runAsNonRoot: true
{{- if .Values.operator.seccompProfile }}
            seccompProfile:
{{ toYaml .Values.operator.seccompProfile | trim | indent 14 }}
{{- end }}
{{- if .Values.imagePullPolicy }}
          imagePullPolicy: {{ .Values.imagePullPolicy }}
{{- end }}
          resources:
{{ toYaml .Values.operator.resources | trim | indent 12 }}
          env:
            - name: WATCH_NAMESPACE

{{- end }}
{{- if .Values.global.imagePullPolicy }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
{{- end }}
          command:
            - /bin/sh
          args:
            - -c

      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      containers:
        - name: istio-proxy
          image: auto
{{- if .Values.global.imagePullPolicy }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
{{- end }}
          ports:
            {{- range $key, $val := $gateway.ports }}
            - containerPort: {{ $val.targetPort | default $val.port }}

      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      containers:
        - name: istio-proxy
          image: auto
{{- if .Values.global.imagePullPolicy }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
{{- end }}
          ports:
            {{- range $key, $val := $gateway.ports }}
            - containerPort: {{ $val.targetPort | default $val.port }}

          securityContext:
            runAsUser: {{ .Values.makePolicyJob.securityContext.runAsUser }}
            runAsGroup: {{ .Values.makePolicyJob.securityContext.runAsGroup }}
          {{- end }}
          imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
          {{- if .Values.makePolicyJob.exitCommand }}
          command: [ "/bin/sh", "-c" ]

  # List of secret names to add to the service account as image pull secrets
  imagePullSecrets: []

  # A `key: value` mapping of environment variables to add to the pod
  env: {}

  # Override for the pod imagePullPolicy
  imagePullPolicy: ""

  # Settings for multicluster
  multiCluster:
    # The name of the cluster we are installing in. Note this is a user-defined name, which must be consistent
    # with Istiod configuration.

{{- end }}
{{- if .Values.global.imagePullPolicy }}
          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
{{- end }}
          args:
          - "discovery"
          - --monitoringAddr=:15014
{{- if .Values.global.logging.level }}

    - "--log_as_json"
    {{ end -}}
    {{ if or .Values.pilot.cni.enabled .Values.istio_cni.enabled -}}
    - "--run-validation"
    - "--skip-rule-apply"
    {{ end -}}
    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
  {{- if .ProxyConfig.ProxyMetadata }}
    env:
    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
    - name: {{ $key }}
      value: "{{ $value }}"
    {{- end }}

    - "--log_as_json"
    {{ end -}}
    {{ if or .Values.pilot.cni.enabled .Values.istio_cni.enabled -}}
    - "--run-validation"
    - "--skip-rule-apply"
    {{ end -}}
    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
  {{- if .ProxyConfig.ProxyMetadata }}
    env:
    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
    - name: {{ $key }}
      value: "{{ $value }}"
    {{- end }}

          name: ztunnel-stats
          protocol: TCP
        resources:
{{- if .Values.resources }}
{{ toYaml .Values.resources | trim | indent 10 }}
{{- end }}
{{- with .Values.imagePullPolicy }}
        imagePullPolicy: {{ . }}
{{- end }}
        securityContext:
          allowPrivilegeEscalation: false
          privileged: false
          capabilities:
            drop:
            - ALL