java-version: 11
      - id: determine-sys-prop-args
        uses: actions/github-script@v7
        with:
          script: |
            if (context.payload.pull_request && context.payload.pull_request.head.repo.fork) {
                core.setOutput('sys-prop-args', '-DagreePublicBuildScanTermOfService=yes -DcacheNode=us')
            } else {
                core.setOutput('sys-prop-args', '-DcacheNode=us')
            }

        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
        args:
        - proxy
        - waypoint
        - --domain
        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
        - --serviceCluster
        - {{.ServiceAccount}}.$(POD_NAMESPACE)
        - --proxyLogLevel
        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}

            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.