defaults:
  global:

    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
    # to use for pulling any images in pods that reference this ServiceAccount.
    # Must be set for any cluster configured with private docker registry.
    imagePullSecrets: []

    # Used to locate istiod.
    istioNamespace: istio-system

    externalIstiod: false
    remotePilotAddress: ""

}

// ImageReviewContainerSpec is a description of a container within the pod creation request.
message ImageReviewContainerSpec {
  // This can be in the form image:tag or image@SHA:012345679abcdef.
  // +optional
  optional string image = 1;
}

// ImageReviewSpec is a description of the pod creation request.
message ImageReviewSpec {

  // More info: https://kubernetes.io/docs/concepts/containers/images.
  optional string image = 6;

  // ImageID is the image ID of the container's image. The image ID may not
  // match the image ID of the image used in the PodSpec, as it may have been
  // resolved by the runtime.
  optional string imageID = 7;

  // ContainerID is the ID of the container in the format '<type>://<container_id>'.

    # Default hub for Istio images.
    # Releases are published to docker hub under 'istio' project.
    # Dev builds from prow are on gcr.io
    hub: gcr.io/istio-testing

    # Default tag for Istio images.
    tag: latest

    # Variant of the image to use.
    # Currently supported are: [debug, distroless]
    variant: ""

    # Specify image pull policy if default behavior isn't desired.

    defaultTolerations: []

    # Default hub for Istio images.
    # Releases are published to docker hub under 'istio' project.
    # Dev builds from prow are on gcr.io
    hub: gcr.io/istio-testing

    # Default tag for Istio images.
    tag: latest

    # Specify image pull policy if default behavior isn't desired.
    # Default behavior: latest images will be Always else IfNotPresent.
    imagePullPolicy: ""

  topologySpreadConstraints: []

  affinity: {}

  # If specified, the gateway will act as a network gateway for the given network.
  networkGateway: ""

  # Specify image pull policy if default behavior isn't desired.
  # Default behavior: latest images will be Always else IfNotPresent
  imagePullPolicy: ""

  imagePullSecrets: []

  # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway.
  #

env | [container environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
imagePullPolicy| [ImagePullPolicy](https://kubernetes.io/docs/concepts/containers/images/)
priorityClassName | [priority class name](https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass)

# Create targets for TARGET_OUT_LINUX/binary
# There are two use cases here:
# * Building all docker images (generally in CI). In this case we want to build everything at once, so they share work
# * Building a single docker image (generally during dev). In this case we just want to build the single binary alone
BUILD_ALL ?= true
define build-linux

spec:
  initContainers:
  - name: istio-init
    image: docker.io/istio/proxy_init:unittest-{{.Values.global.suffix}}
  containers:
  - name: istio-proxy

  {{ else -}}
  - name: istio-init
  {{ end -}}
  {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }}
    image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}"
  {{- else }}
    image: "{{ .ProxyImage }}"
  {{- end }}
    args:
    - istio-iptables
    - "-p"
    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}