{{ end }}
        {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}}
        memory: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` }}"
        {{ end }}
    {{- end }}
  {{- else }}
    {{- if .Values.global.proxy.resources }}
      {{ toYaml .Values.global.proxy.resources | indent 6 }}
    {{- end }}
  {{- end }}
{{- end }}
{{- $containers := list }}

  type: ExternalName
  externalName: {{ .Values.global.remotePilotAddress }}
  {{- end }}
{{- if .Values.global.ipFamilyPolicy }}
  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
{{- end }}
{{- if .Values.global.ipFamilies }}
  ipFamilies:
{{- range .Values.global.ipFamilies }}
  - {{ . }}
{{- end }}
{{- end }}
---

          type: Utilization
    {{- end }}
    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
    - type: Resource
      resource:
        name: memory
        target:
          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
          type: Utilization
    {{- end }}
  {{- if .Values.autoscaling.autoscaleBehavior }}

      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
      namespace: {{ .namespace }}
      path: "{{ .injectionPath }}"
      port: 443
    {{- end }}
  sideEffects: None
  rules:
  - operations: [ "CREATE" ]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
  failurePolicy: Fail
  admissionReviewVersions: ["v1beta1", "v1"]
{{- end }}
{{- range $tagName := $.Values.revisionTags }}

{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
{{- if not (eq $res "")}}
WARNING: {{$dep|quote}} is deprecated; use {{$replace|quote}} instead.
{{- end }}
{{- end }}
{{-
  $failDeps := dict
    "telemetry.v2.prometheus.configOverride"
    "telemetry.v2.stackdriver.configOverride"
    "telemetry.v2.stackdriver.disableOutbound"

  minAvailable: 1
  selector:
    matchLabels:
      app: istiod
      {{- if ne .Values.revision "" }}
      istio.io/rev: {{ .Values.revision | quote }}
      {{- else }}
      istio: pilot
      {{- end }}
---

      {{ $pkey}}: {{ $pval }}
      {{- end }}
    {{- end }}

  {{ range $app := $gateway.egressPorts }}
    -
      port: {{ $app.port }}
      name: {{ $app.name }}
  {{- end }}
{{- if $gateway.ipFamilyPolicy }}
  ipFamilyPolicy: {{ $gateway.ipFamilyPolicy }}
{{- end }}
{{- if $gateway.ipFamilies }}
  ipFamilies:
{{- range $gateway.ipFamilies }}
  - {{ . }}
{{- end }}
{{- end }}
---

        prometheus.io/path: "/stats/prometheus"
        {{- end }}
        sidecar.istio.io/inject: "false"
{{- if $gateway.podAnnotations }}
{{ toYaml $gateway.podAnnotations | indent 8 }}
{{ end }}
    spec:
{{- if not $gateway.runAsRoot }}
      securityContext:
{{- if not (eq .Values.global.platform "openshift") }}
        runAsUser: 1337
        runAsGroup: 1337
{{- end }}
        runAsNonRoot: true
{{- end }}

            runAsGroup: 1337
            {{- end }}
            runAsNonRoot: true
          {{- end }}
          env:
          {{- with .Values.networkGateway }}
          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
            value: "{{.}}"
          {{- end }}
          {{- range $key, $val := .Values.env }}
          - name: {{ $key }}
            value: {{ $val | quote }}
          {{- end }}
          ports:

          {{- range $index2, $p := $c.Ports }}
            {{- if (structToJSON $p) }}
            {{if not $first}},{{end}}{{ structToJSON $p }}
            {{- $first = false }}
            {{- end }}
          {{- end}}
        {{- end}}
        ]
    - name: GOMEMLIMIT
      valueFrom:
        resourceFieldRef:
          resource: limits.memory
    - name: GOMAXPROCS