readOnlyRootFilesystem: true
            runAsNonRoot: true
{{- if .Values.operator.seccompProfile }}
            seccompProfile:
{{ toYaml .Values.operator.seccompProfile | trim | indent 14 }}
{{- end }}
{{- if .Values.imagePullPolicy }}
          imagePullPolicy: {{ .Values.imagePullPolicy }}
{{- end }}
          resources:
{{ toYaml .Values.operator.resources | trim | indent 12 }}
          env:

  // Cannot be updated.
  // More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
  // +optional
  optional string imagePullPolicy = 14;

  // SecurityContext defines the security options the container should be run with.
  // If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.

		},
		{ // case 13
			Args:           strings.Split("--browser=false controlz --selector app=example", " "),
			ExpectedRegexp: regexp.MustCompile(".*no pods found"),
			WantException:  true,
		},
		{ // case 14
			Args:           strings.Split("--browser=false controlz --selector app=example pod-123456-7890", " "),
			ExpectedRegexp: regexp.MustCompile(".*Error: name cannot be provided when a selector is specified"),

  // deprecatedLastTimestamp is the deprecated field assuring backward compatibility with core.v1 Event type.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time deprecatedLastTimestamp = 14;

  // deprecatedCount is the deprecated field assuring backward compatibility with core.v1 Event type.
  // +optional
  optional int32 deprecatedCount = 15;
}

// EventList is a list of Event objects.

  // deprecatedLastTimestamp is the deprecated field assuring backward compatibility with core.v1 Event type.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time deprecatedLastTimestamp = 14;

  // deprecatedCount is the deprecated field assuring backward compatibility with core.v1 Event type.
  // +optional
  optional int32 deprecatedCount = 15;
}

// EventList is a list of Event objects.

  //
  // See documentation for the "matchPolicy" field in the webhook configuration type.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource requestResource = 14;

  // RequestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")

            runAsNonRoot: true
            capabilities:
              drop:
              - ALL
{{- if .Values.pilot.seccompProfile }}
            seccompProfile:
{{ toYaml .Values.pilot.seccompProfile | trim | indent 14 }}
{{- end }}
          volumeMounts:
          - name: istio-token
            mountPath: /var/run/secrets/tokens
            readOnly: true
          - name: local-certs

              # There does not appear to be a more granular capability for this.
              - SYS_ADMIN
{{- if .Values.cni.seccompProfile }}
            seccompProfile:
{{ toYaml .Values.cni.seccompProfile | trim | indent 14 }}
{{- end }}
          command: ["install-cni"]
          args:
            {{- if .Values.global.logging.level }}
            - --log_output_level={{ .Values.global.logging.level }}
            {{- end}}

  // the PSP should deny the pod.
  // If set to false the container may run with a read only root file system if it wishes but it
  // will not be forced to.
  // +optional
  optional bool readOnlyRootFilesystem = 14;

  // defaultAllowPrivilegeEscalation controls the default setting for whether a
  // process can gain more privileges than its parent process.
  // +optional
  optional bool defaultAllowPrivilegeEscalation = 15;

securityContext: allowPrivilegeEscala: false capabilities: drop: - ALL privileged: false readOnlyRootFilesyst: true runAsNonRoot: true {{- if .Values.operator.seccompProfile }} seccompProfile: {{ toYaml .Values.operator.seccompProfile | trim | indent 14 }} {{- end }} {{- if .Values.imagePullPolicy }} imagePullPolicy: {{ .Values.imagePullPolicy }} {{- end }} resources: {{ toYaml .Values.operator.resources | trim | indent 12 }} env: - name: WATCH_NAMESPACE value: {{.Values.watchedNamespaces | quote}}...