{{- end }}
          {{- range $key, $val := $gateway.env }}
          - name: {{ $key }}
            value: {{ $val | quote }}
          {{- end }}
          volumeMounts:
          {{- range $gateway.secretVolumes }}
          - name: {{ .name }}
            mountPath: {{ .mountPath | quote }}
            readOnly: true
          {{- end }}
          {{- range $gateway.configVolumes }}

          {{- end }}
          {{- range $key, $val := $gateway.env }}
          - name: {{ $key }}
            value: {{ $val | quote }}
          {{- end }}
          volumeMounts:
          {{- range $gateway.secretVolumes }}
          - name: {{ .name }}
            mountPath: {{ .mountPath | quote }}
            readOnly: true
          {{- end }}
          {{- range $gateway.configVolumes }}

      - "certificatesigningrequests/status"
    verbs: ["update", "create", "get", "delete", "watch"]
  - apiGroups: ["certificates.k8s.io"]
    resources:
      - "signers"
    resourceNames:
{{- range .Values.global.certSigners }}
    - {{ . | quote }}
{{- end }}
    verbs: ["approve"]
{{- end}}

  # Used by Istiod to verify the JWT tokens
  - apiGroups: ["authentication.k8s.io"]

{{- end }}
  type: {{ $gateway.type }}
  selector:
{{ $gateway.labels | toYaml | indent 4 }}
  ports:

    {{- range $key, $val := $gateway.ports }}
    -
      {{- range $pkey, $pval := $val }}
      {{ $pkey}}: {{ $pval }}
      {{- end }}
    {{- end }}

  {{ range $app := $gateway.egressPorts }}
    -
      port: {{ $app.port }}
      name: {{ $app.name }}
  {{- end }}

{{ $gateway := index .Values "gateways" "istio-ingressgateway" }}
apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: {{ $gateway.name }}-service-account
  namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | trim | indent 4 }}
    release: {{ .Release.Name }}

      nodePort: {{ .Values.consoleService.nodePort }}
      {{- else }}
      targetPort: {{ .Values.minioConsolePort }}
      {{- end }}
  {{- if .Values.consoleService.externalIPs }}
  externalIPs:
    {{- range $i , $ip := .Values.consoleService.externalIPs }}
    - {{ $ip }}
    {{- end }}
  {{- end }}
  selector:
    app: {{ template "minio.name" . }}

  config: |-
    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
    defaultTemplates:
{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
    - {{ . }}
{{- end }}
    {{- else }}
    defaultTemplates: [sidecar]
    {{- end }}
    policy: {{ .Values.global.proxy.autoInject }}
    alwaysInjectSelector:

apiVersion: v1
kind: ServiceAccount
  {{- with .Values.imagePullSecrets }}
imagePullSecrets:
  {{- range . }}
  - name: {{ . }}
  {{- end }}
  {{- end }}
metadata:
  name: ztunnel
  namespace: {{ .Release.Namespace }}
  labels:
    {{- .Values.labels | toYaml | nindent 4}}
  annotations:
    {{- .Values.annotations | toYaml | nindent 4 }}
---
{{- if (eq .Values.platform "openshift") }}
apiVersion: rbac.authorization.k8s.io/v1

      nodePort: {{ .Values.service.nodePort }}
      {{- else }}
      targetPort: {{ .Values.minioAPIPort }}
      {{- end }}
  {{- if .Values.service.externalIPs }}
  externalIPs:
    {{- range $i , $ip := .Values.service.externalIPs }}
    - {{ $ip }}
    {{- end }}
  {{- end }}
  selector:
    app: {{ template "minio.name" . }}

  sideEffects: None
  rules:
  - operations: [ "CREATE" ]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
  failurePolicy: Fail
  admissionReviewVersions: ["v1beta1", "v1"]
{{- end }}
{{- range $tagName := $.Values.revisionTags }}
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
{{- if eq $.Release.Namespace "istio-system"}}
  name: istio-revision-tag-{{ $tagName }}