml
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-platform-k3s.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-platform-k3s.yaml
new file mode 100644
index 000000000..07820106d
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-platform-k3s.yaml
@@ -0,0 +1,7 @@
+# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
+# The original version of this file is located at /manifests/helm-profiles directory.
+# If you want to make a change in this file, edit the original one and run "make gen".
+
+cni:
+  cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
+  cniBinDir: /var/lib/rancher/k3s/data/cni
diff --git a/resources/v1.24.6/charts/ztunnel/files/profile-platform-microk8s.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-platform-microk8s.yaml
similarity index 100%
rename from resources/v1.24.6/charts/ztunnel/files/profile-platform-microk8s.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-platform-microk8s.yaml
diff --git a/resources/v1.24.6/charts/ztunnel/files/profile-platform-minikube.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-platform-minikube.yaml
similarity index 100%
rename from resources/v1.24.6/charts/ztunnel/files/profile-platform-minikube.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-platform-minikube.yaml
diff --git a/resources/v1.24.6/charts/ztunnel/files/profile-platform-openshift.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-platform-openshift.yaml
similarity index 100%
rename from resources/v1.24.6/charts/ztunnel/files/profile-platform-openshift.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-platform-openshift.yaml
diff --git a/resources/v1.24.6/charts/ztunnel/files/profile-preview.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-preview.yaml
similarity index 100%
rename from resources/v1.24.6/charts/ztunnel/files/profile-preview.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-preview.yaml
diff --git a/resources/v1.24.6/charts/ztunnel/files/profile-remote.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-remote.yaml
similarity index 100%
rename from resources/v1.24.6/charts/ztunnel/files/profile-remote.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-remote.yaml
diff --git a/resources/v1.24.6/charts/ztunnel/files/profile-stable.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-stable.yaml
similarity index 100%
rename from resources/v1.24.6/charts/ztunnel/files/profile-stable.yaml
rename to resources/v1.29-alpha.b2f713a9/charts/ztunnel/files/profile-stable.yaml
diff --git a/resources/v1.24.6/charts/ztunnel/templates/NOTES.txt b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/NOTES.txt
similarity index 100%
rename from resources/v1.24.6/charts/ztunnel/templates/NOTES.txt
rename to resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/NOTES.txt
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/_helpers.tpl b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/_helpers.tpl
new file mode 100644
index 000000000..46a7a0b79
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/_helpers.tpl
@@ -0,0 +1 @@
+{{ define "ztunnel.release-name" }}{{ .Values.resourceName| default "ztunnel" }}{{ end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/daemonset.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/daemonset.yaml
new file mode 100644
index 000000000..0cafc4e09
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/daemonset.yaml
@@ -0,0 +1,233 @@
+{{- if or (eq .Values.resourceScope "all") (eq .Values.resourceScope "namespace") }}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
+  annotations:
+{{- if .Values.revision }}
+    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
+    {{- toYaml $annos | nindent 4}}
+{{- else }}
+    {{- .Values.annotations | toYaml | nindent 4 }}
+{{- end }}
+spec:
+  {{- with .Values.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      app: ztunnel
+  template:
+    metadata:
+      labels:
+        sidecar.istio.io/inject: "false"
+        istio.io/dataplane-mode: none
+        app: ztunnel
+        app.kubernetes.io/name: ztunnel
+        {{- include "istio.labels" . | nindent 8}}
+{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
+      annotations:
+        sidecar.istio.io/inject: "false"
+{{- if .Values.revision }}
+        istio.io/rev: {{ .Values.revision }}
+{{- end }}
+{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
+    spec:
+      nodeSelector:
+        kubernetes.io/os: linux
+{{- if .Values.nodeSelector }}
+{{ toYaml .Values.nodeSelector | indent 8 }}
+{{- end }}
+{{- if .Values.affinity }}
+      affinity:
+{{ toYaml .Values.affinity | trim | indent 8 }}
+{{- end }}
+      serviceAccountName: {{ include "ztunnel.release-name" . }}
+{{- if .Values.tolerations }}
+      tolerations:
+{{ toYaml .Values.tolerations | trim | indent 8 }}
+{{- end }}
+      containers:
+      - name: istio-proxy
+{{- if contains "/" .Values.image }}
+        image: "{{ .Values.image }}"
+{{- else }}
+        image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{ .Values.tag }}{{with (.Values.variant )}}-{{.}}{{end}}"
+{{- end }}
+        ports:
+        - containerPort: 15020
+          name: ztunnel-stats
+          protocol: TCP
+        resources:
+{{- if .Values.resources }}
+{{ toYaml .Values.resources | trim | indent 10 }}
+{{- end }}
+{{- with .Values.imagePullPolicy }}
+        imagePullPolicy: {{ . }}
+{{- end }}
+        securityContext:
+          # K8S docs are clear that CAP_SYS_ADMIN *or* privileged: true
+          # both force this to `true`: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+          # But there is a K8S validation bug that doesn't propery catch this: https://github.com/kubernetes/kubernetes/issues/119568
+          allowPrivilegeEscalation: true
+          privileged: false
+          capabilities:
+            drop:
+            - ALL
+            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
+            - NET_ADMIN # Required for TPROXY and setsockopt
+            - SYS_ADMIN # Required for `setns` - doing things in other netns
+            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
+          readOnlyRootFilesystem: true
+          runAsGroup: 1337
+          runAsNonRoot: false
+          runAsUser: 0
+{{- if .Values.seLinuxOptions }}
+          seLinuxOptions:
+{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
+{{- end }}
+        readinessProbe:
+          httpGet:
+            port: 15021
+            path: /healthz/ready
+        args:
+        - proxy
+        - ztunnel
+        env:
+        - name: CA_ADDRESS
+        {{- if .Values.caAddress }}
+          value: {{ .Values.caAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
+        {{- end }}
+        - name: XDS_ADDRESS
+        {{- if .Values.xdsAddress }}
+          value: {{ .Values.xdsAddress }}
+        {{- else }}
+          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
+        {{- end }}
+        {{- if .Values.logAsJson }}
+        - name: LOG_FORMAT
+          value: json
+        {{- end}}
+        {{- if .Values.network }}
+        - name: NETWORK
+          value: {{ .Values.network | quote }}
+        {{- end }}
+        - name: RUST_LOG
+          value: {{ .Values.logLevel | quote }}
+        - name: RUST_BACKTRACE
+          value: "1"
+        - name: ISTIO_META_CLUSTER_ID
+          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
+        - name: INPOD_ENABLED
+          value: "true"
+        - name: TERMINATION_GRACE_PERIOD_SECONDS
+          value: "{{ .Values.terminationGracePeriodSeconds }}"
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}
+        {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata}}
+        - name: {{ $key }}
+          value: "{{ $value }}"
+        {{- end }}
+        {{- end }}
+        - name: ZTUNNEL_CPU_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+              divisor: "1"
+        {{- with .Values.env }}
+        {{- range $key, $val := . }}
+        - name: {{ $key }}
+          value: "{{ $val }}"
+        {{- end }}
+        {{- end }}
+        {{- if .Values.peerCaCrl.enabled }}
+        - name: ENABLE_CRL
+          value: "true"
+        - name: CRL_PATH
+          value: "/var/run/secrets/istio/crl/ca-crl.pem"
+        - name: ALLOW_EXPIRED_CRL
+          value: "false"
+        {{- end }}
+        volumeMounts:
+        - mountPath: /var/run/secrets/istio
+          name: istiod-ca-cert
+        - mountPath: /var/run/secrets/tokens
+          name: istio-token
+        - mountPath: /var/run/ztunnel
+          name: cni-ztunnel-sock-dir
+        - mountPath: /tmp
+          name: tmp
+        {{- if .Values.peerCaCrl.enabled }}
+        - mountPath: /var/run/secrets/istio/crl
+          name: crl-volume
+          readOnly: true
+        {{- end }}
+        {{- with .Values.volumeMounts }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+      priorityClassName: system-node-critical
+      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
+      volumes:
+      - name: istio-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: istio-token
+              expirationSeconds: 43200
+              audience: istio-ca
+      - name: istiod-ca-cert
+        {{- if eq (.Values.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
+        projected:
+          sources:
+          - clusterTrustBundle:
+              name: istio.io:istiod-ca:{{ .Values.trustBundleName | default "root-cert" }}
+              path: root-cert.pem
+        {{- else }}
+        configMap:
+          name: {{ .Values.trustBundleName | default "istio-ca-root-cert" }}
+        {{- end }}
+      - name: cni-ztunnel-sock-dir
+        hostPath:
+          path: /var/run/ztunnel
