- --log_as_json
  {{- end }}
    lifecycle:
      postStart:
        exec:
          command:
          - pilot-agent
          - wait
          - --url=http://localhost:15020/healthz/ready
    env:
    - name: ISTIO_META_GENERATOR
      value: grpc
    - name: OUTPUT_CERTS
      value: /var/lib/istio/data
    {{- if eq .InboundTrafficPolicyMode "localhost" }}

    startupProbe:
      httpGet:
        path: /healthz/ready
        port: 15021
      initialDelaySeconds: 0
      periodSeconds: 1
      timeoutSeconds: 3
      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
  {{ end }}
    readinessProbe:
      httpGet:
        path: /healthz/ready
        port: 15021

    startupProbe:
      httpGet:
        path: /healthz/ready
        port: 15021
      initialDelaySeconds: 0
      periodSeconds: 1
      timeoutSeconds: 3
      failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }}
  {{ end }}
    readinessProbe:
      httpGet:
        path: /healthz/ready
        port: 15021

    # Disable webhook controller in Pilot to stop patching it
    failurePolicy: Fail
    {{- else }}
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `Fail` and patch in the `caBundle` when the webhook
    # endpoint is ready.
    failurePolicy: Ignore
    {{- end }}
    sideEffects: None
    admissionReviewVersions: ["v1beta1", "v1"]

    # Disable webhook controller in Pilot to stop patching it
    failurePolicy: Fail
    {{- else }}
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `Fail` and patch in the `caBundle` when the webhook
    # endpoint is ready.
    failurePolicy: Ignore
    {{- end }}
    sideEffects: None
    admissionReviewVersions: ["v1beta1", "v1"]
    objectSelector:
      matchExpressions:

telemetry.istio.io - extensions.istio.io {{- if .Values.base.validateGateway }} - gateway.networking.k8s.io {{- end }} apiVersions: - "*" resources: - "*" # Fail open until the validation webhook is ready. The webhook controller # will update this to `Fail` and patch in the `caBundle` when the webhook # endpoint is ready. failurePolicy: Ignore sideEffects: None admissionReviewVersi: ["v1beta1", "v1"] {{- end }} manifests/charts/base/files/profile-preview.yaml # The preview profile contains features that are...

  namespace: {{ .Values.global.istioNamespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
rules:
# permissions to verify the webhook is ready and rejecting
# invalid config. We use --server-dry-run so no config is persisted.
- apiGroups: ["networking.istio.io"]
  verbs: ["create"]
  resources: ["gateways"]

# For storing CA secret
- apiGroups: [""]

                                http1MaxPendingRequests:
                                  description: Maximum number of requests that will
                                    be queued while waiting for a ready connection
                                    pool connection.
                                  format: int32
                                  type: integer
                                http2MaxRequests:

      provider: default
    # Additional container arguments
    extraContainerArgs: []
    env: {}
    # Settings related to the untaint controller
    # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
    # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes

      labelPods: false
      # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
      # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
      deletePods: false