#
    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
    # injectedAnnotations:
    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default

      postStart:
        exec:
          command:
          - pilot-agent
          - wait
  {{- else if $nativeSidecar }}
    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
    lifecycle:
      preStop:
        exec:
          command:
          - pilot-agent
          - request

      postStart:
        exec:
          command:
          - pilot-agent
          - wait
  {{- else if $nativeSidecar }}
    {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}}
    lifecycle:
      preStop:
        exec:
          command:
          - pilot-agent
          - request

metadata:
  labels:
    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}

    #
    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
    # injectedAnnotations:
    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default

  gocritic:
    # Disable all checks.
    # Default: false
    disable-all: true
    # Which checks should be enabled in addition to default checks. Since we don't want
    # all of the default checks, we do the disable-all first.
    enabled-checks:
      - appendCombine
      - argOrder
      - assignOp
      - badCond
      - boolExprSimplify
      - builtinShadow