+          type: DirectoryOrCreate # ideally this would be a socket, but istio-cni may not have started yet.
+      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
+      - name: tmp
+        emptyDir: {}
+      {{- if .Values.peerCaCrl.enabled }}
+      # Optional CRL volume - mounts istio-ca-crl ConfigMap if it exists
+      - name: crl-volume
+        configMap:
+          name: istio-ca-crl
+          optional: true
+      {{- end }}
+      {{- with .Values.volumes }}
+        {{- toYaml . | nindent 6}}
+      {{- end }}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/networkpolicy.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/networkpolicy.yaml
new file mode 100644
index 000000000..b397c64c8
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/networkpolicy.yaml
@@ -0,0 +1,62 @@
+{{- if (.Values.global.networkPolicy).enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "ztunnel.release-name" . }}{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: ztunnel
+    app.kubernetes.io/name: ztunnel
+    istio.io/rev: {{ .Values.revision | default "default" | quote }}
+    operator.istio.io/component: "Ztunnel"
+    release: {{ .Release.Name }}
+    {{- include "istio.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      app: ztunnel
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  # Readiness probe
+  - from: []
+    ports:
+    - protocol: TCP
+      port: 15021
+  # Monitoring/prometheus
+  - from: []
+    ports:
+    - protocol: TCP
+      port: 15020  # Metrics
+  # Admin interface
+  - from: []
+    ports:
+    - protocol: TCP
+      port: 15000  # Admin interface
+  # HBONE traffic
+  - from: []
+    ports:
+    - protocol: TCP
+      port: 15008
+  # Outbound traffic endpoint
+  - from: []
+    ports:
+    - protocol: TCP
+      port: 15001
+  # Traffic endpoint for inbound plaintext
+  - from: []
+    ports:
+    - protocol: TCP
+      port: 15006
+  # DNS Captures
+  - from: [ ]
+    ports:
+      - protocol: TCP
+        port: 15053
+      - protocol: UDP
+        port: 15053
+  egress:
+  # Allow all egress
+  - {}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/rbac.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/rbac.yaml
new file mode 100644
index 000000000..18291716b
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/rbac.yaml
@@ -0,0 +1,51 @@
+{{- if or (eq .Values.resourceScope "all") (eq .Values.resourceScope "cluster") }}
+{{- if (eq (.Values.platform | default "") "openshift") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  labels:
+    app: ztunnel
+    release: {{ include "ztunnel.release-name" . }}
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+  annotations:
+{{- if .Values.revision }}
+    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
+    {{- toYaml $annos | nindent 4}}
+{{- else }}
+    {{- .Values.annotations | toYaml | nindent 4 }}
+{{- end }}
+rules:
+- apiGroups: ["security.openshift.io"]
+  resources: ["securitycontextconstraints"]
+  resourceNames: ["privileged"]
+  verbs: ["use"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  labels:
+    app: ztunnel
+    release: {{ include "ztunnel.release-name" . }}
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+  annotations:
+{{- if .Values.revision }}
+    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
+    {{- toYaml $annos | nindent 4}}
+{{- else }}
+    {{- .Values.annotations | toYaml | nindent 4 }}
+{{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "ztunnel.release-name" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}
+---
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/resourcequota.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/resourcequota.yaml
new file mode 100644
index 000000000..d33c9fe13
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/resourcequota.yaml
@@ -0,0 +1,22 @@
+{{- if or (eq .Values.resourceScope "all") (eq .Values.resourceScope "namespace") }}
+{{- if .Values.resourceQuotas.enabled }}
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
+spec:
+  hard:
+    pods: {{ .Values.resourceQuotas.pods | quote }}
+  scopeSelector:
+    matchExpressions:
+    - operator: In
+      scopeName: PriorityClass
+      values:
+      - system-node-critical
+{{- end }}
+{{- end }}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/serviceaccount.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/serviceaccount.yaml
new file mode 100644
index 000000000..e1146f392
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/serviceaccount.yaml
@@ -0,0 +1,24 @@
+{{- if or (eq .Values.resourceScope "all") (eq .Values.resourceScope "namespace") }}
+apiVersion: v1
+kind: ServiceAccount
+  {{- with .Values.imagePullSecrets }}
+imagePullSecrets:
+  {{- range . }}
+  - name: {{ . }}
+  {{- end }}
+  {{- end }}
+metadata:
+  name: {{ include "ztunnel.release-name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: ztunnel
+    {{- include "istio.labels" . | nindent 4}}
+    {{ with .Values.labels -}}{{ toYaml . | nindent 4}}{{ end }}
+  annotations:
+{{- if .Values.revision }}
+    {{- $annos := set $.Values.annotations "istio.io/rev" .Values.revision }}
+    {{- toYaml $annos | nindent 4}}
+{{- else }}
+    {{- .Values.annotations | toYaml | nindent 4 }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/zzz_profile.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/zzz_profile.yaml
new file mode 100644
index 000000000..606c55669
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/templates/zzz_profile.yaml
@@ -0,0 +1,75 @@
+{{/*
+WARNING: DO NOT EDIT, THIS FILE IS A PROBABLY COPY.
+The original version of this file is located at /manifests directory.
+If you want to make a change in this file, edit the original one and run "make gen".
+
+Complex logic ahead...
+We have three sets of values, in order of precedence (last wins):
+1. The builtin values.yaml defaults
+2. The profile the user selects
+3. Users input (-f or --set)
+
+Unfortunately, Helm provides us (1) and (3) together (as .Values), making it hard to insert (2).
+
+However, we can workaround this by placing all of (1) under a specific key (.Values.defaults).
+We can then merge the profile onto the defaults, then the user settings onto that.
+Finally, we can set all of that under .Values so the chart behaves without awareness.
+*/}}
+{{- if $.Values.defaults}}
+{{ fail (cat
+  "Setting with .default prefix found; remove it. For example, replace `--set defaults.hub=foo` with `--set hub=foo`. Defaults set:\n"
+  ($.Values.defaults | toYaml |nindent 4)
+) }}
+{{- end }}
+{{- $defaults := $.Values._internal_defaults_do_not_set }}
+{{- $_ := unset $.Values "_internal_defaults_do_not_set" }}
+{{- $profile := dict }}
+{{- with (coalesce ($.Values).profile ($.Values.global).profile) }}
+{{- with $.Files.Get (printf "files/profile-%s.yaml" .)}}
+{{- $profile = (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown profile" .) }}
+{{- end }}
+{{- end }}
+{{- with .Values.compatibilityVersion }}
+{{- with $.Files.Get (printf "files/profile-compatibility-version-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown compatibility version" $.Values.compatibilityVersion) }}
+{{- end }}
+{{- end }}
+{{- with (coalesce ($.Values).platform ($.Values.global).platform) }}
+{{- with $.Files.Get (printf "files/profile-platform-%s.yaml" .) }}
+{{- $ignore := mustMergeOverwrite $profile (. | fromYaml) }}
+{{- else }}
+{{ fail (cat "unknown platform" .) }}
+{{- end }}
+{{- end }}
+{{- if $profile }}
+{{- $a := mustMergeOverwrite $defaults $profile }}
+{{- end }}
+#  Flatten globals, if defined on a per-chart basis
+{{- if true }}
+{{- $a := mustMergeOverwrite $defaults ($profile.global) ($.Values.global | default dict)  }}
+{{- end }}
+{{- $x := set $.Values "_original" (deepCopy $.Values) }}
+{{- $b := set $ "Values" (mustMergeOverwrite $defaults $.Values) }}
+
+{{/*
+Labels that should be applied to ALL resources.
+*/}}
+{{- define "istio.labels" -}}
+{{- if .Release.Service -}}
+app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
+{{- end }}
+{{- if .Release.Name }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+{{- end }}
+app.kubernetes.io/part-of: "istio"
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+{{- if and .Chart.Name .Chart.Version }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end -}}
diff --git a/resources/v1.29-alpha.b2f713a9/charts/ztunnel/values.yaml b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/values.yaml
new file mode 100644
index 000000000..607f7ea79
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/charts/ztunnel/values.yaml
@@ -0,0 +1,146 @@
+# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
+# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
+_internal_defaults_do_not_set:
+  # Hub to pull from. Image will be `Hub/Image:Tag-Variant`
+  hub: gcr.io/istio-testing
+  # Tag to pull from. Image will be `Hub/Image:Tag-Variant`
+  tag: 1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816
+  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
+  variant: ""
+
+  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
+  # If Image contains a "/", it will replace the entire `image` in the pod.
+  image: ztunnel
+
+  # Same as `global.network`, but will override it if set.
+  # Network defines the network this cluster belong to. This name
+  # corresponds to the networks in the map of mesh networks.
+  network: ""
+
+  global:
+    # When enabled, default NetworkPolicy resources will be created
+    networkPolicy:
+      enabled: false
+
+  # resourceName, if set, will override the naming of resources. If not set, will default to 'ztunnel'.
+  # If you set this, you MUST also set `trustedZtunnelName` in the `istiod` chart.
+  resourceName: ""
+
