{{- end }}
{{- end }}
{{- end }}
  volumes:
  - emptyDir:
    name: workload-socket
  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
  - name: gke-workload-certificate
    csi:
      driver: workloadcertificates.security.cloud.google.com
  {{- else }}
  - emptyDir:
    name: workload-certs
  {{- end }}
  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}

message ResourceClaimSpec {
  // ResourceClassName references the driver and additional parameters
  // via the name of a ResourceClass that was created as part of the
  // driver deployment.
  optional string resourceClassName = 1;

  // ParametersRef references a separate object with arbitrary parameters
  // that will be used by the driver when allocating a resource for the
  // claim.
  //

// CSIDriver captures information about a Container Storage Interface (CSI)
// volume driver deployed on the cluster.
// CSI drivers do not need to create the CSIDriver object directly. Instead they may use the
// cluster-driver-registrar sidecar container. When deployed with a CSI driver it automatically
// creates a CSIDriver object representing the driver.
// Kubernetes attach detach controller uses this object to determine whether attach is required.

        name: workload-socket
      - emptyDir: {}
        name: credential-socket
      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
      - name: gke-workload-certificate
        csi:
          driver: workloadcertificates.security.cloud.google.com
      {{- else}}
      - emptyDir: {}
        name: workload-certs
      {{- end }}
      # SDS channel between istioagent and Envoy
      - emptyDir:

  // storageCapacity indicates that the CSI volume driver wants pod scheduling to consider the storage
  // capacity that the driver deployment will report by creating
  // CSIStorageCapacity objects with capacity information, if set to true.
  //
  // The check can be enabled immediately when deploying a driver.
  // In that case, provisioning new volumes with late binding
  // will pause until the driver deployment has published

  volumes:
  - emptyDir:
    name: workload-socket
  - emptyDir:
    name: credential-socket
  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
  - name: gke-workload-certificate
    csi:
      driver: workloadcertificates.security.cloud.google.com
  {{- else }}
  - emptyDir:
    name: workload-certs
  {{- end }}
  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}

  volumes:
  - emptyDir:
    name: workload-socket
  - emptyDir:
    name: credential-socket
  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
  - name: gke-workload-certificate
    csi:
      driver: workloadcertificates.security.cloud.google.com
  {{- else }}
  - emptyDir:
    name: workload-certs
  {{- end }}
  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}

// AllowedCSIDriver represents a single inline CSI Driver that is allowed to be used.
message AllowedCSIDriver {
  // Name is the registered name of the CSI driver
  optional string name = 1;
}

// AllowedFlexVolume represents a single Flexvolume that is allowed to be used.
message AllowedFlexVolume {
  // driver is the name of the Flexvolume driver.
  optional string driver = 1;
}