//
// They are consumed by the kube-scheduler when a CSI driver opts into
// capacity-aware scheduling with CSIDriverSpec.StorageCapacity. The scheduler
// compares the MaximumVolumeSize against the requested size of pending volumes
// to filter out unsuitable nodes. If MaximumVolumeSize is unset, it falls back
// to a comparison against the less precise Capacity. If that is also unset,
// the scheduler assumes that capacity is insufficient and tries some other

		ObjectMeta: metav1.ObjectMeta{
			Name:        args.PodName,
			Namespace:   "default",
			Labels:      args.Labels,
			Annotations: args.Annotations,
		},
		Spec: corev1.PodSpec{
			NodeName: args.NodeName,
			Volumes:  nil,
			InitContainers: []corev1.Container{
				{
					Name: args.InitContainerName,
				},
			},
			Containers: []corev1.Container{
				{
					Name: "payload-container",
				},
			},
		},

        - mountPath: /etc/istio/proxy
          name: istio-envoy
        - mountPath: /var/run/secrets/tokens
          name: istio-token
        - mountPath: /etc/istio/pod
          name: istio-podinfo
      volumes:
      - emptyDir: {}
        name: workload-socket
      - emptyDir:
          medium: Memory
        name: istio-envoy
      - emptyDir:
          medium: Memory
        name: go-proxy-envoy

    - mountPath: /etc/certs/
      name: istio-certs
      readOnly: true
    {{- end }}
    - name: istio-podinfo
      mountPath: /etc/istio/pod
  volumes:
  - emptyDir: {}
    name: workload-socket
  - emptyDir: {}
    name: credential-socket
  {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
  - name: gke-workload-certificate
    csi:

            readOnly: true
          {{- end }}
          {{- end }}
{{- if $gateway.additionalContainers }}
{{ toYaml $gateway.additionalContainers | indent 8 }}
{{- end }}
      volumes:
      - emptyDir: {}
        name: workload-socket
      - emptyDir: {}
        name: credential-socket
      - emptyDir: {}
        name: workload-certs
{{- if eq .Values.global.pilotCertProvider "istiod" }}

        - mountPath: /etc/istio/proxy
          name: istio-envoy
        - mountPath: /var/run/secrets/tokens
          name: istio-token
        - name: istio-podinfo
          mountPath: /etc/istio/pod
      volumes:
      - emptyDir: {}
        name: workload-socket
      - emptyDir: {}
        name: credential-socket
      {{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
      - name: gke-workload-certificate

            value: "60m" # OVERRIDDEN
          - path: spec.template.spec.containers.[name:discovery].ports.[containerPort:8080].containerPort
            value: 8090 # OVERRIDDEN
          - path: 'spec.template.spec.volumes[100]' #push to the list
            value:
              configMap:
                name: my-config-map
              name: my-volume-name
          - path: 'spec.template.spec.containers[0].volumeMounts[100]'

  // mount option.
  //
  // When "true", the CSI driver must ensure that all volumes provided by this CSI
  // driver can be mounted separately with different `-o context` options. This is
  // typical for storage backends that provide volumes as filesystems on block
  // devices or as independent shared volumes.
  // Kubernetes will call NodeStage / NodePublish with "-o context=xyz" mount

  // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistent-volumes
  // +optional
  optional PersistentVolumeSpec spec = 2;

  // status represents the current information/status for the persistent volume.
  // Populated by the system.
  // Read-only.
  // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistent-volumes
  // +optional
  optional PersistentVolumeStatus status = 3;

{{/* This provides a minimal gateway, ready to be injected.
     Any settings from values.gateways should be here - these are options specific to the gateway.
     Global settings, like the image, various env vars and volumes, etc will be injected.
     The normal Deployment is not suitable for this, as the original pod spec will override the injection template. */}}
apiVersion: apps/v1
kind: Deployment
metadata: