service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name  | quote }}

    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
    {{- end }}

    {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }}
    networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http"  | quote }}
    {{- end }}

{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
      annotations:
        sidecar.istio.io/inject: "false"
{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
    spec:
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: ztunnel
      tolerations:
        - effect: NoSchedule
          operator: Exists
        - key: CriticalAddonsOnly
          operator: Exists

        {{- end }}
        sidecar.istio.io/inject: "false"
        {{- if .Values.pilot.podAnnotations }}
{{ toYaml .Values.pilot.podAnnotations | indent 8 }}
        {{- end }}
    spec:
{{- if .Values.pilot.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.pilot.nodeSelector | indent 8 }}
{{- end }}
{{- with .Values.pilot.affinity }}
      affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
      tolerations:

              name: cni-ztunnel-sock-dir
            {{ end }}
          resources:
{{- if .Values.cni.resources }}
{{ toYaml .Values.cni.resources | trim | indent 12 }}
{{- else }}
{{ toYaml .Values.global.defaultResources | trim | indent 12 }}
{{- end }}
      volumes:
        # Used to install CNI.
        - name: cni-bin-dir
          hostPath:

  labels:
    {{- toJsonMap
      .InfrastructureLabels
      (strdict
        "gateway.networking.k8s.io/gateway-name" .Name
        "istio.io/gateway-name" .Name
      ) | nindent 4 }}
  {{- if ge .KubeVersion 128 }}
  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412

  labels:
    {{- toJsonMap
      .InfrastructureLabels
      (strdict
        "gateway.networking.k8s.io/gateway-name" .Name
        "istio.io/gateway-name" .Name
      ) | nindent 4 }}
  {{- if ge .KubeVersion 128 }}
  # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412

      - name: error-strings
      - name: error-naming
      - name: increment-decrement
      - name: var-naming
      - name: package-comments
      - name: range
      - name: receiver-naming
      - name: indent-error-flow
      - name: superfluous-else
      - name: modifies-parameter
      - name: unreachable-code
      - name: struct-tag
      - name: constant-logical-expr
      - name: bool-literal-in-expr

imagePullSecrets:
  {{- range . }}
  - name: {{ . }}
  {{- end }}
  {{- end }}
metadata:
  name: ztunnel
  namespace: {{ .Release.Namespace }}
  labels:
    {{- .Values.labels | toYaml | nindent 4}}
  annotations:
    {{- .Values.annotations | toYaml | nindent 4 }}
---
{{- if (eq .Values.platform "openshift") }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ztunnel
  labels:
    app: ztunnel