# when using http://gateway-api.org/.
    enabled: true

  serviceAccount:
    # If set, a service account will be created. Otherwise, the default is used
    create: true
    # Annotations to add to the service account
    annotations: {}
    # The name of the service account to use.
    # If not set, the release name is used
    name: ""

  podAnnotations:
    prometheus.io/port: "15020"

    # For example: https://$remotePilotAddress:15017/inject
    # The host should not refer to a service running in the cluster; use a service reference by specifying
    # the clientConfig.service field instead.
    injectionURL: ""

    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
    # Override to pass env variables, for example: /inject/cluster/remote/net/network2

    # An empty value means it is a vanilla Kubernetes distribution, therefore no special
    # treatment will be considered.
    platform: ""

    # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
    # This is intended only for use with external istiod.
    ipFamilyPolicy: ""
    ipFamilies: []

  base:

    # For example: https://$remotePilotAddress:15017/inject
    # The host should not refer to a service running in the cluster; use a service reference by specifying
    # the clientConfig.service field instead.
    injectionURL: ""
    # Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
    # Override to pass env variables, for example: /inject/cluster/remote/net/network2

  ##
  subPath: ""

## Expose the MinIO service to be accessed from outside the cluster (LoadBalancer service).
## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it.
## ref: http://kubernetes.io/docs/user-guide/services/
##
service:
  type: ClusterIP
  clusterIP: ~
  port: "9000"
  nodePort: 32000
  loadBalancerIP: ~

        # Annotations to add to the service account
        annotations: {}

      ### Advanced options ############
      # TODO: convert to real options, env should not be exposed
      env: {}
        # Set this to "external" if and only if you want the egress gateway to
        # act as a transparent SNI gateway that routes mTLS/TLS traffic to
        # external services defined using service entries, where the service

      # When a CSR is sent from Citadel Agent to the CA (e.g. Citadel), this aud is to make sure the
      # JWT is intended for the CA.
      token:
        aud: istio-ca

    sts:
      # The service port used by Security Token Service (STS) server to handle token exchange requests.
      # Setting this port to a non-zero value enables STS server.
      servicePort: 0
    # whether to use autoscaling/v2 template for HPA settings

  # Additional labels to apply on the pod level
  podLabels: {}

  # Pod resource configuration
  resources:
    requests:
      cpu: 500m
      memory: 2048Mi

  # List of secret names to add to the service account as image pull secrets
  imagePullSecrets: []

  # A `key: value` mapping of environment variables to add to the pod
  env: {}

  # Override for the pod imagePullPolicy
  imagePullPolicy: ""