// will fulfill this Template, but have a unique identity from the rest
  // of the StatefulSet. Each pod will be named with the format
  // <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named
  // "web" with index number "3" would be named "web-3".
  // The only allowed template.spec.restartPolicy value is "Always".
  optional k8s.io.api.core.v1.PodTemplateSpec template = 3;

  // group=certificates.k8s.io resource=signers resourceName=<the signer name>
  // verb=attest.
  //
  // If signerName is not empty, then the ClusterTrustBundle object must be
  // named with the signer name as a prefix (translating slashes to colons).
  // For example, for the signer name `example.com/foo`, valid
  // ClusterTrustBundle object names include `example.com:foo:abc` and
  // `example.com:foo:v1`.

  // If not specified, this field defaults to TCP.
  // +optional
  optional string protocol = 1;

  // port represents the port on the given protocol. This can either be a numerical or named
  // port on a pod. If this field is not provided, this matches all port names and
  // numbers.
  // If present, only traffic on the specified protocol AND port will be matched.
  // +optional

  // will fulfill this Template, but have a unique identity from the rest
  // of the StatefulSet. Each pod will be named with the format
  // <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named
  // "web" with index number "3" would be named "web-3".
  // The only allowed template.spec.restartPolicy value is "Always".
  optional k8s.io.api.core.v1.PodTemplateSpec template = 3;

  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> defaultRequest = 5;

  // MaxLimitRequestRatio if specified, the named resource must have a request and limit that are both non-zero where limit divided by request is less than or equal to the enumerated value; this represents the max burst for the named resource.
  // +optional
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> maxLimitRequestRatio = 6;
}

#### Gateway

Gateway (referring to the [Kubernetes API](http://gateway-api.org/), not the same-named Istio type) works very similarly to [Ingress](#ingress). The Gateway controller also converts Gateway API types into `VirtualService` and `Gateway`, implementing the `ConfigStore` interface.

  // If not specified, this field defaults to TCP.
  // +optional
  optional string protocol = 1;

  // The port on the given protocol. This can either be a numerical or named
  // port on a pod. If this field is not provided, this matches all port names and
  // numbers.
  // If present, only traffic on the specified protocol AND port will be matched.
  // +optional

  // presented as-is to a reader.
  // +optional
  optional string message = 2;

  // The field of the resource that has caused this error, as named by its JSON
  // serialization. May include dot and postfix notation for nested attributes.
  // Arrays are zero-indexed.  Fields may appear more than once in an array of
  // causes due to fields having multiple errors.

If you install with `helm install istio-gateway istio/gateway`, resources will be named `istio-gateway` and the `selector` labels set to:

```yaml
app: istio-gateway
istio: gateway # the release name with leading istio- prefix stripped
```

If your existing installation doesn't follow these names, you can override them. For example, if you have resources named `my-custom-gateway` with `selector` labels
`foo=bar,istio=ingressgateway`:

  // will fulfill this Template, but have a unique identity from the rest
  // of the StatefulSet. Each pod will be named with the format
  // <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named
  // "web" with index number "3" would be named "web-3".
  optional k8s.io.api.core.v1.PodTemplateSpec template = 3;

  // volumeClaimTemplates is a list of claims that pods are allowed to reference.