PILOT_ENABLE_SENDING_HBONE: "true"
    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
    CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
platform: openshift
variant: distroless
seLinuxOptions:

    PILOT_ENABLE_SENDING_HBONE: "true"
    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
    CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
platform: openshift
variant: distroless
seLinuxOptions:

      ipFamilies: []

      # To generate an internal load balancer:
      # --set serviceAnnotations.cloud.google.com/load-balancer-type=internal
      #serviceAnnotations:
      #    cloud.google.com/load-balancer-type: "internal"

      podAnnotations: {}
      type: LoadBalancer #change to NodePort, ClusterIP or LoadBalancer if need be

      ##############
      secretVolumes:
      - name: ingressgateway-certs

              audience: istio-ca
      - name: istiod-ca-cert
        configMap:
          name: istio-ca-root-cert
      - name: cni-ztunnel-sock-dir
        hostPath:
          path: /var/run/ztunnel
          type: DirectoryOrCreate # ideally this would be a socket, but ztunnel may not have started yet.
      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one
      - name: tmp

          cpu: 2000m
          memory: 1024Mi
      cpu:
        targetAverageUtilization: 80
      memory: {}
        # targetAverageUtilization: 80

      serviceAnnotations: {}
      podAnnotations: {}
      type: ClusterIP # change to NodePort or LoadBalancer if need be

      # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
      ipFamilyPolicy: ""