# Additional labels to apply to the deployment.
    deploymentLabels: {}

    ## Mesh config settings

    # Install the mesh config map, generated from values.yaml.
    # If false, pilot wil use default values (by default) or user-supplied values.
    configMap: true

    # Additional labels to apply on the pod level for monitoring and logging configuration.
    podLabels: {}

Xiaopeng Han <******@****.***> 1686841337 +0800

    namespace: {{ .Values.global.istioNamespace }}
---
{{- if not (eq (toString .Values.pilot.env.PILOT_ENABLE_GATEWAY_API_DEPLOYMENT_CONTROLLER) "false") }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istiod-gateway-controller{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
  labels:

  minReplicas: {{ .Values.autoscaling.minReplicas }}
  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
  metrics:
    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
    - type: Resource
      resource:
        name: cpu
        target:
          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
          type: Utilization
    {{- end }}

{{- if .Values.global.remotePilotAddress }}
apiVersion: v1
kind: Service
metadata:
  {{- if .Values.pilot.enabled }}
  # when local istiod is enabled, we can't use istiod service name to reach the remote control plane
  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
  {{- else }}
  # when local istiod isn't enabled, we can use istiod service name to reach the remote control plane

    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
      value: "true"
    {{- end }}
    - name: PILOT_CERT_PROVIDER
      value: {{ .Values.global.pilotCertProvider }}
    - name: CA_ADDR
    {{- if .Values.global.caAddress }}
      value: {{ .Values.global.caAddress }}
    {{- else }}
      value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
    {{- end }}

kind: RoleBinding
metadata:
  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Values.global.istioNamespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: istiod{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}
subjects:
  - kind: ServiceAccount

# Removed paths for legacy and default selectors since a revision tag
# is inherently created from a specific revision
{{- $whv := dict
 "revision" .Values.revision
  "injectionPath" .Values.istiodRemote.injectionPath
  "injectionURL" .Values.istiodRemote.injectionURL
  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
  "namespace" .Release.Namespace }}
{{- define "core" }}

"gateway.selectorLabels" -}} {{- if hasKey .Values.labels "app" }} {{- with .Values.labels.app }}app: {{.|quote}} {{- end}} {{- else }}app: {{ include "gateway.name" . }} {{- end }} {{- if hasKey .Values.labels "istio" }} {{- with .Values.labels.istio }} istio: {{.|quote}} {{- end}} {{- else }} istio: {{ include "gateway.name" . | trimPrefix "istio-" }} {{- end }} {{- end }} {{- define "gateway.serviceAccountName" -}} {{- if .Values.serviceAccount.create }} {{- .Values.serviceAccount.name | default (include...

## Making changes

## Step 1. Make changes in charts and values.yaml in `manifests` directory

Be sure to provide sufficient documentation and example usage in values.yaml.
If the chart has a `values.schema.json`, that should be updated as well.

## Step 2. Update the istioctl/Operator values

If you are modifying the `gateway` chart, you can stop here.