# have a shared root CA for this model to work.
      enabled: false
      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
      # to properly label proxies
      clusterName: ""

    # Network defines the network this cluster belong to. This name
    # corresponds to the networks in the map of mesh networks.
    network: ""

defaults:
  global:

    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
    # to use for pulling any images in pods that reference this ServiceAccount.
    # Must be set for any cluster configured with private docker registry.
    imagePullSecrets: []

    # Used to locate istiod.
    istioNamespace: istio-system

    externalIstiod: false
    remotePilotAddress: ""

defaults:
  # Name allows overriding the release name. Generally this should not be set
  name: ""
  # revision declares which revision this gateway is a part of
  revision: ""

  # Controls the spec.replicas setting for the Gateway deployment if set.
  # Otherwise defaults to Kubernetes Deployment default (1).
  replicaCount:

  kind: Deployment

  rbac:

defaults:
  hub: gcr.io/istio-testing
  tag: latest

  # ImagePullSecrets for operator ServiceAccount, list of secrets in the same namespace
  # used to pull operator image. Must be set for any cluster configured with private docker registry.
  imagePullSecrets: []

  # Specify image pull policy if default behavior isn't desired.
  # Default behavior: latest images will be Always else IfNotPresent.
  imagePullPolicy: ""

      # have a shared root CA for this model to work.
      enabled: false
      # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
      # to properly label proxies
      clusterName: ""
    # Network defines the network this cluster belong to. This name
    # corresponds to the networks in the map of mesh networks.
    network: ""

    logging:
      level: default:info,cni:info

    logAsJson: false

    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
    # to use for pulling any images in pods that reference this ServiceAccount.
    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)

  # Should be installed in a separate namespace, to minimize access to config
  gateways:
    istio-egressgateway:
      name: istio-egressgateway
      ports:
      - port: 80
        targetPort: 8080
        name: http2
        protocol: TCP
      - port: 443
        name: https
        targetPort: 8443
        protocol: TCP

      labels:
        app: istio-egressgateway
        istio: egressgateway

      # checks always work. https://github.com/istio/istio/issues/12503
      - port: 15021
        targetPort: 15021
        name: status-port
        protocol: TCP
      - port: 80
        targetPort: 8080
        name: http2
        protocol: TCP
      - port: 443
        targetPort: 8443
        name: https
        protocol: TCP

      # Scalability tuning
      # replicaCount: 1
      rollingMaxSurge: 100%

  env: {}

  # Override for the pod imagePullPolicy
  imagePullPolicy: ""

  # Settings for multicluster
  multiCluster:
    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
    # with Istiod configuration.
    clusterName: ""

  # meshConfig defines runtime configuration of components.