drainDuration: 12s
      tracing:
        zipkin:
          address: zipkin.istio-system:9411
    defaultProviders:
      metrics:
      - prometheus
    enablePrometheusMerge: true
    outboundTrafficPolicy:
      mode: REGISTRY_ONLY
    rootNamespace: istio-control
    trustDomain: cluster.local
  meshNetworks: 'networks: {}'
kind: ConfigMap
metadata:
  labels:

    * https://istio.io/latest/docs/ops/best-practices/security/

For further documentation see https://istio.io website

{{-
  $deps := dict
    "global.outboundTrafficPolicy" "meshConfig.outboundTrafficPolicy"
    "global.certificates" "meshConfig.certificates"
    "global.localityLbSetting" "meshConfig.localityLbSetting"
    "global.policyCheckFailOpen" "meshConfig.policyCheckFailOpen"

			cfg.ControlPlaneValues = fmt.Sprintf(`
namespace: %s
revision: usergroup-1
meshConfig:
  # REGISTRY_ONLY on one control plane is used to verify custom resources scoping
  outboundTrafficPolicy:
    mode: REGISTRY_ONLY
  # CR scoping requires discoverySelectors to be configured
  discoverySelectors:
    - matchLabels:
        usergroup: usergroup-1
values:
  global:
    istioNamespace: %s`,