feat: preliminary setup for Istio ambient mesh

[merll]

📌 Summary

This PR adds charts and essential configuration for the Istio ambient mesh.

🔍 Reviewer Notes

🧹 Checklist

• Code is readable, maintainable, and robust.
• Unit tests added/updated

[svcAPLBot]

Comparison of Helm chart templating output:

# New file added: istio-system-istio-cni
# istiod/templates/configmap-values.yaml

@@ data.original-values @@
! ± value change in multiline text (three inserts, three deletions)
  {
    "autoscaleMax": 5,
    "autoscaleMin": 1,
-   "env": {
-     "PILOT_DEBOUNCE_MAX": "10s",
-     "PILOT_ENABLE_ALPHA_GATEWAY_API": "true",
-     "PILOT_JWT_PUB_KEY_REFRESH_INTERVAL": "1m"
-   },
    "gatewayClasses": {
      "istio": {
        "deployment": {
          "spec": {
  
  [32 lines unchanged)]
  
            "cpu": "20m",
            "memory": "80Mi"
          }
        }
-     }
+     },
+     "variant": "distroless"
    },
    "meshConfig": {
      "accessLogFile": "/dev/stdout",
      "defaultConfig": {
        "gatewayTopology": {
          "numTrustedProxies": 1
        },
-       "holdApplicationUntilProxyStarts": true
+       "holdApplicationUntilProxyStarts": true,
+       "proxyMetadata": {
+         "ISTIO_META_ENABLE_HBONE": "true"
+       }
      },
      "enableAutoMtls": true,
      "extensionProviders": [
        {
  
  [36 lines unchanged)]
  
      "tcpKeepalive": {
        "interval": "5s",
        "probes": 3,
        "time": "10s"
+     }
+   },
+   "pilot": {
+     "env": {
+       "PILOT_DEBOUNCE_MAX": "10s",
+       "PILOT_ENABLE_ALPHA_GATEWAY_API": "true",
+       "PILOT_ENABLE_AMBIENT": "true",
+       "PILOT_JWT_PUB_KEY_REFRESH_INTERVAL": "1m"
      }
    },
    "resources": {
      "limits": {
  
  [six lines unchanged)]
  
      }
    },
    "revision": "1-26-0"
  }

@@ data.merged-values @@
! ± value change in multiline text (four inserts, two deletions)
  {
    "affinity": {},
    "autoscaleBehavior": {},
    "autoscaleEnabled": true,
  
  [14 lines unchanged)]
  
    "deploymentLabels": {},
    "env": {
      "PILOT_DEBOUNCE_MAX": "10s",
      "PILOT_ENABLE_ALPHA_GATEWAY_API": "true",
+     "PILOT_ENABLE_AMBIENT": "true",
      "PILOT_JWT_PUB_KEY_REFRESH_INTERVAL": "1m"
    },
    "envVarFrom": [],
    "experimental": {
  
  [115 lines unchanged)]
  
      "sts": {
        "servicePort": 0
      },
      "tag": "1.29.2",
-     "variant": "",
+     "variant": "distroless",
      "waypoint": {
        "affinity": {},
        "nodeSelector": {},
        "resources": {
  
  [30 lines unchanged)]
  
      "defaultConfig": {
        "gatewayTopology": {
          "numTrustedProxies": 1
        },
-       "holdApplicationUntilProxyStarts": true
+       "holdApplicationUntilProxyStarts": true,
+       "proxyMetadata": {
+         "ISTIO_META_ENABLE_HBONE": "true"
+       }
      },
      "enableAutoMtls": true,
      "enablePrometheusMerge": true,
      "extensionProviders": [
  
  [44 lines unchanged)]
  
    "ownerName": "",
    "pdb": {
      "minAvailable": 1,
      "unhealthyPodEvictionPolicy": ""
+   },
+   "pilot": {
+     "env": {
+       "PILOT_DEBOUNCE_MAX": "10s",
+       "PILOT_ENABLE_ALPHA_GATEWAY_API": "true",
+       "PILOT_ENABLE_AMBIENT": "true",
+       "PILOT_JWT_PUB_KEY_REFRESH_INTERVAL": "1m"
+     }
    },
    "podAnnotations": {},
    "podLabels": {},
    "replicaCount": 1,
  
  [50 lines unchanged)]
  
    "variant": "",
    "volumeMounts": [],
    "volumes": []
  }

# istiod/templates/configmap.yaml

@@ data.mesh @@
! ± value change in multiline text (one insert, no deletions)
  accessLogFile: /dev/stdout
  defaultConfig:
    discoveryAddress: istiod-1-26-0.istio-system.svc:15012
    gatewayTopology:
      numTrustedProxies: 1
    holdApplicationUntilProxyStarts: true
+   image:
+     imageType: distroless
+   proxyMetadata:
+     ISTIO_META_ENABLE_HBONE: "true"
  defaultProviders:
    metrics:
    - prometheus
  enableAutoMtls: true
  
  [29 lines unchanged)]
  
    interval: 5s
    probes: 3
    time: 10s
  trustDomain: cluster.local

# istiod/templates/deployment.yaml

@@ spec.template.spec.containers.discovery.image @@
! ± value change
- docker.io/istio/pilot:1.29.2
+ docker.io/istio/pilot:1.29.2-distroless

@@ spec.template.spec.containers.discovery.env @@
! + one list entry added:
+ - name: PILOT_ENABLE_AMBIENT
+   value: "true"

# istiod/templates/istiod-injector-configmap.yaml

@@ data.values @@
! ± value change in multiline text (two inserts, one deletion)
  {
    "gateways": {
      "seccompProfile": {},
      "securityContext": {}
  
  [100 lines unchanged)]
  
      "sts": {
        "servicePort": 0
      },
      "tag": "1.29.2",
-     "variant": "",
+     "variant": "distroless",
      "waypoint": {
        "affinity": {},
        "nodeSelector": {},
        "resources": {
  
  [17 lines unchanged)]
  
      },
      "env": {
        "PILOT_DEBOUNCE_MAX": "10s",
        "PILOT_ENABLE_ALPHA_GATEWAY_API": "true",
+       "PILOT_ENABLE_AMBIENT": "true",
        "PILOT_JWT_PUB_KEY_REFRESH_INTERVAL": "1m"
      }
    },
    "revision": "1-26-0",
  
  [seven lines unchanged)]
  
      "rewriteAppHTTPProbe": true,
      "templates": {}
    }
  }

# New file added: istio-system-ztunnel
# rabbitmq-cluster-operator/templates/messaging-topology-operator/validating-webhook-configuration.yaml

# values-repo.yaml