+  # Labels to apply to all top level resources
+  labels: {}
+  # Annotations to apply to all top level resources
+  annotations: {}
+
+  # Additional volumeMounts to the ztunnel container
+  volumeMounts: []
+
+  # Additional volumes to the ztunnel pod
+  volumes: []
+  
+  # Tolerations for the ztunnel pod
+  tolerations:
+    - effect: NoSchedule
+      operator: Exists
+    - key: CriticalAddonsOnly
+      operator: Exists
+    - effect: NoExecute
+      operator: Exists
+
+  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
+  podAnnotations:
+    prometheus.io/port: "15020"
+    prometheus.io/scrape: "true"
+
+  # Additional labels to apply on the pod level
+  podLabels: {}
+
+  # Pod resource configuration
+  resources:
+    requests:
+      cpu: 200m
+      # Ztunnel memory scales with the size of the cluster and traffic load
+      # While there are many factors, this is enough for ~200k pod cluster or 100k concurrently open connections.
+      memory: 512Mi
+
+  resourceQuotas:
+    enabled: false
+    pods: 5000
+
+  # Certificate Revocation List (CRL) support for plugged-in CAs.
+  # When enabled, ztunnel will check certificates against the CRL
+  peerCaCrl:
+    enabled: false
+
+  # List of secret names to add to the service account as image pull secrets
+  imagePullSecrets: []
+
+  # A `key: value` mapping of environment variables to add to the pod
+  env: {}
+
+  # Override for the pod imagePullPolicy
+  imagePullPolicy: ""
+
+  # Settings for multicluster
+  multiCluster:
+    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
+    # with Istiod configuration.
+    clusterName: ""
+
+  # meshConfig defines runtime configuration of components.
+  # For ztunnel, only defaultConfig is used, but this is nested under `meshConfig` for consistency with other
+  # components.
+  # TODO: https://github.com/istio/istio/issues/43248
+  meshConfig:
+    defaultConfig:
+      proxyMetadata: {}
+
+  # This value defines:
+  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
+  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
+  # Default K8S value is 30 seconds
+  terminationGracePeriodSeconds: 30
+
+  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
+  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
+  revision: ""
+
+  # The customized CA address to retrieve certificates for the pods in the cluster.
+  # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
+  caAddress: ""
+
+  # The customized XDS address to retrieve configuration.
+  # This should include the port - 15012 for Istiod. TLS will be used with the certificates in "istiod-ca-cert" secret.
+  # By default, it is istiod.istio-system.svc:15012 if revision is not set, or istiod-<revision>.<istioNamespace>.svc:15012
+  xdsAddress: ""
+
+  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set.
+  istioNamespace: istio-system
+
+  # Configuration log level of ztunnel binary, default is info.
+  # Valid values are: trace, debug, info, warn, error
+  logLevel: info
+
+  # To output all logs in json format
+  logAsJson: false
+
+  # Set to `type: RuntimeDefault` to use the default profile if available.
+  seLinuxOptions: {}
+  # TODO Ambient inpod - for OpenShift, set to the following to get writable sockets in hostmounts to work, eventually consider CSI driver instead
+  #seLinuxOptions:
+  #  type: spc_t
+  
+  # resourceScope controls what resources will be processed by helm.
+  # This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
+  # It can be one of:
+  # - all: all resources are processed
+  # - cluster: only cluster-scoped resources are processed
+  # - namespace: only namespace-scoped resources are processed
+  resourceScope: all
+
+  # K8s DaemonSet update strategy.
+  # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
diff --git a/resources/v1.29-alpha.b2f713a9/cni-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz.etag b/resources/v1.29-alpha.b2f713a9/cni-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz.etag
new file mode 100644
index 000000000..dd6e90f70
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/cni-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz.etag
@@ -0,0 +1 @@
+5902a9d4952a5e04429068a510fe79e9
diff --git a/resources/v1.29-alpha.b2f713a9/commit b/resources/v1.29-alpha.b2f713a9/commit
new file mode 100644
index 000000000..deadcc235
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/commit
@@ -0,0 +1 @@
+b2f713a9c7879a0c736388ff854f94c904dcc816
diff --git a/resources/v1.29-alpha.b2f713a9/gateway-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz.etag b/resources/v1.29-alpha.b2f713a9/gateway-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz.etag
new file mode 100644
index 000000000..4188aacb0
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/gateway-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz.etag
@@ -0,0 +1 @@
+418f08f711307a7db2531b6a0b593d0b
diff --git a/resources/v1.29-alpha.b2f713a9/istiod-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz.etag b/resources/v1.29-alpha.b2f713a9/istiod-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz.etag
new file mode 100644
index 000000000..677392aff
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/istiod-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz.etag
@@ -0,0 +1 @@
+1cdfb47874a42b2150b21d1e86e31e44
diff --git a/resources/v1.24.6/profiles/ambient.yaml b/resources/v1.29-alpha.b2f713a9/profiles/ambient.yaml
similarity index 100%
rename from resources/v1.24.6/profiles/ambient.yaml
rename to resources/v1.29-alpha.b2f713a9/profiles/ambient.yaml
diff --git a/resources/v1.29-alpha.b2f713a9/profiles/default.yaml b/resources/v1.29-alpha.b2f713a9/profiles/default.yaml
new file mode 100644
index 000000000..8f1ef1967
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/profiles/default.yaml
@@ -0,0 +1,12 @@
+apiVersion: sailoperator.io/v1
+kind: Istio
+spec:
+  # Most default values come from the helm chart's values.yaml
+  # Below are the things that differ
+  values:
+    defaultRevision: ""
+    global:
+      istioNamespace: istio-system
+      configValidation: true
+    ztunnel:
+      resourceName: ztunnel
diff --git a/resources/v1.24.6/profiles/demo.yaml b/resources/v1.29-alpha.b2f713a9/profiles/demo.yaml
similarity index 100%
rename from resources/v1.24.6/profiles/demo.yaml
rename to resources/v1.29-alpha.b2f713a9/profiles/demo.yaml
diff --git a/resources/v1.24.6/profiles/empty.yaml b/resources/v1.29-alpha.b2f713a9/profiles/empty.yaml
similarity index 100%
rename from resources/v1.24.6/profiles/empty.yaml
rename to resources/v1.29-alpha.b2f713a9/profiles/empty.yaml
diff --git a/resources/v1.24.6/profiles/openshift-ambient.yaml b/resources/v1.29-alpha.b2f713a9/profiles/openshift-ambient.yaml
similarity index 100%
rename from resources/v1.24.6/profiles/openshift-ambient.yaml
rename to resources/v1.29-alpha.b2f713a9/profiles/openshift-ambient.yaml
diff --git a/resources/v1.24.6/profiles/openshift.yaml b/resources/v1.29-alpha.b2f713a9/profiles/openshift.yaml
similarity index 100%
rename from resources/v1.24.6/profiles/openshift.yaml
rename to resources/v1.29-alpha.b2f713a9/profiles/openshift.yaml
diff --git a/resources/v1.24.6/profiles/preview.yaml b/resources/v1.29-alpha.b2f713a9/profiles/preview.yaml
similarity index 100%
rename from resources/v1.24.6/profiles/preview.yaml
rename to resources/v1.29-alpha.b2f713a9/profiles/preview.yaml
diff --git a/resources/v1.24.6/profiles/remote.yaml b/resources/v1.29-alpha.b2f713a9/profiles/remote.yaml
similarity index 100%
rename from resources/v1.24.6/profiles/remote.yaml
rename to resources/v1.29-alpha.b2f713a9/profiles/remote.yaml
diff --git a/resources/v1.24.6/profiles/stable.yaml b/resources/v1.29-alpha.b2f713a9/profiles/stable.yaml
similarity index 100%
rename from resources/v1.24.6/profiles/stable.yaml
rename to resources/v1.29-alpha.b2f713a9/profiles/stable.yaml
diff --git a/resources/v1.29-alpha.b2f713a9/ztunnel-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz.etag b/resources/v1.29-alpha.b2f713a9/ztunnel-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz.etag
new file mode 100644
index 000000000..5ba229b22
--- /dev/null
+++ b/resources/v1.29-alpha.b2f713a9/ztunnel-1.29-alpha.b2f713a9c7879a0c736388ff854f94c904dcc816.tgz.etag
@@ -0,0 +1 @@
+9f63c5601e7f2883c4669f3de0d55408
diff --git a/tests/e2e/ambient/ambient_test.go b/tests/e2e/ambient/ambient_test.go
index deb7c78a8..07f97cc9f 100644
--- a/tests/e2e/ambient/ambient_test.go
+++ b/tests/e2e/ambient/ambient_test.go
@@ -163,12 +163,11 @@ profile: ambient`)
 				When("the ZTunnel CR is created", func() {
 					BeforeAll(func() {
 						ztunnelYaml := `
-apiVersion: sailoperator.io/v1alpha1
+apiVersion: sailoperator.io/v1
 kind: ZTunnel
 metadata:
   name: default
 spec:
-  profile: ambient
   version: %s
   namespace: %s
   values:
diff --git a/tests/e2e/common-operator-integ-suite.sh b/tests/e2e/common-operator-integ-suite.sh
index 8a264eae3..668f924d8 100755
--- a/tests/e2e/common-operator-integ-suite.sh
+++ b/tests/e2e/common-operator-integ-suite.sh
@@ -195,7 +195,7 @@ uninstall_operator() {
 cleanup() {
   # Do not let cleanup errors affect the final exit code
   set +e
-  if [ "${OLM}" != "true" ] && [ "${SKIP_DEPLOY}" != "true" ]; then
+  if [ "${OLM}" != "true" ] && [ "${SKIP_DEPLOY}" != "true" ] && [ "${SKIP_CLEANUP}" != "true" ]; then
     if [ "${MULTICLUSTER}" == true ]; then
       KUBECONFIG="${KUBECONFIG}" uninstall_operator || true
       # shellcheck disable=SC2153  # KUBECONFIG2 is set by multicluster setup scripts
@@ -300,4 +300,4 @@ go run github.com/onsi/ginkgo/v2/ginkgo -tags e2e \
 --timeout 60m --junit-report="${ARTIFACTS}/report.xml" ${GINKGO_FLAGS:-} "${WD}"/...
 TEST_EXIT_CODE=$?
 
