),
          self.query(
            'Received ({{pod}})',
            sum(rate(labels('istio_tcp_received_bytes_total', podLabels)), by=['pod'])
          ),
        ],

      dns:
        self.query(
          'Request ({{pod}})',
          sum(rate(labels('istio_dns_requests_total', podLabels)), by=['pod'])
        ),

    {{- end }}
spec:
  template:
    metadata:
      labels:
        app: {{ template "minio.name" . }}-job
        release: {{ .Release.Name }}
        {{- if .Values.podLabels }}
          {{- toYaml .Values.podLabels | nindent 8 }}
        {{- end }}
      {{- if .Values.postJob.podAnnotations }}
      annotations: {{- toYaml .Values.postJob.podAnnotations | nindent 8 }}
      {{- end }}
    spec:

  template:
    metadata:
      name: {{ template "minio.fullname" . }}
      labels:
        app: {{ template "minio.name" . }}
        release: {{ .Release.Name }}
        {{- if .Values.podLabels }}
          {{- toYaml .Values.podLabels | nindent 8 }}
        {{- end }}
      annotations:
        {{- if not .Values.ignoreChartChecksums }}
        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}

# Avoid creating a bunch of RBAC rules for features we are not enabling
rbac:
  create: false
  pspEnabled: false

# Disable test pods
testFramework:
  enabled: false

podLabels:
  sidecar.istio.io/inject: "false"

# Demo only, so we will have no authentication
admin:
  existingSecret: ""
ldap:
  existingSecret: true
env:
  GF_SECURITY_ADMIN_USER: "admin"
  GF_SECURITY_ADMIN_PASSWORD: "admin"

  template:
    metadata:
      name: {{ template "minio.fullname" . }}
      labels:
        app: {{ template "minio.name" . }}
        release: {{ .Release.Name }}
        {{- if .Values.podLabels }}
          {{- toYaml .Values.podLabels | nindent 8 }}
        {{- end }}
      annotations:
        {{- if not .Values.ignoreChartChecksums }}
        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}

}

func matchesAnyPod(subsetSelector klabels.Selector, podsLabels []klabels.Set) bool {
	for _, podLabels := range podsLabels {
		if subsetSelector.Matches(podLabels) {
			return true
		}
	}
	return false
}

func printDestinationRule(writer io.Writer, initPrintNum int,
	dr *clientnetworking.DestinationRule, podsLabels []klabels.Set,
) {
	fmt.Fprintf(writer, "%sDestinationRule: %s for %q\n",

selector: matchLabels: app: {{ template "minio.name" . }} release: {{ .Release.Name }} template: metadata: name: {{ template "minio.fullname" . }} labels: app: {{ template "minio.name" . }} release: {{ .Release.Name }} {{- if .Values.podLabels }} {{- toYaml .Values.podLabels | nindent 8 }} {{- end }} annotations: {{- if not .Values.ignoreChartChecksums }} checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml")...

  fsGroup: 1000
  fsGroupChangePolicy: "OnRootMismatch"

containerSecurityContext:
  readOnlyRootFilesystem: false

# Additational pod annotations
podAnnotations: {}

# Additional pod labels
podLabels: {}

## Configure resource requests and limits
## ref: http://kubernetes.io/docs/user-guide/compute-resources/
##
resources:
  requests:
    memory: 16Gi

# We set up anonymous authentication as this is for demos.
auth:
  strategy: anonymous
deployment:
  pod_labels:
    sidecar.istio.io/inject: "false"
  ingress_enabled: false
  image_pull_policy: IfNotPresent
login_token:
  signing_key: CHANGEME00000000
external_services:
  # Kiali will not start up without tracing service. We don't want to require it.
  tracing: