- name: INSTANCE_IP
      valueFrom:
        fieldRef:
          fieldPath: status.podIP
    - name: SERVICE_ACCOUNT
      valueFrom:
        fieldRef:
          fieldPath: spec.serviceAccountName
    - name: HOST_IP
      valueFrom:
        fieldRef:
          fieldPath: status.hostIP
    - name: ISTIO_CPU_LIMIT
      valueFrom:
        resourceFieldRef:
          resource: limits.cpu
    - name: PROXY_CONFIG

NAME        VHOST NAME                 DOMAINS                 MATCH                  VIRTUAL SERVICE
http.80     httpbin.example.com:80     httpbin.example.com     PathPrefix:/get        http-0-istio-autogenerated-k8s-gateway.default
            backend                    *                       /healthz/ready*        

  // requirements.
  // +optional
  optional string nodeName = 10;

  // Host networking requested for this carp. Use the host's network namespace.
  // If this option is set, the ports that will be used must be specified.
  // Default to false.
  // +k8s:conversion-gen=false
  // +optional
  optional bool hostNetwork = 11;

  // Use the host's pid namespace.
  // Optional: Default to false.
  // +k8s:conversion-gen=false

      containers:
        - name: istio-operator
          image: {{.Values.hub}}/operator:{{.Values.tag}}
          command:
          - operator
          - server
          - --monitoring-host={{ .Values.operator.monitoring.host }}
          - --monitoring-port={{ .Values.operator.monitoring.port }}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:

  // perNodeHostBits defines the number of host bits to be configured per node.
  // A subnet mask determines how much of the address is used for network bits
  // and host bits. For example an IPv4 address of 192.168.0.0/24, splits the
  // address into 24 bits for the network portion and 8 bits for the host portion.
  // To allocate 256 IPs, set this field to 8 (a /24 mask for IPv4 or a /120 for IPv6).

  # and manipulation.
  # The "TPROXY" mode also configures the sidecar to run with the
  # CAP_NET_ADMIN capability, which is required to use TPROXY.
  #interceptionMode: REDIRECT
  #
  # Port where Envoy listens (on local host) for admin commands
  # You can exec into the istio-proxy container in a pod and
  # curl the admin port (curl http://localhost:15000/) to obtain
  # diagnostic information from Envoy. See

		expectedFailure    bool
		k8sServiceProtocol string
		k8sServiceHost     string
		k8sServicePort     string
		kubeCAFilepath     string
		skipTLSVerify      bool
	}{
		{
			name:            "k8s service host not set",
			expectedFailure: true,
		},
		{
			name:            "k8s service port not set",
			expectedFailure: true,
			k8sServiceHost:  k8sServiceHost,
		},
		{
			name:           "skip TLS verify",

      {{- else if eq .Values.global.proxy.tracer "datadog" }}
        datadog:
          # Address of the Datadog Agent
          address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
        stackdriver:
          # enables trace output to stdout.
          debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}

    - name: INSTANCE_IP
      valueFrom:
        fieldRef:
          fieldPath: status.podIP
    - name: SERVICE_ACCOUNT
      valueFrom:
        fieldRef:
          fieldPath: spec.serviceAccountName
    - name: HOST_IP
      valueFrom:
        fieldRef:
          fieldPath: status.hostIP
    - name: ISTIO_CPU_LIMIT
      valueFrom:
        resourceFieldRef:
          resource: limits.cpu
    - name: PROXY_CONFIG

                        "num_retries": 2,
                        "retry_host_predicate": [
                          {
                            "name": "envoy.retry_host_predicates.previous_hosts"
                          }
                        ],
                        "host_selection_retry_max_attempts": "5",
                        "retriable_status_codes": [
                          503