value: "99"
      - name: GRPC_GO_LOG_SEVERITY_LEVEL
        value: info
    volumeMounts:
      - mountPath: /var/lib/grpc/data/
        name: grpc-io-proxyless-bootstrap
  {{- end }}
  volumes:
    - name: grpc-io-proxyless-bootstrap

  #
  podDisruptionBudget: {}

  terminationGracePeriodSeconds: 30

  # A list of `Volumes` added into the Gateway Pods. See
  # https://kubernetes.io/docs/concepts/storage/volumes/.
  volumes: []

  # A list of `VolumeMounts` added into the Gateway Pods. See
  # https://kubernetes.io/docs/concepts/storage/volumes/.
  volumeMounts: []

        prometheus.io/path: /stats/prometheus
        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"
        sidecar.istio.io/status: '{"initContainers":["istio-init"],"containers":["istio-proxy"],"volumes":null,"imagePullSecrets":null,"revision":"default"}'
      creationTimestamp: null
      labels:
        app: hello
        tier: backend
        track: stable
    spec:
      containers:

        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
        sysctls:
        - name: net.ipv4.ip_unprivileged_port_start
          value: "0"
      {{- end }}
      {{- with .Values.volumes }}
      volumes:
        {{ toYaml . | nindent 8 }}
      {{- end }}
      containers:
        - name: istio-proxy

//
// They are consumed by the kube-scheduler when a CSI driver opts into
// capacity-aware scheduling with CSIDriverSpec.StorageCapacity. The scheduler
// compares the MaximumVolumeSize against the requested size of pending volumes
// to filter out unsuitable nodes. If MaximumVolumeSize is unset, it falls back
// to a comparison against the less precise Capacity. If that is also unset,
// the scheduler assumes that capacity is insufficient and tries some other

		ObjectMeta: metav1.ObjectMeta{
			Name:        args.PodName,
			Namespace:   "default",
			Labels:      args.Labels,
			Annotations: args.Annotations,
		},
		Spec: corev1.PodSpec{
			NodeName: args.NodeName,
			Volumes:  nil,
			InitContainers: []corev1.Container{
				{
					Name: args.InitContainerName,
				},
			},
			Containers: []corev1.Container{
				{
					Name: "payload-container",
				},
			},
		},

    - mountPath: /etc/certs/
      name: istio-certs
      readOnly: true
    {{- end }}
    - name: istio-podinfo
      mountPath: /etc/istio/pod
  volumes:
  - emptyDir: {}
    name: workload-socket
  - emptyDir: {}
    name: credential-socket
  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
  - name: gke-workload-certificate
    csi:

{{/* This provides a minimal gateway, ready to be injected.
     Any settings from values.gateways should be here - these are options specific to the gateway.
     Global settings, like the image, various env vars and volumes, etc will be injected.
     The normal Deployment is not suitable for this, as the original pod spec will override the injection template. */}}
apiVersion: apps/v1
kind: Deployment
metadata:

{{/* This provides a minimal gateway, ready to be injected.
     Any settings from values.gateways should be here - these are options specific to the gateway.
     Global settings, like the image, various env vars and volumes, etc will be injected.
     The normal Deployment is not suitable for this, as the original pod spec will override the injection template. */}}
apiVersion: apps/v1
kind: Deployment
metadata:

                "AlwaysAllow"
              ]
            }
          }
        },
        "terminationGracePeriodSeconds": {
          "type": "number"
        },
        "volumes": {
          "type": "array",
          "items": {
            "type": "object"
          }
        },
        "volumeMounts": {
          "type": "array",
          "items": {