CNI: enable sidecars in istio-system (#50337)

* CNI: enable sidecars in istio-system

This opt out is not required; all Istio components already label
themselves as not injected to avoid circular dependencies. The injector
already injects these.

What ends up happening is CNI skips, then later repairs. This is a bit
silly -- we should just properly let CNI run.

* gen files

manifests/charts/istio-cni/values.yaml

@@ -27,7 +27,6 @@ defaults:
 
 
     excludeNamespaces:
-      - istio-system
       - kube-system
 
     # Allows user to set custom affinity for the DaemonSet

manifests/helm-profiles/ambient.yaml

@@ -20,9 +20,5 @@ cni:
   ambient:
     enabled: true
 
-  # Default excludes istio-system; its actually fine to redirect there since we opt-out istiod, ztunnel, and istio-cni
-  excludeNamespaces:
-    - kube-system
-
 # Ztunnel doesn't use a namespace, so everything here is mostly for ztunnel
 variant: distroless

manifests/helm-profiles/openshift-ambient.yaml

@@ -11,8 +11,6 @@ cni:
   cniConfDir: /etc/cni/multus/net.d
   chained: false
   cniConfFileName: "istio-cni.conf"
-  excludeNamespaces:
-    - kube-system
   logLevel: info
   privileged: true
   provider: "multus"

manifests/helm-profiles/openshift.yaml

@@ -5,9 +5,6 @@ cni:
   cniConfDir: /etc/cni/multus/net.d
   chained: false
   cniConfFileName: "istio-cni.conf"
-  excludeNamespaces:
-    - istio-system
-    - kube-system
   logLevel: info
   provider: "multus"
 global:

tests/integration/helm/util.go

@@ -100,10 +100,6 @@ cni:
   privileged: true
   ambient:
     enabled: true
-
-  # Default excludes istio-system; its actually fine to redirect there since we opt-out istiod, ztunnel, and istio-cni
-  excludeNamespaces:
-    - kube-system
 `
 )