apiVersion: v1
kind: Service
metadata:
  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Release.Namespace }}
  {{- if .Values.pilot.serviceAnnotations }}
  annotations:
{{ toYaml .Values.pilot.serviceAnnotations | indent 4 }}
  {{- end }}
  labels:
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}

		return
	}
	n := nn.(*ir.CallExpr)
	if n.Fun == nil || n.Fun.Op() != ir.ONAME {
		return
	}
	fn := n.Fun.(*ir.Name)
	if fn.Class != ir.PFUNC || fn.Defn == nil {
		return
	}
	if types.RuntimeSymName(fn.Sym()) != "systemstack" {
		return
	}

	var callee *ir.Func
	arg := n.Args[0]
	switch arg.Op() {
	case ir.ONAME:
		arg := arg.(*ir.Name)
		callee = arg.Defn.(*ir.Func)
	case ir.OCLOSURE:

    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
    {{ end }}
  }
spec:
  securityContext:
  {{- if .Values.gateways.securityContext }}
    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
  {{- else }}
    sysctls:
    - name: net.ipv4.ip_unprivileged_port_start
      value: "0"
  {{- end }}
  containers:
  - name: istio-proxy

    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
    {{ end }}
  }
spec:
  securityContext:
  {{- if .Values.gateways.securityContext }}
    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
  {{- else }}
    sysctls:
    - name: net.ipv4.ip_unprivileged_port_start
      value: "0"
  {{- end }}
  containers:
  - name: istio-proxy