readOnlyRootFilesystem: true
            runAsNonRoot: true
{{- if .Values.operator.seccompProfile }}
            seccompProfile:
{{ toYaml .Values.operator.seccompProfile | trim | indent 14 }}
{{- end }}
{{- if .Values.imagePullPolicy }}
          imagePullPolicy: {{ .Values.imagePullPolicy }}
{{- end }}
          resources:
{{ toYaml .Values.operator.resources | trim | indent 12 }}
          env:

securityContext: allowPrivilegeEscala: false capabilities: drop: - ALL privileged: false readOnlyRootFilesyst: true runAsNonRoot: true {{- if .Values.operator.seccompProfile }} seccompProfile: {{ toYaml .Values.operator.seccompProfile | trim | indent 14 }} {{- end }} {{- if .Values.imagePullPolicy }} imagePullPolicy: {{ .Values.imagePullPolicy }} {{- end }} resources: {{ toYaml .Values.operator.resources | trim | indent 12 }} env: - name: WATCH_NAMESPACE value: {{.Values.watchedNamespaces | quote}}...

            runAsNonRoot: true
            capabilities:
              drop:
              - ALL
{{- if .Values.pilot.seccompProfile }}
            seccompProfile:
{{ toYaml .Values.pilot.seccompProfile | trim | indent 14 }}
{{- end }}
          volumeMounts:
          - name: istio-token
            mountPath: /var/run/secrets/tokens
            readOnly: true
          - name: local-certs

              # There does not appear to be a more granular capability for this.
              - SYS_ADMIN
{{- if .Values.cni.seccompProfile }}
            seccompProfile:
{{ toYaml .Values.cni.seccompProfile | trim | indent 14 }}
{{- end }}
          command: ["install-cni"]
          args:
            {{- if .Values.global.logging.level }}
            - --log_output_level={{ .Values.global.logging.level }}
            {{- end}}