WorkloadType      string            `json:"workloadType"`
	CanonicalName     string            `json:"canonicalName"`
	CanonicalRevision string            `json:"canonicalRevision"`
	ClusterID         string            `json:"clusterId"`
	TrustDomain       string            `json:"trustDomain,omitempty"`
	Locality          Locality          `json:"locality,omitempty"`
	Node              string            `json:"node"`

  ##
  subPath: ""

## Expose the MinIO service to be accessed from outside the cluster (LoadBalancer service).
## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it.
## ref: http://kubernetes.io/docs/user-guide/services/
##
service:
  type: ClusterIP
  clusterIP: ~
  port: "9000"
  nodePort: 32000
  loadBalancerIP: ~
  externalIPs: []

)

// loadClusterNotificationMetrics - `MetricsLoaderFn` for cluster notification metrics.
func loadClusterNotificationMetrics(_ context.Context, m MetricValues, _ *metricsCache) error {
	if globalEventNotifier == nil {
		return nil
	}

	nstats := globalEventNotifier.targetList.Stats()

	syncSuccessesMD                          = NewCounterMD(syncSuccesses, "Number of successful IAM data syncs since server start.")
)

// loadClusterIAMMetrics - `MetricsLoaderFn` for cluster IAM metrics.
func loadClusterIAMMetrics(_ context.Context, m MetricValues, _ *metricsCache) error {
	m.Set(lastSyncDurationMillis, float64(atomic.LoadUint64(&globalIAMSys.LastRefreshDurationMilliseconds)))

    #       port: 443
    #
    meshNetworks: {}
    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
    mountMtlsCerts: false
    multiCluster:
      # Set to true to connect two kubernetes clusters via their respective
      # ingressgateway services when pods in each cluster cannot directly

However, while we chose to use the xDS *transport protocol*, we chose to not use the xDS resource types, such as Clusters and Listeners.
In our experience and testing, these types force us to represent data in inefficient ways because they are general purpose.
Ztunnel is not general purpose; it has an extremely tight goal.

that don't natively support sub mounting (like glusterfs). ## subPath: "" ## Expose the MinIO service to be accessed from outside the cluster (LoadBalancer service). ## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it. ## ref: http://kubernetes.io/docs/user-guide/services/ ## service: type: ClusterIP clusterIP: ~ port: "9000" nodePort: 32000 loadBalancerIP: ~ externalIPs: [] annotations: {} ## service.loadBalancerSourceRa Addresses that are allowed...

  annotations: {{- toYaml .Values.consoleService.annotations | nindent 4 }}
  {{- end }}
spec:
  type: {{ .Values.consoleService.type }}
  {{- if and (eq .Values.consoleService.type "ClusterIP") .Values.consoleService.clusterIP }}
  clusterIP: {{ .Values.consoleService.clusterIP }}
  {{- end }}
  {{- if or (eq .Values.consoleService.type "LoadBalancer") (eq .Values.consoleService.type "NodePort") }}

  annotations: {{- toYaml .Values.service.annotations | nindent 4 }}
  {{- end }}
spec:
  type: {{ .Values.service.type }}
  {{- if and (eq .Values.service.type "ClusterIP") .Values.service.clusterIP }}
  clusterIP: {{ .Values.service.clusterIP }}
  {{- end }}
  {{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") }}
  externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }}

spiffe://cluster.local/ns/istio-system/sa/istiod         Leaf     Available        true           e5dfb59150b2ba7f108d93dcec5aa613     2033-03-22T13:04:57Z     2023-03-21T13:02:57Z
spiffe://cluster.local/ns/istio-system/sa/istiod         Root     Available        false          8a516645c40ce76c2c0d27ab4e2461c1     2022-03-18T13:04:49Z     2022-03-21T13:04:49Z