- name: ISTIO_META_NETWORK
          value: {{.|quote}}
        {{- end }}
        - name: ISTIO_META_WORKLOAD_NAME
          value: {{.DeploymentName|quote}}
        - name: ISTIO_META_OWNER
          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
        {{- if .Values.global.meshID }}
        - name: ISTIO_META_MESH_ID
          value: "{{ .Values.global.meshID }}"

          - name: {{ $key }}
            value: "{{ $val }}"
          {{- end }}
          {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata }}
          - name: {{ $key }}
            value: "{{ $value }}"
          {{- end }}
          {{- $network_set := index $gateway.env "ISTIO_META_NETWORK" }}
          {{- if and (not $network_set) .Values.global.network }}
          - name: ISTIO_META_NETWORK

            resourceFieldRef:
              resource: limits.cpu
        - name: PROXY_CONFIG
          value: |
                 {{ protoToJSON .ProxyConfig }}
        {{- if .ProxyConfig.ProxyMetadata }}
        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
        - name: {{ $key }}
          value: "{{ $value }}"
        {{- end }}
        {{- end }}
        - name: GOMEMLIMIT
          valueFrom:

    - name: TRUST_DOMAIN
      value: "{{ . }}"
    {{- end }}
    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
    - name: {{ $key }}
      value: "{{ $value }}"
    {{- end }}
    {{- end }}
    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}

    - name: TRUST_DOMAIN
      value: "{{ . }}"
    {{- end }}
    {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
    {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }}
    - name: {{ $key }}
      value: "{{ $value }}"
    {{- end }}
    {{- end }}
    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}

    - name: {{ $key }}
      value: "{{ $value }}"
    {{- end }}
    # grpc uses xds:/// to resolve – no need to resolve VIP
    - name: ISTIO_META_DNS_CAPTURE
      value: "false"
    - name: DISABLE_ENVOY
      value: "true"
    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}

    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
    # of migration TBD, and it may be a disruptive operation to change the Mesh
    # ID post-install.
    #
    # If the mesh admin does not specify a value, Istio will use the value of the

    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
    # of migration TBD, and it may be a disruptive operation to change the Mesh
    # ID post-install.
    #
    # If the mesh admin does not specify a value, Istio will use the value of the

          - name: {{ $key }}
            value: "{{ $val }}"
          {{- end }}
          {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata }}
          - name: {{ $key }}
            value: "{{ $value }}"
          {{- end }}
          {{- $network_set := index $gateway.env "ISTIO_META_NETWORK" }}
          {{- if and (not $network_set) .Values.global.network }}
          - name: ISTIO_META_NETWORK

    # configured to have the same Mesh ID value. If an existing cluster 'joins' a
    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
    # of migration TBD, and it may be a disruptive operation to change the Mesh
    # ID post-install.
    #
    # If the mesh admin does not specify a value, Istio will use the value of the