-exit "${TEST_EXIT_CODE}"
\ No newline at end of file
+exit "${TEST_EXIT_CODE}"
diff --git a/tests/e2e/controlplane/control_plane_test.go b/tests/e2e/controlplane/control_plane_test.go
index 719c956aa..413052edd 100644
--- a/tests/e2e/controlplane/control_plane_test.go
+++ b/tests/e2e/controlplane/control_plane_test.go
@@ -18,6 +18,7 @@ package controlplane
 
 import (
 	"fmt"
+	"regexp"
 	"strings"
 	"time"
 
@@ -273,15 +274,32 @@ func getProxyVersion(podName, namespace string) (*semver.Version, error) {
 	}
 
 	lines := strings.Split(proxyStatus, "\n")
+	colSplit := regexp.MustCompile(`\s{2,}`)
+
+	versionIdx := -1
+	headers := colSplit.Split(strings.TrimSpace(lines[0]), -1)
+	for i, header := range headers {
+		if header == "VERSION" {
+			versionIdx = i
+			break
+		}
+	}
+	if versionIdx == -1 {
+		return nil, fmt.Errorf("VERSION header not found")
+	}
+
 	var versionStr string
-	for _, line := range lines {
+	for _, line := range lines[1:] {
 		if strings.Contains(line, podName+"."+namespace) {
-			values := strings.Fields(line)
-			versionStr = values[len(values)-1]
+			values := colSplit.Split(strings.TrimSpace(line), -1)
+			versionStr = values[versionIdx]
 			break
 		}
 	}
 
+	if versionStr == "" {
+		return nil, fmt.Errorf("pod %s not found in proxy status output for namespace %s", podName, namespace)
+	}
 	version, err := semver.NewVersion(versionStr)
 	if err != nil {
 		return version, fmt.Errorf("error parsing sidecar version %q: %w", versionStr, err)
diff --git a/tests/e2e/multicluster/common.go b/tests/e2e/multicluster/common.go
index fdb7dd7e2..4d792e6b7 100644
--- a/tests/e2e/multicluster/common.go
+++ b/tests/e2e/multicluster/common.go
@@ -54,7 +54,7 @@ func verifyResponsesAreReceivedFromExpectedVersions(k kubectl.Kubectl, expectedV
 		expectedVersions = []string{"v1", "v2"}
 	}
 	for _, v := range expectedVersions {
-		Eventually(k.WithNamespace("sample").Exec, 160*time.Second, 2*time.Second).
+		Eventually(k.WithNamespace("sample").Exec, 10*time.Minute, 2*time.Second).
 			WithArguments("deploy/sleep", "sleep", "curl -sS helloworld.sample:5000/hello").
 			Should(ContainSubstring(fmt.Sprintf("Hello version: %s", v)),
 				fmt.Sprintf("sleep pod in %s did not receive any response from %s", k.ClusterName, v))
diff --git a/tests/e2e/multicluster/multicluster_externalcontrolplane_test.go b/tests/e2e/multicluster/multicluster_externalcontrolplane_test.go
index de4702e17..bbadb18b4 100644
--- a/tests/e2e/multicluster/multicluster_externalcontrolplane_test.go
+++ b/tests/e2e/multicluster/multicluster_externalcontrolplane_test.go
@@ -49,7 +49,7 @@ var _ = Describe("Multicluster deployment models", Label("multicluster", "multic
 
