inject.istio.io/templates: "gateway"
    sidecar.istio.io/inject: "true"

  # Define the security context for the pod.
  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
  securityContext: ~
  containerSecurityContext: ~

  service:

            "cluster": "outbound|15021||ratings-istio-waypoint.ambient.svc.cluster.local"
           }
          }
         ]
        }
       ],
       "traffic_direction": "OUTBOUND",
       "bind_to_port": false
      },
      "last_updated": "2023-06-20T09:07:41.943Z"
     }
    },
    {
     "name": "10.108.65.203_443",
     "active_state": {
      "version_info": "2023-06-20T09:07:41Z/3",

          runAsGroup: {{ .ProxyGID | default "1337" }}
          runAsNonRoot: true
        {{- else }}
          capabilities:
            drop:
            - ALL
            add:
            - NET_BIND_SERVICE
          runAsUser: 0
          runAsGroup: 1337
          runAsNonRoot: false
          allowPrivilegeEscalation: true
          readOnlyRootFilesystem: true
        {{- end }}
        ports:

                  properties:
                    bind:
                      description: The IP(IPv4 or IPv6) or the Unix domain socket
                        to which the listener should be bound to.
                      type: string
                    captureMode:
                      description: |-

description: Egress specifies the configuration of the sidecar for processing outbound traffic from the attached workload instance to other services in the mesh. items: properties: bind: description: The IP(IPv4 or IPv6) or the Unix domain socket to which the listener should be bound to. type: string captureMode: description: When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). enum: - DEFAULT - IPTABLES - NONE type: string hosts: description:...

        - NET_ADMIN
        {{- end }}
        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
        - NET_BIND_SERVICE
        {{- end }}
        {{- end }}
        drop:
        - ALL
      privileged: {{ .Values.global.proxy.privileged }}

        - NET_ADMIN
        {{- end }}
        {{ if eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true` -}}
        - NET_BIND_SERVICE
        {{- end }}
        {{- end }}
        drop:
        - ALL
      privileged: {{ .Values.global.proxy.privileged }}

            fieldRef:
              fieldPath: spec.nodeName
        - name: METALLB_HOST
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: METALLB_ML_BIND_ADDR
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: METALLB_ML_LABELS
          value: app=metallb,component=speaker
        - name: METALLB_ML_SECRET_KEY_PATH

                  properties:
                    bind:
                      description: The IP(IPv4 or IPv6) or the Unix domain socket
                        to which the listener should be bound to.
                      type: string
                    captureMode:
                      description: |-

          hostPath:
            path: {{ .Values.cni.cniNetnsDir | default "/var/run/netns" }}
            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.