// Defaults to false.
  // +optional
  optional bool readOnly = 6;

  // portals is the iSCSI Target Portal List. The Portal is either an IP or ip_addr:port if the port
  // is other than default (typically TCP ports 860 and 3260).
  // +optional
  repeated string portals = 7;

  // chapAuthDiscovery defines whether support iSCSI Discovery CHAP authentication
  // +optional

    autoscaleEnabled: false
    resources:
      requests:
        cpu: 10m
        memory: 40Mi
  istio-ingressgateway:
    autoscaleEnabled: false
    ports:
    ## You can add custom gateway ports in user values overrides, but it must include those ports since helm replaces.
    # Note that AWS ELB will by default perform health checks on the first port
    # on this list. Setting this to the health check port will ensure that health

					ObjectMeta: metav1.ObjectMeta{
						Name:      "productpage",
						Namespace: "default",
					},
					Spec: corev1.ServiceSpec{
						Selector: map[string]string{
							"app": "productpage",
						},
						Ports: []corev1.ServicePort{
							{
								Name:       "http",
								Port:       9080,
								TargetPort: intstr.FromInt32(9080),
							},
						},
					},
				},
				&corev1.Service{

CANONICAL_REVISION='latest'
CANONICAL_SERVICE='foo'
ISTIO_INBOUND_PORTS='*'
ISTIO_LOCAL_EXCLUDE_PORTS='22,15090,15021,15020'
ISTIO_METAJSON_LABELS='{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
ISTIO_META_CLUSTER_ID='Kubernetes'
ISTIO_META_DNS_CAPTURE='true'
ISTIO_META_MESH_ID=''
ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'
ISTIO_NAMESPACE='bar'
ISTIO_SERVICE='foo.bar'
ISTIO_SERVICE_CIDR='*'

type ZtunnelService struct {
	Name      string         `json:"name"`
	Namespace string         `json:"namespace"`
	Hostname  string         `json:"hostname"`
	Addresses []string       `json:"addresses"`
	Ports     map[string]int `json:"ports"`
}

type ZtunnelDump struct {
	Workloads    map[string]*ZtunnelWorkload `json:"by_addr"`
	Services     map[string]*ZtunnelService  `json:"by_vip"`

		Annotations:       pod.Annotations,
		ProxyEnvironments: make(map[string]string),
	}
	for _, c := range containers(pod) {
		pi.Containers.Insert(c.Name)
		if c.Name == ISTIOPROXY {
			// don't include ports from istio-proxy in the redirect ports
			// Get proxy container env variable, and extract out ProxyConfig from it.
			for _, e := range c.Env {
				pi.ProxyEnvironments[e.Name] = e.Value
			}
			if len(c.Args) >= 2 && c.Args[0] == "proxy" {

COMMIT
* nat
-N ISTIO_INBOUND
-N ISTIO_REDIRECT
-N ISTIO_IN_REDIRECT
-N ISTIO_OUTPUT
-A ISTIO_INBOUND -p tcp --dport 15008 -j RETURN
-A ISTIO_REDIRECT -p tcp -j REDIRECT --to-ports 15001
-A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-ports 15006
-A OUTPUT -p tcp -j ISTIO_OUTPUT
-A ISTIO_OUTPUT -p tcp --dport 15020 -j RETURN
-A ISTIO_OUTPUT -o lo -s 127.0.0.6/32 -j RETURN

    annotations:
      proxy.istio.io/config: |-
        proxyMetadata:
          # this should override the value from the global meshconfig
          PROXY_CONFIG_ANNOT_VALUE: bar
    labels: {}
  template:
    ports: {}
    serviceAccount: vm-serviceaccount
  probe:
    httpGet:

apiVersion: v1
kind: Service
metadata:
  namespace: {{.Release.Namespace}}
  labels:
    name: istio-operator
  name: istio-operator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
spec:
  ports:
  - name: http-metrics
    port: 8383
    targetPort: 8383
    protocol: TCP
  selector:
    name: istio-operator

  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
spec:
  ports:
  - port: 15012
    name: tcp-istiod
    protocol: TCP
  - port: 443
    targetPort: 15017
    name: tcp-webhook
    protocol: TCP