 	Describe("External Control Plane Multi-Network configuration", func() {
 		// Test the External Control Plane Multi-Network configuration for each supported Istio version
-		for _, v := range istioversion.List {
+		for _, v := range istioversion.GetLatestPatchVersions() {
 			// The configuration is only supported in Istio 1.24+.
 			if version.Constraint("<1.24").Check(v.Version) {
 				Log(fmt.Sprintf("Skipping test, because Istio version %s does not support External Control Plane Multi-Network configuration", v.Version))
@@ -340,7 +340,7 @@ spec:
 					})
 
 					It("updates remote Istio CR status to Ready on Cluster #2", func(ctx SpecContext) {
-						Eventually(common.GetObject).
+						Eventually(common.GetObject, 10*time.Minute).
 							WithArguments(ctx, clRemote, kube.Key(externalIstioName), &v1.Istio{}).
 							Should(HaveConditionStatus(v1.IstioConditionReady, metav1.ConditionTrue), "Istio is not Ready on Remote; unexpected Condition")
 						Success("Remote Istio CR is Ready on Cluster #2")
diff --git a/tests/e2e/multicluster/multicluster_primaryremote_test.go b/tests/e2e/multicluster/multicluster_primaryremote_test.go
index 625294375..f0f15a978 100644
--- a/tests/e2e/multicluster/multicluster_primaryremote_test.go
+++ b/tests/e2e/multicluster/multicluster_primaryremote_test.go
@@ -207,7 +207,7 @@ values:
 					})
 
 					It("updates remote Istio CR status to Ready", func(ctx SpecContext) {
-						Eventually(common.GetObject).
+						Eventually(common.GetObject, 10*time.Minute).
 							WithArguments(ctx, clRemote, kube.Key(istioName), &v1.Istio{}).
 							Should(HaveConditionStatus(v1.IstioConditionReady, metav1.ConditionTrue), "Istio is not Ready on Remote; unexpected Condition")
 						Success("Istio CR is Ready on Remote Cluster")
diff --git a/tests/e2e/samples/sleep/kustomization.yaml b/tests/e2e/samples/sleep/kustomization.yaml
index 722a0cf4a..5aac3660a 100644
--- a/tests/e2e/samples/sleep/kustomization.yaml
+++ b/tests/e2e/samples/sleep/kustomization.yaml
@@ -4,4 +4,6 @@ resources:
   - https://raw.githubusercontent.com/istio/istio/master/samples/sleep/sleep.yaml
 images:
   - name: curlimages/curl
+    newName: quay.io/curl/curl
+  - name: docker.io/curlimages/curl
     newName: quay.io/curl/curl
\ No newline at end of file
diff --git a/tests/e2e/util/common/e2e_utils.go b/tests/e2e/util/common/e2e_utils.go
index c950f4489..a11743961 100644
--- a/tests/e2e/util/common/e2e_utils.go
+++ b/tests/e2e/util/common/e2e_utils.go
@@ -109,7 +109,7 @@ func GetSVCLoadBalancerAddress(ctx context.Context, cl client.Client, ns, svcNam
 	Eventually(func() ([]corev1.LoadBalancerIngress, error) {
 		err := cl.Get(ctx, client.ObjectKey{Namespace: ns, Name: svcName}, svc)
 		return svc.Status.LoadBalancer.Ingress, err
-	}, "1m", "1s").ShouldNot(BeEmpty(), "LoadBalancer should be ready")
+	}, "3m", "1s").ShouldNot(BeEmpty(), "LoadBalancer should be ready")
 
 	if svc.Status.LoadBalancer.Ingress[0].IP != "" {
 		return svc.Status.LoadBalancer.Ingress[0].IP
@@ -169,6 +169,8 @@ func LogDebugInfo(suite testSuite, kubectls ...kubectl.Kubectl) {
 		GinkgoWriter.Println("=========================================================")
 		logCertsDebugInfo(k)
 		GinkgoWriter.Println("=========================================================")
+		logSampleNamespacesDebugInfo(k, suite)
+		GinkgoWriter.Println("=========================================================")
 		GinkgoWriter.Println()
 
 		if suite == Ambient {
@@ -261,6 +263,60 @@ func logCertsDebugInfo(k kubectl.Kubectl) {
 	logDebugElement("=====CA certs in "+controlPlaneNamespace+"=====", certs, err)
 }
 
+func logSampleNamespacesDebugInfo(k kubectl.Kubectl, suite testSuite) {
+	// Common sample namespaces used across different test suites
+	sampleNamespaces := []string{SleepNamespace, HttpbinNamespace}
+
+	// Add additional namespaces based on test suite
+	switch suite {
+	case MultiCluster, ControlPlane, MultiControlPlane:
+		sampleNamespaces = append(sampleNamespaces, "sample")
+	case DualStack:
+		// Dual-stack tests use specific namespaces for TCP services
+		sampleNamespaces = append(sampleNamespaces, "dual-stack", "ipv4", "ipv6")
+	}
+
+	for _, ns := range sampleNamespaces {
+		logSampleNamespaceInfo(k, ns)
+	}
+}
+
+func logSampleNamespaceInfo(k kubectl.Kubectl, namespace string) {
+	// Check if namespace exists
+	nsInfo, err := k.GetYAML("namespace", namespace)
+	if err != nil {
+		logDebugElement("=====Namespace "+namespace+" (not found)=====", "", err)
+		return
+	}
+	logDebugElement("=====Namespace "+namespace+" YAML=====", nsInfo, err)
+
+	// Get pods in the namespace with wide output for more details
+	pods, err := k.WithNamespace(namespace).GetPods("", "-o wide")
+	logDebugElement("=====Pods in "+namespace+"=====", pods, err)
+
+	// Get events in the namespace
+	events, err := k.WithNamespace(namespace).GetEvents()
+	logDebugElement("=====Events in "+namespace+"=====", events, err)
+
+	// Get deployments
+	deployments, err := k.WithNamespace(namespace).GetYAML("deployments", "")
+	logDebugElement("=====Deployments in "+namespace+"=====", deployments, err)
+
+	// Get services
+	services, err := k.WithNamespace(namespace).GetYAML("services", "")
+	logDebugElement("=====Services in "+namespace+"=====", services, err)
+
+	// Describe failed or non-ready pods specifically
+	logFailedPodsDetails(k, namespace)
+}
+
+func logFailedPodsDetails(k kubectl.Kubectl, namespace string) {
+	// Describe all pods in the namespace for detailed troubleshooting
+	// This provides comprehensive information about pod status, events, and configuration
+	describe, err := k.WithNamespace(namespace).Describe("pods", "")
+	logDebugElement("=====Pod descriptions in "+namespace+"=====", describe, err)
+}
+
 func logDebugElement(caption string, info string, err error) {
 	GinkgoWriter.Println("\n" + caption + ":")
 	if err != nil {
diff --git a/tests/integration/api/istiobase_test.go b/tests/integration/api/istiobase_test.go
index f2f8b3fd2..4aa1e9dd2 100644
--- a/tests/integration/api/istiobase_test.go
+++ b/tests/integration/api/istiobase_test.go
@@ -56,6 +56,7 @@ var _ = Describe("base chart support", Ordered, func() {
 	}
 
 	saKey := client.ObjectKey{Name: "istio-reader-service-account", Namespace: istioNamespace}
+	validatingWebhookKey := client.ObjectKey{Name: "istiod-default-validator", Namespace: istioNamespace}
 
