To override a setting that includes dots, escape them with a backslash (\).  Your shell may require enclosing quotes.

``` bash
istioctl manifest generate --set "values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy=runtime/default"
```

  //
  // +featureGate=SELinuxMountReadWriteOncePod
  // +optional
  optional bool seLinuxMount = 8;
}

// DEPRECATED - This group version of CSINode is deprecated by storage/v1/CSINode.
// See the release notes for more information.
// CSINode holds information about all CSI drivers installed on a node.
// CSI drivers do not need to create the CSINode object directly. As long as

        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "refId": "A"
        }
      ],
      "title": "Performance Dashboard Notes",
      "type": "row"
    },
    {
      "gridPos": {
        "h": 6,
        "w": 24,
        "x": 0,
        "y": 1
      },
      "id": 19,
      "links": [],
      "options": {

  // 	  :443 for https.
  // Both these may change in the future.
  // Incoming requests are matched against the host before the
  // IngressRuleValue. If the host is unspecified, the Ingress routes all
  // traffic based on the specified IngressRuleValue.
  //
  // Host can be "precise" which is a domain name without the terminating dot of
  // a network host (e.g. "foo.bar.com") or "wildcard", which is a domain name

      # TODO: convert to real options, env should not be exposed
      env: {}
        # Set this to "external" if and only if you want the egress gateway to
        # act as a transparent SNI gateway that routes mTLS/TLS traffic to
        # external services defined using service entries, where the service
        # entry has resolution set to DNS, has one or more endpoints with

            {{- end }}
            - containerPort: 15090
              protocol: TCP
              name: http-envoy-prom
          args:
          - proxy
          - router
          - --domain
          - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
        {{- if .Values.global.proxy.logLevel }}
          - --proxyLogLevel={{ .Values.global.proxy.logLevel }}