imagePullPolicy: {{ .Values.global.imagePullPolicy }}
{{- end }}
          command:
            - /bin/sh
          args:
            - -c
            - sysctl -w kernel.core_pattern=/var/lib/istio/data/core.proxy && ulimit -c unlimited
          securityContext:
            runAsUser: 0
            runAsGroup: 0
            runAsNonRoot: false
            privileged: true
{{- end }}
      containers:

        - name: ISTIO_META_CLUSTER_ID
          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}"
        - name: ISTIO_META_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: ISTIO_META_INTERCEPTION_MODE
          value: "{{ .ProxyConfig.InterceptionMode.String }}"

metadata:
  labels:
    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}

    # The control plane has different scopes depending on component, but can configure default log level across all components
    # If empty, default scope and level will be used as configured in code
    logging:
      level: "default:info"

    omitSidecarInjectorConfigMap: false

    # Configure whether Operator manages webhook configurations. The current behavior

            "prometheus.io/scrape" "true"
          ) | nindent 8 }}
      labels:
        {{- toJsonMap
          (strdict
            "sidecar.istio.io/inject" "false"
            "istio.io/dataplane-mode" "none"
            "service.istio.io/canonical-name" .DeploymentName
            "service.istio.io/canonical-revision" "latest"
           )
          .InfrastructureLabels
          (strdict

    {{- end }}
  {{ end -}}
  {{- if eq (annotation .ObjectMeta `sidecar.istio.io/enableCoreDump` .Values.global.proxy.enableCoreDump) "true" }}
  - name: enable-core-dump
    args:
    - -c
    - sysctl -w kernel.core_pattern=/var/lib/istio/data/core.proxy && ulimit -c unlimited
    command:
      - /bin/sh
  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}

    {{- end }}
  {{ end -}}
  {{- if eq (annotation .ObjectMeta `sidecar.istio.io/enableCoreDump` .Values.global.proxy.enableCoreDump) "true" }}
  - name: enable-core-dump
    args:
    - -c
    - sysctl -w kernel.core_pattern=/var/lib/istio/data/core.proxy && ulimit -c unlimited
    command:
      - /bin/sh
  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}

    # The control plane has different scopes depending on component, but can configure default log level across all components
    # If empty, default scope and level will be used as configured in code
    logging:
      level: "default:info"
    omitSidecarInjectorConfigMap: true
    # Configure whether Operator manages webhook configurations. The current behavior

      - name: package-comments
      - name: range
      - name: receiver-naming
      - name: indent-error-flow
      - name: superfluous-else
      - name: modifies-parameter
      - name: unreachable-code
      - name: struct-tag
      - name: constant-logical-expr
      - name: bool-literal-in-expr
      - name: redefines-builtin-id
      - name: imports-blacklist
      - name: range-val-in-closure

    # If empty, default scope and level will be used as configured in code
    logging:
      level: "default:info"

    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
    # system-node-critical, it is better to configure this in order to make sure your Istio pods
    # will not be killed because of low priority class.