 	BeforeAll(func() {
 		Step(fmt.Sprintf("Creating namespace %q", istioNamespace))
@@ -99,6 +100,10 @@ var _ = Describe("base chart support", Ordered, func() {
 			sa := &corev1.ServiceAccount{}
 			Step("Checking if istio-reader ServiceAccount was successfully created")
 			Eventually(k8sClient.Get).WithArguments(ctx, saKey, sa).Should(Succeed())
+
+			webhook := &admissionv1.ValidatingWebhookConfiguration{}
+			Step("Checking if default ValidatingWebhookConfiguration was successfully created")
+			Eventually(k8sClient.Get).WithArguments(ctx, validatingWebhookKey, webhook).Should(Succeed())
 		})
 
 		It("undeploys base chart when default IstioRevision is deleted", func() {
@@ -108,6 +113,10 @@ var _ = Describe("base chart support", Ordered, func() {
 			sa := &corev1.ServiceAccount{}
 			Step("Checking if istio-reader ServiceAccount was deleted")
 			Eventually(k8sClient.Get).WithArguments(ctx, saKey, sa).Should(ReturnNotFoundError())
+
+			webhook := &admissionv1.ValidatingWebhookConfiguration{}
+			Step("Checking if default ValidatingWebhookConfiguration was deleted")
+			Eventually(k8sClient.Get).WithArguments(ctx, validatingWebhookKey, webhook).Should(ReturnNotFoundError())
 		})
 	})
 
@@ -153,12 +162,20 @@ var _ = Describe("base chart support", Ordered, func() {
 			sa := &corev1.ServiceAccount{}
 			Step("Checking if istio-reader ServiceAccount was deleted")
 			Eventually(k8sClient.Get).WithArguments(ctx, saKey, sa).Should(ReturnNotFoundError())
+
+			webhook := &admissionv1.ValidatingWebhookConfiguration{}
+			Step("Checking if default ValidatingWebhookConfiguration was deleted")
+			Eventually(k8sClient.Get).WithArguments(ctx, validatingWebhookKey, webhook).Should(ReturnNotFoundError())
 		})
 
 		It("deploys base chart when default IstioRevisionTag is created", func() {
 			sa := &corev1.ServiceAccount{}
 			Step("Checking if istio-reader ServiceAccount was successfully created")
 			Eventually(k8sClient.Get).WithArguments(ctx, saKey, sa).Should(Succeed())
+
+			webhook := &admissionv1.ValidatingWebhookConfiguration{}
+			Step("Checking if default ValidatingWebhookConfiguration was successfully created")
+			Eventually(k8sClient.Get).WithArguments(ctx, validatingWebhookKey, webhook).Should(Succeed())
 		})
 	})
 
diff --git a/tests/integration/api/istiorevision_test.go b/tests/integration/api/istiorevision_test.go
index f13fbdd6e..c146f35ba 100644
--- a/tests/integration/api/istiorevision_test.go
+++ b/tests/integration/api/istiorevision_test.go
@@ -231,6 +231,99 @@ var _ = Describe("IstioRevision resource", Label("istiorevision"), Ordered, func
 		})
 	})
 
+	Describe("ZTunnel dependency checks", func() {
+		ztunnelName := "default"
+		ztunnelKey := client.ObjectKey{Name: ztunnelName}
+		ztunnel := &v1.ZTunnel{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: ztunnelName,
+			},
+			Spec: v1.ZTunnelSpec{
+				Version:   istioversion.Default,
+				Namespace: istioNamespace,
+			},
+		}
+
+		// Create IstioCNI as ambient mode requires it
+		cni := &v1.IstioCNI{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: cniName,
+			},
+			Spec: v1.IstioCNISpec{
+				Version:   istioversion.Default,
+				Namespace: istioNamespace,
+			},
+		}
+
+		BeforeAll(func() {
+			Expect(k8sClient.Create(ctx, cni)).To(Succeed())
+			// Wait for CNI DaemonSet to be created
+			dsKey := client.ObjectKey{Name: "istio-cni-node", Namespace: istioNamespace}
+			ds := &appsv1.DaemonSet{}
+			Eventually(k8sClient.Get).WithArguments(ctx, dsKey, ds).Should(Succeed())
+			// Make CNI healthy
+			ds.Status.CurrentNumberScheduled = 3
+			ds.Status.NumberReady = 3
+			Expect(k8sClient.Status().Update(ctx, ds)).To(Succeed())
+			expectCNICondition(ctx, v1.IstioCNIConditionReady, metav1.ConditionTrue)
+
+			rev = &v1.IstioRevision{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: revName,
+				},
+				Spec: v1.IstioRevisionSpec{
+					Version:   istioversion.Default,
+					Namespace: istioNamespace,
+					Values: &v1.Values{
+						Revision: ptr.Of(revName),
+						Profile:  ptr.Of("ambient"),
+						Global: &v1.GlobalConfig{
+							IstioNamespace: ptr.Of(istioNamespace),
+						},
+					},
+				},
+			}
+			Expect(k8sClient.Create(ctx, rev)).To(Succeed())
+		})
+
+		AfterAll(func() {
+			deleteAllIstioRevisions(ctx)
+
+			Expect(k8sClient.Delete(ctx, ztunnel)).To(Succeed())
+			Eventually(k8sClient.Get).WithArguments(ctx, ztunnelKey, ztunnel).Should(ReturnNotFoundError())
+
+			Expect(k8sClient.Delete(ctx, cni)).To(Succeed())
+			Eventually(k8sClient.Get).WithArguments(ctx, cniKey, cni).Should(ReturnNotFoundError())
+		})
+
+		It("shows dependencies unhealthy when ZTunnel is missing", func() {
+			expectCondition(ctx, revName, v1.IstioRevisionConditionDependenciesHealthy, metav1.ConditionFalse,
+				func(g Gomega, condition *v1.IstioRevisionCondition) {
+					g.Expect(condition.Reason).To(Equal(v1.IstioRevisionReasonZTunnelNotFound))
+				})
+		})
+
+		It("shows dependencies unhealthy when ZTunnel is unhealthy", func() {
+			Expect(k8sClient.Create(ctx, ztunnel)).To(Succeed())
+			expectCondition(ctx, revName, v1.IstioRevisionConditionDependenciesHealthy, metav1.ConditionFalse,
+				func(g Gomega, condition *v1.IstioRevisionCondition) {
+					g.Expect(condition.Reason).To(Equal(v1.IstioRevisionReasonZTunnelNotHealthy))
+				})
+		})
+
+		It("shows dependencies healthy when ZTunnel is healthy", func() {
+			dsKey := client.ObjectKey{Name: "ztunnel", Namespace: ztunnel.Spec.Namespace}
+			ds := &appsv1.DaemonSet{}
+			Expect(k8sClient.Get(ctx, dsKey, ds)).To(Succeed())
+			ds.Status.CurrentNumberScheduled = 3
+			ds.Status.NumberReady = 3
+			Expect(k8sClient.Status().Update(ctx, ds)).To(Succeed())
+
+			expectZTunnelCondition(ctx, v1.ZTunnelConditionReady, metav1.ConditionTrue)
+			expectCondition(ctx, revName, v1.IstioRevisionConditionDependenciesHealthy, metav1.ConditionTrue)
+		})
+	})
+
 	Describe("target namespace dependency checks", func() {
 		When("IstioRevision is created before the target namespace", func() {
 			nsName := "nonexistent-namespace-" + rand.String(8)
@@ -561,6 +654,32 @@ var _ = Describe("IstioRevision resource", Label("istiorevision"), Ordered, func
 			Expect(k8sClient.Get(ctx, client.ObjectKeyFromObject(sa), sa)).To(Succeed())
 			Expect(sa.ImagePullSecrets).To(ContainElement(corev1.LocalObjectReference{Name: "other-pull-secret"}))
 		})
+
+		It("skips reconcile when sailoperator.io/ignore annotation is set to true on a resource", func() {
+			waitForInFlightReconcileToFinish()
+
+			webhook := &admissionv1.MutatingWebhookConfiguration{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "istio-sidecar-injector-" + revName + "-" + istioNamespace,
+				},
+			}
+			Expect(k8sClient.Get(ctx, client.ObjectKeyFromObject(webhook), webhook)).To(Succeed())
+
+			GinkgoWriter.Println("webhook:", webhook)
+
+			expectNoReconciliation(istioRevisionController, func() {
+				By("adding sailoperator.io/ignore annotation to ConfigMap")
+				webhook.Annotations = map[string]string{
+					"sailoperator.io/ignore": "true",
+				}
+				webhook.Labels["app"] = "sidecar-injector-test"
+				Expect(k8sClient.Update(ctx, webhook)).To(Succeed())
+			})
+
+			Expect(k8sClient.Get(ctx, client.ObjectKeyFromObject(webhook), webhook)).To(Succeed())
+			Expect(webhook.Annotations["sailoperator.io/ignore"]).To(Equal("true"))
+			Expect(webhook.Labels["app"]).To(Equal("sidecar-injector-test"))
+		})
 	})
 
