{{- end }}
        runAsNonRoot: true
{{- end }}
      serviceAccountName: {{ $gateway.name | default "istio-ingressgateway" }}-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      containers:
        - name: istio-proxy
          image: auto
{{- if .Values.global.imagePullPolicy }}

{{- end }}
        runAsNonRoot: true
{{- end }}
      serviceAccountName: {{ $gateway.name | default "istio-egressgateway" }}-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      containers:
        - name: istio-proxy
          image: auto
{{- if .Values.global.imagePullPolicy }}

      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
      {{- with .Values.priorityClassName }}
      priorityClassName: {{ . }}

        runAsUser: 1337
        runAsGroup: 1337
{{- end }}
        runAsNonRoot: true
{{- end }}
      serviceAccountName: {{ $gateway.name }}-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
{{- if .Values.global.proxy.enableCoreDump }}
      initContainers:
        - name: enable-core-dump
{{- if contains "/" .Values.global.proxy.image }}

  # will not be killed because of low priority class.
  # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
  # for more detail.

```

Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
'system-node-critical' outside of kube-system.

## Configuration

To view support configuration options and documentation, run:

            "type": "object"
          }
        },
        "volumeMounts": {
          "type": "array",
          "items": {
            "type": "object"
          }
        },
        "priorityClassName": {
          "type": "string"
        }
      }
    }
  },
  "defaults": {
    "$ref": "#/$defs/values"
  },
  "$ref": "#/$defs/values"

    # will not be killed because of low priority class.
    # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
    # for more detail.
    priorityClassName: ""

    proxy:
      image: proxyv2

      # This controls the 'policy' in the sidecar injector.
      autoInject: enabled

{{- toYaml . | nindent 8 }}
{{- end }}
      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
      containers:
        - name: discovery
{{- if contains "/" .Values.pilot.image }}
          image: "{{ .Values.pilot.image }}"
{{- else }}

securityContext: {{- if not (eq .Values.global.platform "openshift") }} runAsUser: 1337 runAsGroup: 1337 {{- end }} runAsNonRoot: true {{- end }} serviceAccountName: {{ $gateway.name }}-service-account {{- if .Values.global.priorityClassName }} priorityClassName: "{{ .Values.global.priorityClassName }}" {{- end }} {{- if .Values.global.proxy.enableCoreDump }} initContainers: - name: enable-core-dump {{- if contains "/" .Values.global.proxy.image }} image: "{{ .Values.global.proxy.image }}" {{- else }} image:...