{{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
    - name: "{{  $index }}"
      {{ toYaml $value | indent 6 }}
      {{ end }}
      {{- end }}
  volumes:
  - emptyDir:
    name: workload-socket
  - emptyDir:
    name: credential-socket
  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
  - name: gke-workload-certificate
    csi:

      {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }}
    - name: "{{  $index }}"
      {{ toYaml $value | indent 6 }}
      {{ end }}
      {{- end }}
  volumes:
  - emptyDir:
    name: workload-socket
  - emptyDir:
    name: credential-socket
  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
  - name: gke-workload-certificate
    csi:

        - mountPath: /etc/istio/proxy
          name: istio-envoy
        - mountPath: /var/run/secrets/tokens
          name: istio-token
        - mountPath: /etc/istio/pod
          name: istio-podinfo
      volumes:
      - emptyDir: {}
        name: workload-socket
      - emptyDir:
          medium: Memory
        name: istio-envoy
      - emptyDir:
          medium: Memory
        name: go-proxy-envoy

    cpu:
      targetAverageUtilization: 80
    memory: {}
    # targetAverageUtilization: 80

    # Additional volumeMounts to the istiod container
    volumeMounts: []
    # Additional volumes to the istiod pod
    volumes: []
    nodeSelector: {}
    podAnnotations: {}
    serviceAnnotations: {}
    serviceAccountAnnotations: {}
    topologySpreadConstraints: []

    cpu:
      targetAverageUtilization: 80
    memory: {}
      # targetAverageUtilization: 80

    # Additional volumeMounts to the istiod container
    volumeMounts: []

    # Additional volumes to the istiod pod
    volumes: []

    nodeSelector: {}
    podAnnotations: {}
    serviceAnnotations: {}
    serviceAccountAnnotations: {}

    topologySpreadConstraints: []

        readOnly: true
      {{- else }}
      - name: workload-certs
        mountPath: /var/run/secrets/workload-spiffe-credentials
      {{- end }}
{{- end }}
{{- end }}
  volumes:
  - emptyDir:
    name: workload-socket
  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
  - name: gke-workload-certificate
    csi:
      driver: workloadcertificates.security.cloud.google.com

set to "true" to disable this behaviour. ignoreChartChecksums: false ## Additional arguments to pass to minio binary extraArgs: [] # example for enabling FTP: # - --ftp=\"address=:8021\" # - --ftp=\"passive-port-range=10000-10010\" ## Additional volumes to minio container extraVolumes: [] ## Additional volumeMounts to minio container extraVolumeMounts: [] ## Additional sidecar containers extraContainers: [] ## Internal port number for MinIO S3 API container ## Change service.port to change external...

services:
  minio1:
    <<: *minio-common
    hostname: minio1
    volumes:
      - data1-1:/data1
      - data1-2:/data2

  minio2:
    <<: *minio-common
    hostname: minio2
    volumes:
      - data2-1:/data1
      - data2-2:/data2

  minio3:
    <<: *minio-common
    hostname: minio3
    volumes:
      - data3-1:/data1
      - data3-2:/data2

  minio4:
    <<: *minio-common

          {{- toYaml . | nindent 8 }}
        {{- end }}
      priorityClassName: system-node-critical
      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
      volumes:
      - name: istio-token
        projected:
          sources:
          - serviceAccountToken:
              path: istio-token
              expirationSeconds: 43200
              audience: istio-ca

            mountPath: /var/run/secrets/istiod/ca
            readOnly: true
          {{- with .Values.pilot.volumeMounts }}
            {{- toYaml . | nindent 10 }}
          {{- end }}
      volumes:
      # Technically not needed on this pod - but it helps debugging/testing SDS
      # Should be removed after everything works.
      - emptyDir:
          medium: Memory
        name: local-certs