{{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      terminationGracePeriodSeconds: {{ $.Values.terminationGracePeriodSeconds }}
      {{- with .Values.priorityClassName }}

      affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.pilot.tolerations }}
      tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.pilot.topologySpreadConstraints }}
      topologySpreadConstraints:
{{- toYaml . | nindent 8 }}
{{- end }}
      serviceAccountName: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
{{- if .Values.global.priorityClassName }}

      {{- end }}
      {{- if and (gt $replicas 1) (ge .Capabilities.KubeVersion.Major "1") (ge .Capabilities.KubeVersion.Minor "19") }}
      {{- with .Values.topologySpreadConstraints }}
      topologySpreadConstraints: {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- end }}
      volumes:
        - name: minio-user
          secret:
            secretName: {{ template "minio.secretName" . }}

  env: {}

  # Labels to apply to all resources
  labels: {}

  # Annotations to apply to all resources
  annotations: {}

  nodeSelector: {}

  tolerations: []

  topologySpreadConstraints: []

  affinity: {}

  # If specified, the gateway will act as a network gateway for the given network.
  networkGateway: ""

  # Specify image pull policy if default behavior isn't desired.

          "properties": {
            "enabled": {
              "type": "boolean"
            }
          }
        },
        "tolerations": {
          "type": "array"
        },
        "topologySpreadConstraints": {
          "type": "array"
        },
        "networkGateway": {
          "type": "string"
        },
        "imagePullPolicy": {
          "type": "string",
          "enum": [

    volumeMounts: []
    # Additional volumes to the istiod pod
    volumes: []
    nodeSelector: {}
    podAnnotations: {}
    serviceAnnotations: {}
    serviceAccountAnnotations: {}
    topologySpreadConstraints: []
    # You can use jwksResolverExtraRootCA to provide a root certificate
    # in PEM format. This will then be trusted by pilot when resolving
    # JWKS URIs.
    jwksResolverExtraRootCA: ""

  #    hosts:
  #      - chart-example.local

## Node labels for pod assignment
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
##
nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints: []

## Add stateful containers to have security context, if enabled MinIO will run as this
## user and group NOTE: securityContext is only enabled if persistence.enabled=true
securityContext:
  enabled: true

    volumeMounts: []

    # Additional volumes to the istiod pod
    volumes: []

    nodeSelector: {}
    podAnnotations: {}
    serviceAnnotations: {}
    serviceAccountAnnotations: {}

    topologySpreadConstraints: []

    # You can use jwksResolverExtraRootCA to provide a root certificate
    # in PEM format. This will then be trusted by pilot when resolving
    # JWKS URIs.
    jwksResolverExtraRootCA: ""

- Forbid to set matchLabelKeys when labelSelector is not set in topologySpreadConstraints ([#116535](https://github.com/kubernetes/kubernetes/pull/116535), [@denkensk](https://github.com/denkensk))

  // +optional
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> overhead = 32;

  // TopologySpreadConstraints describes how a group of pods ought to spread across topology
  // domains. Scheduler will schedule pods in a way which abides by the constraints.
  // All topologySpreadConstraints are ANDed.
  // +optional
  // +patchMergeKey=topologyKey
  // +patchStrategy=merge
  // +listType=map