{{- if eq .Values.global.pilotCertProvider "istiod" }}
          - name: istiod-ca-cert
            configMap:
              name: istio-ca-root-cert
          {{- end }}
          {{- if eq .Values.global.pilotCertProvider "kubernetes" }}
          - name: kube-ca-cert
            configMap:
              name: kube-root-ca.crt
          {{- end }}
          {{- if .Values.global.mountMtlsCerts }}

          "optional": {
            "description": "optional specify whether the ConfigMap or its keys must be defined",
            "type": "boolean"
          }
        },
        "type": "object"
      },
      "io.k8s.api.core.v1.ConfigMapVolumeSource": {

		name   string
		newCfg core.ConfigMap
		oldCfg core.ConfigMap
		valid  bool
	}{{
		name:   "valid",
		newCfg: configMap,
		oldCfg: configMap,
		valid:  true,
	}, {
		name:   "invalid",
		newCfg: noVersion,
		oldCfg: configMap,
		valid:  false,
	}, {
		name:   "mark configmap immutable",
		oldCfg: configMap,
		newCfg: immutableConfigMap,

                      A single CACertificateRef to a Kubernetes ConfigMap kind has "Core" support.
                      Implementations MAY choose to support attaching multiple certificates to
                      a backend, but this behavior is implementation-specific.


                      Support: Core - An optional single reference to a Kubernetes ConfigMap,
                      with the CA certificate in a key named `ca.crt`.

          },
          "kind": {
            "default": "",
            "description": "Kind is the type of resource being referenced. This is the same value as in the parameter object's metadata, for example \"ConfigMap\".",
            "type": "string"
          },
          "name": {
            "default": "",
            "description": "Name is the name of resource being referenced.",
            "type": "string"