{{- if .Values.seLinuxOptions }}
          seLinuxOptions:
{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
{{- end }}
        readinessProbe:
          httpGet:
            port: 15021
            path: /healthz/ready
        args:
        - proxy
        - ztunnel
        env:
        - name: CA_ADDRESS
        {{- if .Values.caAddress }}
          value: {{ .Values.caAddress }}
        {{- else }}

            # But we don't need _everything_ in `privileged`, so drop+readd capabilities based on feature.
            # privileged is redundant with CAP_SYS_ADMIN
            # since it's redundant, hardcode it to `true`, then manually drop ALL + readd granular
            # capabilities we actually require
            capabilities:
              drop:
              - ALL