 	DescribeTableSubtree("reconciling when revision is in use",
@@ -897,3 +1016,21 @@ func expectCondition(ctx context.Context, name string, condition v1.IstioRevisio
 		}
 	}).Should(Succeed(), "Expected condition %q to be %q on IstioRevision: %s", condition, status, name)
 }
+
+// expectZTunnelCondition on the ZTunnel resource to eventually have a given status.
+func expectZTunnelCondition(ctx context.Context, condition v1.ZTunnelConditionType, status metav1.ConditionStatus,
+	extraChecks ...func(Gomega, *v1.ZTunnelCondition),
+) {
+	ztunnelKey := client.ObjectKey{Name: "default"}
+	ztunnel := v1.ZTunnel{}
+	Eventually(func(g Gomega) {
+		g.Expect(k8sClient.Get(ctx, ztunnelKey, &ztunnel)).To(Succeed())
+		g.Expect(ztunnel.Status.ObservedGeneration).To(Equal(ztunnel.ObjectMeta.Generation))
+
+		condition := ztunnel.Status.GetCondition(condition)
+		g.Expect(condition.Status).To(Equal(status))
+		for _, check := range extraChecks {
+			check(g, &condition)
+		}
+	}).Should(Succeed())
+}
diff --git a/tests/integration/api/k8sapi_utils.go b/tests/integration/api/k8sapi_utils.go
index 1faeeedc3..456f7151a 100644
--- a/tests/integration/api/k8sapi_utils.go
+++ b/tests/integration/api/k8sapi_utils.go
@@ -16,6 +16,7 @@ package integration
 
