{{- end }}
    spec:
      restartPolicy: OnFailure
      {{- include "minio.imagePullSecrets" . | indent 6 }}
      {{- if .Values.nodeSelector }}
      nodeSelector: {{- toYaml .Values.postJob.nodeSelector | nindent 8 }}
      {{- end }}
      {{- with .Values.postJob.affinity }}
      affinity: {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.postJob.tolerations }}

          resources: {{- toYaml .Values.resources | nindent 12 }}
        {{- with .Values.extraContainers }}
          {{- if eq (typeOf .) "string" }}
            {{- tpl . $ | nindent 8 }}
          {{- else }}
            {{- toYaml . | nindent 8 }}
          {{- end }}
        {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector: {{- toYaml . | nindent 8 }}
      {{- end }}

          {{- if eq (typeOf .) "string" }}
            {{- tpl . $ | nindent 8 }}
          {{- else }}
            {{- toYaml . | nindent 8 }}
          {{- end }}
        {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector: {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- include "minio.imagePullSecrets" . | indent 6 }}
      {{- with .Values.affinity }}

data:
  initialize: |-
    {{- include (print $.Template.BasePath "/_helper_create_bucket.txt") . | nindent 4 }}
  add-user: |-
    {{- include (print $.Template.BasePath "/_helper_create_user.txt") . | nindent 4 }}
  add-policy: |-
    {{- include (print $.Template.BasePath "/_helper_create_policy.txt") . | nindent 4 }}
  {{- range $idx, $policy := .Values.policies }}
  # Policy: {{ $policy.name }}
  policy_{{ $idx }}.json: |-

            {{- toYaml .Values.resources | nindent 12 }}
          {{- with .Values.volumeMounts }}
          volumeMounts:
            {{ toYaml . | nindent 12 }}
          {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}

  name: {{ include "gateway.name" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "gateway.labels" . | nindent 4 }}
    {{- with .Values.networkGateway }}
    topology.istio.io/network: "{{.}}"
    {{- end }}
  annotations:
    {{- merge (deepCopy .Values.service.annotations) .Values.annotations | toYaml | nindent 4 }}
spec:
{{- with .Values.service.loadBalancerIP }}
  loadBalancerIP: "{{ . }}"
{{- end }}

apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "gateway.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "gateway.labels" . | nindent 4 }}
  {{- with .Values.serviceAccount.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ include "gateway.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "gateway.labels" . | nindent 4}}
  annotations:
    {{- .Values.annotations | toYaml | nindent 4 }}
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:

      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}

        app: ztunnel
{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
      annotations:
        sidecar.istio.io/inject: "false"
{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
    spec:
      nodeSelector:
        kubernetes.io/os: linux
{{- if .Values.nodeSelector }}
{{ toYaml .Values.nodeSelector | indent 8 }}
{{- end }}
{{- if .Values.affinity }}
      affinity: