group:
                    description: group is the group of the target resource.
                    type: string
                  kind:
                    description: kind is kind of the target resource.
                    type: string
                  name:
                    description: name is the name of the target resource.
                    type: string
                  namespace:

  namespace: {{ .Release.Namespace }}
  labels:
    app: istiod
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Pilot"
    release: {{ .Release.Name }}
    istio: pilot
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: istiod

    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "IngressGateways"
spec:
  maxReplicas: {{ $gateway.autoscaleMax }}
  minReplicas: {{ $gateway.autoscaleMin }}
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: {{ $gateway.name }}
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:

                  group:
                    description: group is the group of the target resource.
                    type: string
                  kind:
                    description: kind is kind of the target resource.
                    type: string
                  name:
                    description: name is the name of the target resource.
                    type: string
                  namespace:

A secondary configuration consumed by Ztunnel is the [`Authorization` resource](../../pkg/workloadapi/security/authorization.proto).
[Original Design Doc](https://docs.google.com/document/d/17mRVzXe8PS7VoligvIx52T10tOP7xPQ9noeOzoLO2cY/edit).

This resource aims to represent the relatively small set of Authorization policies that Ztunnel support.
Most notably, this is only L4 resources.

Most of the API is fairly straight forward.

              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 2
            successThreshold: 1
            timeoutSeconds: 1
          resources:
{{- if $gateway.resources }}
{{ toYaml $gateway.resources | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | indent 12 }}
{{- end }}
          env:
          - name: PILOT_CERT_PROVIDER

      {{- else }}
        image: "{{ .ProxyImage }}"
      {{- end }}
        {{- if .Values.global.proxy.resources }}
        resources:
          {{- toYaml .Values.global.proxy.resources | nindent 10 }}
        {{- end }}
        {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
        securityContext:
        {{- if ge .KubeVersion 122 }}

  labels:
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "IngressGateways"
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]

        {{- end }}
        {{- end }}
        - name: GOMEMLIMIT
          valueFrom:
            resourceFieldRef:
              resource: limits.memory
        - name: GOMAXPROCS
          valueFrom:
            resourceFieldRef:
              resource: limits.cpu
        - name: ISTIO_META_CLUSTER_ID
          value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}"

{{- end }}
  labels:
    istio.io/tag: {{ $tagName }}
    istio.io/rev: {{ $.Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ $.Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Pilot"
    app: sidecar-injector
    release: {{ $.Release.Name }}
webhooks: