// It must match the pod template's labels.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;

  // Template describes the pods that will be created.
  // The only allowed template.spec.restartPolicy value is "Always".
  optional k8s.io.api.core.v1.PodTemplateSpec template = 3;

  // The deployment strategy to use to replace existing pods with new ones.
  // +optional

    # This is intended for advanced configuration only; most users should use the built in template
    templates: {}

    # Default templates specifies a set of default templates that are used in sidecar injection.
    # By default, a template `sidecar` is always provided, which contains the template of default sidecar.
    # To inject other additional templates, define it using the `templates` option, and add it to

}}
{{- range $dep, $replace := $deps }}
{{- /* Complex logic to turn the string above into a null-safe traversal like ((.Values.global).certificates */}}
{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
{{- if not (eq $res "")}}
WARNING: {{$dep|quote}} is deprecated; use {{$replace|quote}} instead.
{{- end }}
{{- end }}
{{-
  $failDeps := dict

spec:
  metadata:
    annotations:
      proxy.istio.io/config: |-
        proxyMetadata:
          # this should override the value from the global meshconfig
          PROXY_CONFIG_ANNOT_VALUE: bar
    labels: {}
  template:
    ports: {}
    serviceAccount: vm-serviceaccount
  probe:
    httpGet:

	MountedCNINetDir string
	// Name of the CNI config file
	CNIConfName string
	// Whether to install CNI plugin as a chained or standalone
	ChainedCNIPlugin bool

	// CNI config template file
	CNINetworkConfigFile string
	// CNI config template string
	CNINetworkConfig string

	// Logging level
	LogLevel string
	// Name of the kubeconfig file used by the CNI plugin
	KubeconfigFilename string

}

func (m *realDeps) destroySet(name string) error {
	return errors.New("not implemented on this platform")
}

func (m *realDeps) addIP(name string, ip netip.Addr, ipProto uint8, comment string, replace bool) error {
	return errors.New("not implemented on this platform")
}

func (m *realDeps) deleteIP(name string, ip netip.Addr, ipProto uint8) error {
	return errors.New("not implemented on this platform")
}

{{- .Values.name | default .Release.Name | default "istio-ingressgateway" -}} {{- end -}} {{- end }} {{/* Create chart name and version as used by the chart label. */}} {{- define "gateway.chart" -}} {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} {{- end }} {{- define "gateway.labels" -}} helm.sh/chart: {{ include "gateway.chart" . }} {{ include "gateway.selectorLabels" . }} {{- if .Chart.AppVersion }} app.kubernetes.io/version: {{ .Chart.AppVersion |...

                          enum:
                          - INVALID
                          - MERGE
                          - ADD
                          - REMOVE
                          - INSERT_BEFORE
                          - INSERT_AFTER
                          - INSERT_FIRST
                          - REPLACE
                          type: string

      timeoutSeconds: 3
      failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }}
    resources:
  {{ template "resources" . }}
    volumeMounts:
    - name: workload-socket
      mountPath: /var/run/secrets/workload-spiffe-uds
    {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
    - name: gke-workload-certificate

  // +listType=map
  // +listMapKey=type
  // +optional
  repeated CertificateSigningRequestCondition conditions = 1;

  // If request was approved, the controller will place the issued certificate here.
  // +listType=atomic
  // +optional
  optional bytes certificate = 2;
}

// ExtraValue masks the value so protobuf can generate
// +protobuf.nullable=true