sidecar.istio.io/inject: "true"

  # Define the security context for the pod.
  # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
  # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
  securityContext: ~
  containerSecurityContext: ~

  service:
    # Type of service. Set to "None" to disable the service entirely

    configValidation: true

    # Mesh ID means Mesh Identifier. It should be unique within the scope where
    # meshes will interact with each other, but it is not required to be
    # globally/universally unique. For example, if any of the following are true,
    # then two meshes must have different Mesh IDs:
    # - Meshes will have their telemetry aggregated in one place

      # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
      # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
      repairPods: true

      initContainerName: "istio-validation"

      brokenPodLabelKey: "cni.istio.io/uninitialized"
      brokenPodLabelValue: "true"

    configValidation: true
    # Mesh ID means Mesh Identifier. It should be unique within the scope where
    # meshes will interact with each other, but it is not required to be
    # globally/universally unique. For example, if any of the following are true,
    # then two meshes must have different Mesh IDs:
    # - Meshes will have their telemetry aggregated in one place

      # podAntiAffinityLabelSelector:
      # - key: security
      #   operator: In
      #   values: S1,S2
      #   topologyKey: "kubernetes.io/hostname"
      # This pod anti-affinity rule says that the pod requires not to be scheduled
      # onto a node if that node is already running a pod with label having key
      # "security" and value "S1".
      podAntiAffinityLabelSelector: []
      podAntiAffinityTermLabelSelector: []

      # podAntiAffinityLabelSelector:
      # - key: security
      #   operator: In
      #   values: S1,S2
      #   topologyKey: "kubernetes.io/hostname"
      # This pod anti-affinity rule says that the pod requires not to be scheduled
      # onto a node if that node is already running a pod with label having key
      # "security" and value "S1".
      podAntiAffinityLabelSelector: []
      podAntiAffinityTermLabelSelector: []

  annotations: {}

  # Additional volumeMounts to the ztunnel container
  volumeMounts: []

  # Additional volumes to the ztunnel pod
  volumes: []

  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
  podAnnotations:
    prometheus.io/port: "15020"
    prometheus.io/scrape: "true"

  # Additional labels to apply on the pod level
  podLabels: {}

## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
##
persistence:
  enabled: true
  annotations: {}

  ## A manually managed Persistent Volume and Claim
  ## Requires persistence.enabled: true
  ## If defined, PVC must be created manually before volume will be bound
  existingClaim: ""

  ## minio data Persistent Volume Storage Class
  ## If defined, storageClassName: <storageClass>