{{- else }}
    image: "{{ .ProxyImage }}"
  {{- end }}
    ports:
    - containerPort: 15090
      protocol: TCP
      name: http-envoy-prom
    args:
    - proxy
    - router
    - --domain
    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}

            {{- end }}
            - containerPort: 15090
              protocol: TCP
              name: http-envoy-prom
          args:
          - proxy
          - router
          - --domain
          - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
        {{- if .Values.global.proxy.logLevel }}
          - --proxyLogLevel={{ .Values.global.proxy.logLevel }}

        - containerPort: 15021
          name: status-port
          protocol: TCP
        - containerPort: 15090
          protocol: TCP
          name: http-envoy-prom
        args:
        - proxy
        - router
        - --domain
        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
        - --proxyLogLevel

  {{ $prom := include "default-prometheus" . | eq "true" }}
  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
  {{- if or $prom $sdMetrics $sdLogs }}
    defaultProviders:
    {{- if or $prom $sdMetrics }}
      metrics:
      {{ if $prom }}- prometheus{{ end }}

    prometheus.io/scrape: "true"
    prometheus.io/path: "/stats/prometheus"
    inject.istio.io/templates: "gateway"
    sidecar.istio.io/inject: "true"

  # Define the security context for the pod.
  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
  securityContext: ~

          - name: {{ $key }}
            value: {{ $val | quote }}
          {{- end }}
          ports:
          - containerPort: 15090
            protocol: TCP
            name: http-envoy-prom
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          {{- with .Values.volumeMounts }}
          volumeMounts:
            {{ toYaml . | nindent 12 }}
          {{- end }}

    verbs: ["update"]
    # TODO: should be on just */status but wildcard is not supported
    resources: ["*"]

  # Needed because status reporter sets the config map owner reference to the istiod pod
  - apiGroups: [""]
    verbs: ["update"]
    resources: ["pods/finalizers"]
{{- end }}
  - apiGroups: ["networking.istio.io"]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]

              workload for bootstrap and provides a template for `WorkloadEntry`,
              similar to how `Deployment` specifies properties of workloads via `Pod`
              templates.'
            properties:
              metadata:
                description: Metadata that will be used for all corresponding `WorkloadEntries`.
                properties:

  # Speed up scraping a bit from the default
  global:
    scrape_interval: 15s

  # Match legacy addon deployment
  fullnameOverride: prometheus

  # use dockerhub
  image:
    repository: prom/prometheus

  securityContext: null

configmapReload:
  prometheus:
    image:
      # Use ghcr

leaf namespace. rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }} {{ $prom := include "default-prometheus" . | eq "true" }} {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }} {{ $sdLogs := include "default-sd-logs" . | eq "true" }} {{- if or $prom $sdMetrics $sdLogs }} defaultProviders: {{- if or $prom $sdMetrics }} metrics: {{ if $prom }}- prometheus{{ end }} {{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }} {{- end }} {{- if and $sdMetrics...