{{ $vals = set $vals "pilot" $pilotVals -}}
{{ $vals | toPrettyJson | indent 4 }}

  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
  # and istiod webhook functionality.
  #
  # New fields should not use Values - it is a 'primary' config object, users should be able
  # to fine tune it or use it with kube-inject.
  config: |-

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
  - 31772
releaseNotes:
- |

apiVersion: release-notes/v2
kind: feature
area: installation
issue: []
releaseNotes:
- |

apiVersion: release-notes/v2
kind: feature
area: telemetry
releaseNotes:
- |

NAME       CLUSTER      CDS       LDS        EDS        RDS          ECDS         ISTIOD      VERSION
proxy1     cluster1     STALE     SYNCED     SYNCED     NOT SENT     NOT SENT     istiod1     1.20

apiVersion: release-notes/v2
kind: feature
area: installation
issue: []
releaseNotes:
- |

    "id": "sidecar~127.0.1.1~echo.test~cluster.local",
    "metadata": {
      "INSTANCE_IPS": "127.0.1.1",
      "PILOT_SAN": [
        "istiod.istio-system.svc"
      ],
      "GENERATOR": "grpc",
      "NAMESPACE": "test"
    },
    "localisty": {},
    "UserAgentVersionType": "istiov1"
  },
  "certificate_providers": {
    "default": {
      "plugin_name": "file_watcher",
      "config": {

Lin Sun <******@****.***> 1604706292 -0500

Frank Budinsky <******@****.***> 1629905327 -0400

		}
	}

	s.caServer.Register(grpc)

	log.Info("Istiod CA has started")
}

// detectAuthEnv will use the JWT token that is mounted in istiod to set the default audience
// and trust domain for Istiod, if not explicitly defined.
// K8S will use the same kind of tokens for the pods, and the value in istiod's own token is
// simplest and safest way to have things match.
//