{{- toJsonMap
      .InfrastructureLabels
      (strdict
        "gateway.networking.k8s.io/gateway-name" .Name
        "istio.io/gateway-name" .Name
      ) | nindent 4 }}
  {{- if ge .KubeVersion 128 }}
  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
  ownerReferences:
  - apiVersion: gateway.networking.k8s.io/v1beta1
    kind: Gateway
    name: "{{.Name}}"
    uid: "{{.UID}}"
  {{- end }}
---

      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
      securityContext:
      {{- if .Values.securityContext }}
        {{- toYaml .Values.securityContext | nindent 8 }}
      {{- else }}
        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
        sysctls:
        - name: net.ipv4.ip_unprivileged_port_start
          value: "0"
      {{- end }}
      {{- with .Values.volumes }}
      volumes:

                         {
                          "filter_state": {
                           "key": "io.istio.peer_principal",
                           "string_match": {
                            "safe_regex": {
                             "regex": ".*/ns/test/.*"
                            }
                           }
                          }
                         }
                        ]

    {{- toJsonMap
      .InfrastructureLabels
      (strdict
        "gateway.networking.k8s.io/gateway-name" .Name
        "istio.io/gateway-name" .Name
      ) | nindent 4 }}
  {{- if ge .KubeVersion 128 }}
  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412
  ownerReferences:
  - apiVersion: gateway.networking.k8s.io/v1beta1
    kind: Gateway
    name: "{{.Name}}"
    uid: "{{.UID}}"
  {{- end }}
---

}} serviceAccountName: {{ include "gateway.serviceAccountName" . }} securityContext: {{- if .Values.securityContext }} {{- toYaml .Values.securityContext | nindent 8 }} {{- else if (semverCompare ">=1.22-0" .Capabilities.KubeVersion.GitVersion) }} # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326 sysctls: - name: net.ipv4.ip_unprivileged_port_start value: "0" {{- end }} {{- with .Values.volumes }} volumes: {{ toYaml . | nindent 8 }} {{- end }} containers: - name: istio-proxy #...

      # deny for all go files
      AllGoFiles:
        files:
          - $all
        deny:
          - pkg: golang.org/x/net/http2/h2c
            desc: "h2c.NewHandler is unsafe; use wrapper istio.io/istio/pkg/h2c"
          - pkg: github.com/golang/protobuf/jsonpb
            desc: "don't use the jsonpb package directly; use util/protomarshal instead"