a.Security.RootCertFilePath = cfg.CaCertificatePath
			a.ProxyConfig.ProxyMetadata = map[string]string{}
			a.ProxyConfig.ProxyMetadata[MetadataClientCertChain] = filepath.Join(dir, "cert-chain.pem")
			a.ProxyConfig.ProxyMetadata[MetadataClientCertKey] = filepath.Join(dir, "key.pem")
			a.ProxyConfig.ProxyMetadata[MetadataClientRootCert] = filepath.Join(dir, "root-cert.pem")
			a.Security.FileMountedCerts = true

              resource: limits.cpu
        - name: PROXY_CONFIG
          value: |
                 {{ protoToJSON .ProxyConfig }}
        {{- if .ProxyConfig.ProxyMetadata }}
        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
        - name: {{ $key }}
          value: "{{ $value }}"
        {{- end }}
        {{- end }}
        - name: GOMEMLIMIT
          valueFrom:

		},
		{
			in:   "traffic-annotations.yaml",
			want: "traffic-annotations.yaml.injected",
			mesh: func(m *meshapi.MeshConfig) {
				if m.DefaultConfig.ProxyMetadata == nil {
					m.DefaultConfig.ProxyMetadata = map[string]string{}
				}
				m.DefaultConfig.ProxyMetadata["ISTIO_META_TLS_CLIENT_KEY"] = "/etc/identity/client/keys/client-key.pem"
			},
		},
		{
			in:   "proxy-override.yaml",

	var key, cert string
	if a.secOpts.ProvCert != "" {
		key, cert = getKeyCertInner(a.secOpts.ProvCert)
	} else if a.secOpts.FileMountedCerts {
		key = a.proxyConfig.ProxyMetadata[MetadataClientCertKey]
		cert = a.proxyConfig.ProxyMetadata[MetadataClientCertChain]
	}
	return key, cert
}

func fileExists(path string) bool {
	if fi, err := os.Stat(path); err == nil && fi.Mode().IsRegular() {
		return true
	}

        {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain)  }}
        - name: TRUST_DOMAIN
          value: "{{ . }}"
        {{- end }}
        {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
        - name: {{ $key }}
          value: "{{ $value }}"
        {{- end }}
        {{- with (index .InfrastructureLabels "topology.istio.io/network") }}
        - name: ISTIO_META_REQUESTED_NETWORK_VIEW

			IncludeExtAuthz: c.IncludeExtAuthz,
			IPFamilies:      "IPv6",
			IPFamilyPolicy:  "SingleStack",
			DualStack:       true,
		}
		defaultConfigs = append(defaultConfigs, dSvc, eSvc)
	}

	sotw := `{"proxyMetadata": {"ISTIO_DELTA_XDS": "false"}}`

	if !t.Settings().Skip(echo.Sotw) {
		sotw := echo.Config{
			Service:        SotwSvc,
			ServiceAccount: true,
			Ports:          ports.All(),

		option.DiscoveryHost(discHost),
		option.Metadata(cfg.Metadata),
		option.XdsType(xdsType),
		option.MetadataDiscovery(bool(metadataDiscovery)),
		option.MetricsLocalhostAccessOnly(cfg.Metadata.ProxyConfig.ProxyMetadata),
		option.DeferredClusterCreation(features.EnableDeferredClusterCreation))

	// Add GCPProjectNumber to access in bootstrap template.
	md := cfg.Metadata.PlatformMetadata

		args.AppendSet("components.cni.enabled", "true")
	}

	if ctx.Settings().EnableDualStack {
		args.AppendSet("values.pilot.env.ISTIO_DUAL_STACK", "true")
		args.AppendSet("meshConfig.defaultConfig.proxyMetadata.ISTIO_DUAL_STACK", "true")
		args.AppendSet("values.gateways.istio-ingressgateway.ipFamilyPolicy", "RequireDualStack")
		args.AppendSet("values.gateways.istio-egressgateway.ipFamilyPolicy", "RequireDualStack")
	}