proxy.istio.io/config: '{"holdApplicationUntilProxyStarts": true}'
{{- end }}
    spec:
{{- if $.Ambient }}
      topologySpreadConstraints:
      - topologyKey: "kubernetes.io/hostname"
        whenUnsatisfiable: "ScheduleAnyway"
        maxSkew: 1
        labelSelector:
          matchLabels:
            app: {{ $.Service }}
{{- end }}
{{- if $.ServiceAccount }}
      serviceAccountName: {{ $.Service }}
{{- end }}

	var result []topologySpreadConstraint
	for _, c := range constraints {
		if c.WhenUnsatisfiable == action {
			selector, err := metav1.LabelSelectorAsSelector(c.LabelSelector)
			if err != nil {
				return nil, err
			}

			if pl.enableMatchLabelKeysInPodTopologySpread && len(c.MatchLabelKeys) > 0 {