" # Can leave empty claimPrefix: "" comment: "" networkPolicy: enabled: false allowExternal: true ## PodDisruptionBudget settings ## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ ## podDisruptionBudget: enabled: false maxUnavailable: 1 ## Specify the service account to use for the MinIO pods. If 'create' is set to 'false' ## and 'name' is left unspecified, the account 'default' will be used. serviceAccount: create: true ## The name of the service account to use. If 'create'...

flavor: kubernetes allowExternal: true # only when using flavor: cilium egressEntities: - kube-apiserver ## PodDisruptionBudget settings ## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ ## podDisruptionBudget: enabled: false maxUnavailable: 1 ## Specify the service account to use for the MinIO pods. If 'create' is set to 'false' ## and 'name' is left unspecified, the account 'default' will be used. serviceAccount: create: true ## The name of the service account to use. If 'create'...

  resources:
  - leases
  verbs:
  - get
  - create
  - update
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - events
  - namespaces
  - pods
  - pods/proxy
  - pods/portforward
  - persistentvolumeclaims
  - secrets
  - services
  - serviceaccounts
  - resourcequotas
  verbs:
  - '*'

      operator: NotIn
      values:
      - canary
  reinvocationPolicy: Never
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    resources:
    - pods
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
---
# same webhook but with different name, will result in a duplicate
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration

    resources: ["*"]

  # Needed because status reporter sets the config map owner reference to the istiod pod
  - apiGroups: [""]
    verbs: ["update"]
    resources: ["pods/finalizers"]
{{- end }}
  - apiGroups: ["networking.istio.io"]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
    resources: [ "workloadentries" ]
  - apiGroups: ["networking.istio.io"]

defaults:
  global:

    # ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
    # to use for pulling any images in pods that reference this ServiceAccount.
    # Must be set for any cluster configured with private docker registry.
    imagePullSecrets: []

    # Used to locate istiod.
    istioNamespace: istio-system

    externalIstiod: false
    remotePilotAddress: ""

ingressService: istio-ingress
#
defaultConfig:
  # NOTE: If you change any values in this section, make sure to make
  # the same changes in start up args in istio-ingress pods.
  #
  # TCP connection timeout between Envoy & the application, and between Envoys.
  connectTimeout: 1s
  #
  ### ADVANCED SETTINGS #############

      namespace: {{ .namespace }}
      path: "/inject"
    {{- end }}
  sideEffects: None
  rules:
    - operations: [ "CREATE" ]
      apiGroups: [""]
      apiVersions: ["v1"]
      resources: ["pods"]
  failurePolicy: Fail
  admissionReviewVersions: ["v1beta1", "v1"]
{{- end }}

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: istio-revision-tag-default

mmafan.biz mn mn.it mn.us mo mo-i-rana.no mo-siemens.io mo.cn mo.it mo.us moareke.no mobara.chiba.jp mobi mobi.gp mobi.ke mobi.na mobi.ng mobi.tt mobi.tz mobile mochizuki.nagano.jp mock.pstmn.io mod.gi moda modalen.no modelling.aero modena.it modern.museum mods.jp modum.no moe moi moka.tochigi.jp mol.it molde.no molise.it mom moma.museum mombetsu.hokkaido.jp monash mond.jp money money.bj money.museum mongolian.jp monmouth.museum monster monticello.museum montreal.museum monza-brianza.it monza-e-della-brianza.it...

be 'config.env' ## # extraSecret: minio-extraenv networkPolicy: enabled: false allowExternal: true ## PodDisruptionBudget settings ## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ ## podDisruptionBudget: enabled: false maxUnavailable: 1 ## Specify the service account to use for the MinIO pods. If 'create' is set to 'false' ## and 'name' is left unspecified, the account 'default' will be used. serviceAccount: create: true ## The name of the service account to use. If 'create'...