readOnly: true
          {{- end }}
          {{- end }}
{{- if $gateway.additionalContainers }}
{{ toYaml $gateway.additionalContainers | indent 8 }}
{{- end }}
      volumes:
      {{- range $gateway.secretVolumes }}
      - name: {{ .name }}
        secret:
          secretName: {{ .secretName | quote }}
          optional: true
      {{- end }}
      {{- range $gateway.configVolumes }}

            readOnly: true
          {{- end }}
          {{- end }}
{{- if $gateway.additionalContainers }}
{{ toYaml $gateway.additionalContainers | indent 8 }}
{{- end }}
      volumes:
      {{- range $gateway.secretVolumes }}
      - name: {{ .name }}
        secret:
          secretName: {{ .secretName | quote }}
          optional: true
      {{- end }}
      {{- range $gateway.configVolumes }}

      metrics:
      {{ if $prom }}- prometheus{{ end }}
      {{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
    {{- end }}
    {{- if and $sdMetrics $sdLogs }}
      accessLogging:
      - stackdriver
    {{- end }}
  {{- end }}

    defaultConfig:
      {{- if .Values.global.meshID }}
      meshId: "{{ .Values.global.meshID }}"
      {{- end }}

    resources: ["nodes"]
    verbs: ["patch"]
{{- end }}

  # ingress controller
{{- if .Values.global.istiod.enableAnalysis }}
  - apiGroups: ["extensions", "networking.k8s.io"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions", "networking.k8s.io"]
    resources: ["ingresses/status"]
    verbs: ["*"]
{{- end}}
  - apiGroups: ["networking.k8s.io"]

{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.pilot.topologySpreadConstraints }}
      topologySpreadConstraints:
{{- toYaml . | nindent 8 }}
{{- end }}
      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      containers:
        - name: discovery

        {{- end }}
    spec:
      {{- if .Values.priorityClassName }}
      priorityClassName: "{{ .Values.priorityClassName }}"
      {{- end }}
      {{- if .Values.runtimeClassName }}
      runtimeClassName: "{{ .Values.runtimeClassName }}"
      {{- end }}
      {{- if and .Values.securityContext.enabled .Values.persistence.enabled }}
      securityContext:
        runAsUser: {{ .Values.securityContext.runAsUser }}

      {{ $pkey}}: {{ $pval }}
      {{- end }}
    {{- end }}

  {{ range $app := $gateway.ingressPorts }}
    -
      port: {{ $app.port }}
      name: {{ $app.name }}
  {{- end }}
{{- if $gateway.ipFamilyPolicy }}
  ipFamilyPolicy: {{ $gateway.ipFamilyPolicy }}
{{- end }}
{{- if $gateway.ipFamilies }}
  ipFamilies:
{{- range $gateway.ipFamilies }}
  - {{ . }}
{{- end }}
{{- end }}
---

{{- end }}
        ports:
        - containerPort: 15020
          name: ztunnel-stats
          protocol: TCP
        resources:
{{- if .Values.resources }}
{{ toYaml .Values.resources | trim | indent 10 }}
{{- end }}
{{- with .Values.imagePullPolicy }}
        imagePullPolicy: {{ . }}
{{- end }}
        securityContext:

		}

	case h.Start >= resourceSize:
		return 0, InvalidRange{
			OffsetBegin:  h.Start,
			OffsetEnd:    h.End,
			ResourceSize: resourceSize,
		}

	case h.End > -1:
		end := h.End
		if resourceSize <= end {
			end = resourceSize - 1
		}
		rangeLength = end - h.Start + 1

	case h.End == -1:
		rangeLength = resourceSize - h.Start

	default:
		return 0, errors.New("Unexpected range specification case")

{{- end }}
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "gateway") }}
      gateway: |
{{ .Files.Get "files/gateway-injection-template.yaml" | trim | indent 8 }}
{{- end }}
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
      grpc-simple: |
{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
{{- end }}