#
    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
    # injectedAnnotations:
    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default

      deletePods: false
      # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
      # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
      # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
      repairPods: true

    #
    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
    # injectedAnnotations:
    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default

        # external services defined using service entries, where the service
        # entry has resolution set to DNS, has one or more endpoints with
        # network field set to "external". By default its set to "" so that
        # the egress gateway sees the same set of endpoints as the sidecars
        # preserving backward compatibility
        # ISTIO_META_REQUESTED_NETWORK_VIEW: ""

      nodeSelector: {}
      tolerations: []

    # . implies these objects are visible to only to sidecars in the same namespace, or if imported as a Sidecar.egress.host
    defaultConfigVisibilitySettings: []

    # Default node selector to be applied to all deployments so that all pods can be
    # constrained to run a particular nodes. Each component can overwrite these default
    # values by adding its node selector block in the relevant section below and setting
    # the desired values.