global:
  proxy:
    resources:
      requests:
        cpu: 10m
        memory: 40Mi

pilot:
  autoscaleEnabled: false
  traceSampling: 100
  resources:
    requests:
      cpu: 10m
      memory: 100Mi

gateways:
  istio-egressgateway:
    autoscaleEnabled: false
    resources:
      requests:
        cpu: 10m
        memory: 40Mi

    private static final String[] BINDINGS = {
        "process-resources",
                "org.apache.maven.plugins:maven-resources-plugin:" + RESOURCES_PLUGIN_VERSION + ":resources",
        "compile", "org.apache.maven.plugins:maven-compiler-plugin:" + COMPILER_PLUGIN_VERSION + ":compile",
        "process-test-resources",
                "org.apache.maven.plugins:maven-resources-plugin:" + RESOURCES_PLUGIN_VERSION + ":testResources",

message APIResourceDiscovery {
  // resource is the plural name of the resource.  This is used in the URL path and is the unique identifier
  // for this resource across all versions in the API group.
  // Resources with non-empty groups are located at /apis/<APIGroupDiscovery.objectMeta.name>/<APIVersionDiscovery.version>/<APIResourceDiscovery.Resource>

global:
  proxy:
    resources:
      requests:
        cpu: 10m
        memory: 40Mi

pilot:
  autoscaleEnabled: false
  traceSampling: 100
  resources:
    requests:
      cpu: 10m
      memory: 100Mi

gateways:
  istio-egressgateway:
    autoscaleEnabled: false
    resources:
      requests:
        cpu: 10m
        memory: 40Mi

    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Cni"
rules:
- apiGroups: [""]
  resources: ["pods","nodes","namespaces"]
  verbs: ["get", "list", "watch"]
{{- if (eq .Values.platform "openshift") }}
- apiGroups: ["security.openshift.io"]
  resources: ["securitycontextconstraints"]
  resourceNames: ["privileged"]
  verbs: ["use"]

  // Group is the API Group of the Resource.  "*" means all.
  // +optional
  optional string group = 3;

  // Version is the API Version of the Resource.  "*" means all.
  // +optional
  optional string version = 4;

  // Resource is one of the existing resource types.  "*" means all.
  // +optional
  optional string resource = 5;

  // Subresource is one of the existing resource types.  "" means none.
  // +optional

Istio reads from over 20 different resources types, and aggregates them together to build the proxy configuration. These resources can be sourced from Kubernetes (via watches), files, or over xDS; Kubernetes is by far the most common usage, though.

Primarily for historical reasons, ingestion is split into a few components.

#### ConfigStore

    private static final String[] BINDINGS = {
        "process-resources",
                "org.apache.maven.plugins:maven-resources-plugin:" + RESOURCES_PLUGIN_VERSION + ":resources",
        "compile", "org.apache.maven.plugins:maven-compiler-plugin:" + COMPILER_PLUGIN_VERSION + ":compile",
        "process-test-resources",
                "org.apache.maven.plugins:maven-resources-plugin:" + RESOURCES_PLUGIN_VERSION + ":testResources",

  </dependencies>
  <build>
    <resources>
      <resource>
        <directory>..</directory>
        <includes>
          <include>LICENSE</include> <!-- copied from the parent pom because I couldn't figure out a way to make combine.children="append" work -->
          <include>proguard/*</include>
        </includes>
        <targetPath>META-INF</targetPath>
      </resource>
    </resources>
    <plugins>
      <plugin>

  // the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
  // +optional
  repeated string apiGroups = 2;

  // Resources is a list of resources this rule applies to.  '*' represents all resources in the specified apiGroups.