metadata:
  labels:
    app: istiod
    release: istio
  name: istiod
  namespace: istio-system

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: istio-reader
    release: istio
  name: istio-reader-clusterrole-istio-system
rules:
- apiGroups:
  - config.istio.io
  - security.istio.io
  - networking.istio.io
  - authentication.istio.io
  - rbac.istio.io

          optional: true
      - name: istio-kubeconfig
        secret:
          secretName: istio-kubeconfig
          optional: true
      # Optional: istio-csr dns pilot certs
      - name: istio-csr-dns-cert
        secret:
          secretName: istiod-tls
          optional: true
      - name: istio-csr-ca-configmap
        configMap:
          name: istio-ca-root-cert
          defaultMode: 420

    apiVersion: apps/v1
    kind: Deployment
    name: istio-ingressgateway

---


apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  labels:
    app: istiod
    install.operator.istio.io/owning-resource: unknown
    istio.io/rev: default
    operator.istio.io/component: Pilot
    release: istio
  name: istiod
  namespace: istio-system
spec:
  maxReplicas: 5
  metrics:
  - resource:

  * Istiod xDS server;
  * Istiod injection and validation webhook servers.

  The restrictions are not applied on the following data paths:
  * Istiod to Kubernetes API server;
  * JWK fetch from Istiod;
  * Wasm image and URL fetch from Istio Proxy containers;
  * ztunnel.

  Note that Istio injector will propagate the value of COMPLIANCE_POLICY to the

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:
    internal.istio.io/gateway-semantics: gateway
    internal.istio.io/gateway-service: eastwestgateway-istio.istio-system.svc.domain.suffix
    internal.istio.io/parents: Gateway/eastwestgateway/istiod-grpc.istio-system
  creationTimestamp: null
  name: eastwestgateway-istio-autogenerated-k8s-gateway-istiod-grpc
  namespace: istio-system
spec:
  servers:
  - hosts:

      creationTimestamp: null
      labels:
        app: hello
        security.istio.io/tlsMode: istio
        service.istio.io/canonical-name: hello

      creationTimestamp: null
      labels:
        app: traffic
        security.istio.io/tlsMode: istio
        service.istio.io/canonical-name: traffic
        service.istio.io/canonical-revision: latest
    spec:
      containers:
      - image: fake.docker.io/google-samples/traffic-go-gke:1.0
        name: traffic

    - mountPath: /var/run/secrets/istio
      name: istiod-ca-cert
    - mountPath: /var/lib/istio/data
      name: istio-data
    - mountPath: /etc/istio/proxy
      name: istio-envoy
    - mountPath: /var/run/secrets/tokens
      name: istio-token
    - mountPath: /etc/istio/pod
      name: istio-podinfo
  initContainers:
  - args:
    - istio-iptables
    - -p
    - "15001"
    - -z

    - mountPath: /var/run/secrets/istio
      name: istiod-ca-cert
    - mountPath: /var/lib/istio/data
      name: istio-data
    - mountPath: /etc/istio/proxy
      name: istio-envoy
    - mountPath: /var/run/secrets/tokens
      name: istio-token
    - mountPath: /etc/istio/pod
      name: istio-podinfo
  initContainers:
  - args:
    - istio-iptables
    - -p
    - "15001"
    - -z

        readiness.status.sidecar.istio.io/periodSeconds: "200"
        sidecar.istio.io/status: '{"initContainers":["istio-init"],"containers":["istio-proxy"],"volumes":["workload-socket","credential-socket","workload-certs","istio-envoy","istio-data","istio-podinfo","istio-token","istiod-ca-cert"],"imagePullSecrets":null,"revision":"default"}'
        status.sidecar.istio.io/port: "123"
      creationTimestamp: null