if cfg == nil {
		return
	}
	cfg.ControlPlaneValues = tmpl.MustEvaluate(`
{{- if not .isExternalControlPlane }}
components:
  egressGateways:
  - enabled: true
    name: istio-egressgateway
values:
   gateways:
      istio-egressgateway:
         secretVolumes:
         - name: client-custom-certs
           secretName: egress-gw-cacerts
           mountPath: /etc/certs/custom
{{- end }}

metadata:
  name: {{ $gateway.name | default "istio-egressgateway" }}
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "EgressGateways"
spec:
{{- if not $gateway.autoscaleEnabled }}

kind: Gateway
metadata:
  name: istio-egressgateway
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "some-external-site.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: route-via-egressgateway
spec:
  hosts:
    - "some-external-site.com"
  gateways:

      proxy:
        resources:
          requests:
            cpu: 10m
            memory: 40Mi
    gateways:
      istio-ingressgateway:
        autoscaleEnabled: false
        resources:
          requests:
            cpu: 10m
            memory: 40Mi
      istio-egressgateway:
        autoscaleEnabled: false
        resources:
          requests:
            cpu: 10m

{{ $gateway := index .Values "gateways" "istio-egressgateway" }}
{{- if not $gateway.customService }}
apiVersion: v1
kind: Service
metadata:
  name: {{ $gateway.name }}
  namespace: {{ .Release.Namespace }}
  annotations:
    {{- range $key, $val := $gateway.serviceAnnotations }}
    {{ $key }}: {{ $val | quote }}
    {{- end }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}

{{ $gateway := index .Values "gateways" "istio-egressgateway" }}
apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: {{ $gateway.name }}-service-account
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | trim | indent 4 }}
    release: {{ .Release.Name }}

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ $gateway.name }}-sds
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "EgressGateways"
rules:

{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
{{ $gateway := index .Values "gateways" "istio-egressgateway" }}
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: {{ $gateway.name }}
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | trim | indent 4 }}
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" | quote }}

	// This field should only be set when DeployIstio is false
	EgressGatewayServiceNamespace string

	// EgressGatewayIstioLabel allows overriding the selector of the egressgateway service (defaults to istio=egressgateway)
	// This field should only be set when DeployIstio is false
	EgressGatewayIstioLabel string

# with the appropriate version
version: 1.0.0
appVersion: 1.0.0
description: Helm chart for deploying Istio gateways
keywords:
  - istio
  - egressgateway
  - gateways
sources:
  - https://github.com/istio/istio