 import (
 	v1 "github.com/istio-ecosystem/sail-operator/api/v1"
+	"github.com/istio-ecosystem/sail-operator/api/v1alpha1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
@@ -35,6 +36,13 @@ func NewOwnerReference(obj client.Object) metav1.OwnerReference {
 	case *v1.IstioCNI:
 		apiVersion = v1.GroupVersion.String()
 		kind = v1.IstioCNIKind
+	case *v1alpha1.ZTunnel:
+		apiVersion = v1.GroupVersion.String()
+		kind = v1.ZTunnelKind
+	case *v1.ZTunnel:
+		apiVersion = v1.GroupVersion.String()
+		kind = v1.ZTunnelKind
+
 	default:
 		panic("unknown type")
 	}
diff --git a/tests/integration/api/ztunnel_test.go b/tests/integration/api/ztunnel_test.go
new file mode 100644
index 000000000..c8ca7a516
--- /dev/null
+++ b/tests/integration/api/ztunnel_test.go
@@ -0,0 +1,209 @@
+//go:build integration
+
+// Copyright Istio Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package integration
+
+import (
+	"context"
+	"time"
+
+	v1 "github.com/istio-ecosystem/sail-operator/api/v1"
+	"github.com/istio-ecosystem/sail-operator/api/v1alpha1"
+	"github.com/istio-ecosystem/sail-operator/pkg/enqueuelogger"
+	"github.com/istio-ecosystem/sail-operator/pkg/istioversion"
+	. "github.com/istio-ecosystem/sail-operator/pkg/test/util/ginkgo"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+const (
+	ztunnelName      = "default"
+	ztunnelNamespace = "ztunnel-test"
+)
+
+var ztunnelKey = client.ObjectKey{Name: ztunnelName}
+
+var _ = Describe("ZTunnel DaemonSet status changes", Label("ztunnel"), Ordered, func() {
+	SetDefaultEventuallyPollingInterval(time.Second)
+	SetDefaultEventuallyTimeout(30 * time.Second)
+
+	enqueuelogger.LogEnqueueEvents = true
+
+	ctx := context.Background()
+
+	namespace := &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: ztunnelNamespace,
+		},
+	}
+
+	daemonsetKey := client.ObjectKey{Name: "ztunnel", Namespace: ztunnelNamespace}
+
+	BeforeAll(func() {
+		Expect(k8sClient.Create(ctx, namespace)).To(Succeed())
+	})
+
+	AfterAll(func() {
+		Expect(k8sClient.Delete(ctx, namespace)).To(Succeed())
+	})
+
+	for _, apiVersion := range []string{"v1", "v1alpha1"} {
+		Describe("API version "+apiVersion, func() {
+			ds := &appsv1.DaemonSet{}
+
+			BeforeAll(func() {
+				if apiVersion == "v1" {
+					ztunnel := &v1.ZTunnel{
+						ObjectMeta: metav1.ObjectMeta{
+							Name: ztunnelName,
+						},
+						Spec: v1.ZTunnelSpec{
+							Version:   istioversion.Default,
+							Namespace: ztunnelNamespace,
+						},
+					}
+					Expect(k8sClient.Create(ctx, ztunnel)).To(Succeed())
+				} else {
+					ztunnel := &v1alpha1.ZTunnel{
+						ObjectMeta: metav1.ObjectMeta{
+							Name: ztunnelName,
+						},
+						Spec: v1alpha1.ZTunnelSpec{
+							Version:   istioversion.Default,
+							Namespace: ztunnelNamespace,
+						},
+					}
+					Expect(k8sClient.Create(ctx, ztunnel)).To(Succeed())
+				}
+			})
+
+			AfterAll(func() {
+				if apiVersion == "v1" {
+					ztunnel := &v1.ZTunnel{}
+					Expect(k8sClient.Get(ctx, ztunnelKey, ztunnel)).To(Succeed())
+					Expect(k8sClient.Delete(ctx, ztunnel)).To(Succeed())
+					Eventually(k8sClient.Get).WithArguments(ctx, ztunnelKey, ztunnel).Should(ReturnNotFoundError())
+				} else {
+					ztunnel := &v1alpha1.ZTunnel{}
+					Expect(k8sClient.Get(ctx, ztunnelKey, ztunnel)).To(Succeed())
+					Expect(k8sClient.Delete(ctx, ztunnel)).To(Succeed())
+					Eventually(k8sClient.Get).WithArguments(ctx, ztunnelKey, ztunnel).Should(ReturnNotFoundError())
+				}
+			})
+
+			It("creates the ztunnel DaemonSet", func() {
+				Eventually(k8sClient.Get).WithArguments(ctx, daemonsetKey, ds).Should(Succeed())
+				if apiVersion == "v1" {
+					ztunnel := &v1.ZTunnel{}
+					Expect(k8sClient.Get(ctx, ztunnelKey, ztunnel)).To(Succeed())
+					Expect(ds.ObjectMeta.OwnerReferences).To(ContainElement(NewOwnerReference(ztunnel)))
+				} else {
+					ztunnel := &v1alpha1.ZTunnel{}
+					Expect(k8sClient.Get(ctx, ztunnelKey, ztunnel)).To(Succeed())
+					Expect(ds.ObjectMeta.OwnerReferences).To(ContainElement(NewOwnerReference(ztunnel)))
+				}
+			})
+
+			It("updates the status of the ZTunnel resource", func() {
+				if apiVersion == "v1" {
+					ztunnel := &v1.ZTunnel{}
+					Eventually(func(g Gomega) {
+						g.Expect(k8sClient.Get(ctx, ztunnelKey, ztunnel)).To(Succeed())
+						g.Expect(ztunnel.Status.ObservedGeneration).To(Equal(ztunnel.ObjectMeta.Generation))
+					}).Should(Succeed())
+				} else {
+					ztunnel := &v1alpha1.ZTunnel{}
+					Eventually(func(g Gomega) {
+						g.Expect(k8sClient.Get(ctx, ztunnelKey, ztunnel)).To(Succeed())
+						g.Expect(ztunnel.Status.ObservedGeneration).To(Equal(ztunnel.ObjectMeta.Generation))
+					}).Should(Succeed())
+				}
+			})
+
+			When("DaemonSet becomes ready", func() {
+				BeforeAll(func() {
+					Expect(k8sClient.Get(ctx, daemonsetKey, ds)).To(Succeed())
+					ds.Status.CurrentNumberScheduled = 3
+					ds.Status.NumberReady = 3
+					Expect(k8sClient.Status().Update(ctx, ds)).To(Succeed())
+				})
+
+				It("marks the ZTunnel resource as ready", func() {
+					if apiVersion == "v1" {
+						expectZTunnelV1Condition(ctx, v1.ZTunnelConditionReady, metav1.ConditionTrue)
+					} else {
+						expectZTunnelV1Alpha1Condition(ctx, v1alpha1.ZTunnelConditionReady, metav1.ConditionTrue)
+					}
+				})
+			})
+
+			When("DaemonSet becomes not ready", func() {
+				BeforeAll(func() {
+					Expect(k8sClient.Get(ctx, daemonsetKey, ds)).To(Succeed())
+					ds.Status.CurrentNumberScheduled = 3
+					ds.Status.NumberReady = 2
+					Expect(k8sClient.Status().Update(ctx, ds)).To(Succeed())
+				})
+
+				It("marks the ZTunnel resource as not ready", func() {
+					if apiVersion == "v1" {
+						expectZTunnelV1Condition(ctx, v1.ZTunnelConditionReady, metav1.ConditionFalse)
+					} else {
+						expectZTunnelV1Alpha1Condition(ctx, v1alpha1.ZTunnelConditionReady, metav1.ConditionFalse)
+					}
+				})
+			})
+		})
+	}
+})
+
+// expectZTunnelV1Condition on the v1.ZTunnel resource to eventually have a given status.
+func expectZTunnelV1Condition(ctx context.Context, condition v1.ZTunnelConditionType, status metav1.ConditionStatus,
+	extraChecks ...func(Gomega, *v1.ZTunnelCondition),
+) {
+	ztunnel := v1.ZTunnel{}
+	Eventually(func(g Gomega) {
+		g.Expect(k8sClient.Get(ctx, ztunnelKey, &ztunnel)).To(Succeed())
+		g.Expect(ztunnel.Status.ObservedGeneration).To(Equal(ztunnel.ObjectMeta.Generation))
+
+		condition := ztunnel.Status.GetCondition(condition)
+		g.Expect(condition.Status).To(Equal(status))
+		for _, check := range extraChecks {
+			check(g, &condition)
+		}
+	}).Should(Succeed())
+}
+
+// expectZTunnelV1Alpha1Condition on the v1alpha1.ZTunnel resource to eventually have a given status.
+func expectZTunnelV1Alpha1Condition(ctx context.Context, condition v1alpha1.ZTunnelConditionType, status metav1.ConditionStatus,
+	extraChecks ...func(Gomega, *v1alpha1.ZTunnelCondition),
+) {
+	ztunnel := v1alpha1.ZTunnel{}
+	Eventually(func(g Gomega) {
+		g.Expect(k8sClient.Get(ctx, ztunnelKey, &ztunnel)).To(Succeed())
+		g.Expect(ztunnel.Status.ObservedGeneration).To(Equal(ztunnel.ObjectMeta.Generation))
+
+		condition := ztunnel.Status.GetCondition(condition)
+		g.Expect(condition.Status).To(Equal(status))
+		for _, check := range extraChecks {
+			check(g, &condition)
+		}
+	}).Should(Succeed())
+}
diff --git a/tools/update_deps.sh b/tools/update_deps.sh
index fdcb8f66a..351e0bab7 100755
--- a/tools/update_deps.sh
+++ b/tools/update_deps.sh
@@ -36,6 +36,13 @@ function getLatestVersion() {
   curl -sL "https://api.github.com/repos/${1}/releases/latest" | yq '.tag_name'
 }
 
+# getLatestMinorVersion gets the latest released version of a github project with a specific minor version prefix
+# $1 = org/repo
+# $2 = major version prefix
+function getLatestMinorVersion() {
+  curl -sL "https://api.github.com/repos/${1}/releases" | yq -p json "[.[] | select(.tag_name | test(\"^$2\\.\")) | .tag_name] | .[0]" 
+}
+
 function getReleaseBranch() {
   minor=$(echo "${1}" | cut -f1,2 -d'.')
   echo "release-${minor#*v}"
@@ -64,8 +71,8 @@ OPERATOR_SDK_LATEST_VERSION=$(getLatestVersion operator-framework/operator-sdk)
 "$SED_CMD" -i "s|OPERATOR_SDK_VERSION ?= .*|OPERATOR_SDK_VERSION ?= ${OPERATOR_SDK_LATEST_VERSION}|" "${ROOTDIR}/Makefile.core.mk"
 find "${ROOTDIR}/chart/templates/olm/scorecard.yaml" -type f -exec "$SED_CMD" -i "s|quay.io/operator-framework/scorecard-test:.*|quay.io/operator-framework/scorecard-test:${OPERATOR_SDK_LATEST_VERSION}|" {} +
 
-# Update helm
-HELM_LATEST_VERSION=$(getLatestVersion helm/helm | cut -d/ -f2)
+# Update helm (FIXME: pinned to v3 as we don't support helm4 yet, see https://github.com/istio-ecosystem/sail-operator/issues/1371)
+HELM_LATEST_VERSION=$(getLatestMinorVersion helm/helm v3)
 "$SED_CMD" -i "s|HELM_VERSION ?= .*|HELM_VERSION ?= ${HELM_LATEST_VERSION}|" "${ROOTDIR}/Makefile.core.mk"
 
 # Update controller-tools
@@ -117,6 +124,8 @@ else
   echo "No latest version found for kindest/node on Docker Hub. Keeping the existing KIND_IMAGE."
 fi
 
+# Update Istio versions in the Documentation files
+./hack/update-istio-in-docs.sh
 
 # Regenerate files
 make update-istio gen