drop:
            - ALL
            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
            - NET_ADMIN # Required for TPROXY and setsockopt
            - SYS_ADMIN # Required for `setns` - doing things in other netns
            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
          readOnlyRootFilesystem: true
          runAsGroup: 1337
          runAsNonRoot: false
          runAsUser: 0

  provider: "multus"
pilot:
  cni:
    enabled: true
    provider: "multus"
  variant: distroless
  env:
    PILOT_ENABLE_AMBIENT: "true"
    # Allow sidecars/ingress to send/receive HBONE. This is required for interop.
    PILOT_ENABLE_SENDING_HBONE: "true"
    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
    CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
platform: openshift
variant: distroless

  provider: "multus"
pilot:
  cni:
    enabled: true
    provider: "multus"
  variant: distroless
  env:
    PILOT_ENABLE_AMBIENT: "true"
    # Allow sidecars/ingress to send/receive HBONE. This is required for interop.
    PILOT_ENABLE_SENDING_HBONE: "true"
    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
    CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
platform: openshift
variant: distroless

  annotations: {}

  # Additional volumeMounts to the ztunnel container
  volumeMounts: []

  # Additional volumes to the ztunnel pod
  volumes: []

  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
  podAnnotations:
    prometheus.io/port: "15020"
    prometheus.io/scrape: "true"

  # Additional labels to apply on the pod level
  podLabels: {}

    # Used to locate istiod.
    istioNamespace: istio-system

    # Mesh ID means Mesh Identifier. It should be unique within the scope where
    # meshes will interact with each other, but it is not required to be
    # globally/universally unique. For example, if any of the following are true,
    # then two meshes must have different Mesh IDs:
    # - Meshes will have their telemetry aggregated in one place

    # Used to locate istiod.
    istioNamespace: istio-system

    # Mesh ID means Mesh Identifier. It should be unique within the scope where
    # meshes will interact with each other, but it is not required to be
    # globally/universally unique. For example, if any of the following are true,
    # then two meshes must have different Mesh IDs:
    # - Meshes will have their telemetry aggregated in one place

      {{- end }}
    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".
         This should make it obvious that their installation is broken.
     */}}
    template: {{ `{{ Template_Version_And_Istio_Version_Mismatched_Check_Installation }}` | quote }}