// valid against the audience of the Kubernetes API server.
  // +optional
  repeated string audiences = 4;

  // Error indicates that the token couldn't be checked
  // +optional
  optional string error = 3;
}

// UserInfo holds the information about the user needed to implement the
// user.Info interface.
message UserInfo {

  {{- else }}
  - emptyDir:
    name: workload-certs
  {{- end }}
  {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }}
  - name: custom-bootstrap-volume
    configMap:
      name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }}
  {{- end }}
  # SDS channel between istioagent and Envoy
  - emptyDir:
      medium: Memory
    name: istio-xds

    #     gateways:
    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
    #       port: 443
    #
    meshNetworks: {}

    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
    mountMtlsCerts: false

    multiCluster:
      # Set to true to connect two kubernetes clusters via their respective

                  required:
                  - hosts
                  type: object
                type: array
              inboundConnectionPool:
                description: Settings controlling the volume of connections Envoy
                  will accept from the network.
                properties:
                  http:
                    description: HTTP connection pool settings.

          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A",
          "step": 4
        }
      ],
      "title": "Client Request Volume",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {

message VolumeAttachmentSpec {
  // attacher indicates the name of the volume driver that MUST handle this
  // request. This is the name returned by GetPluginName().
  optional string attacher = 1;

  // source represents the volume that should be attached.
  optional VolumeAttachmentSource source = 2;

  // nodeName represents the node that the volume should be attached to.
  optional string nodeName = 3;
}

  // fsGroupPolicy defines if the underlying volume supports changing ownership and
  // permission of the volume before being mounted.
  // Refer to the specific FSGroupPolicy values for additional details.
  //
  // This field is immutable.
  //
  // Defaults to ReadWriteOnceWithFSType, which will examine each volume
  // to determine if Kubernetes should modify ownership and permissions of the volume.

    --mount "type=bind,source=${MOUNT_SOURCE},destination=/work" \
    --mount "type=volume,source=go,destination=/go" \
    --mount "type=volume,source=gocache,destination=/gocache" \
    --mount "type=volume,source=cache,destination=/home/.cache" \
    --mount "type=volume,source=crates,destination=/home/.cargo/registry" \
    --mount "type=volume,source=git-crates,destination=/home/.cargo/git" \
    ${CONDITIONAL_HOST_MOUNTS} \

          - name: workload-certs
            mountPath: /var/run/secrets/workload-spiffe-credentials
          - name: istio-envoy
            mountPath: /etc/istio/proxy
          - name: config-volume
            mountPath: /etc/istio/config
{{- if eq .Values.global.pilotCertProvider "istiod" }}
          - mountPath: /var/run/secrets/istio
            name: istiod-ca-cert
{{- end }}
          - name: istio-token

            value:
              configMap:
                name: my-config-map
              name: my-volume-name
          - path: 'spec.template.spec.containers[0].volumeMounts[100]'
            value:
              mountPath: /mnt/path1
              name: my-volume-name
        - kind: Service
          name: istio-pilot
          patches:
          - path: spec.ports.[name:grpc-xds].port