namespace: {{ .Release.Namespace }}
  labels:
{{ $gateway.labels | toYaml | trim | indent 4 }}
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "IngressGateways"
spec:
  minAvailable: 1
  selector:
    matchLabels:
{{ $gateway.labels | toYaml | trim | indent 6 }}

  labels:
{{ $gateway.labels | toYaml | trim | indent 4 }}
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "EgressGateways"
  {{- with $gateway.serviceAccount.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}

  namespace: {{ .Release.Namespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Pilot"
spec:
  maxReplicas: {{ .Values.pilot.autoscaleMax }}
  minReplicas: {{ .Values.pilot.autoscaleMin }}
  scaleTargetRef:

message DaemonSetUpdateStrategy {
  // Type of daemon set update. Can be "RollingUpdate" or "OnDelete". Default is RollingUpdate.
  // +optional
  optional string type = 1;

  // Rolling update config params. Present only if type = "RollingUpdate".
  // ---
  // TODO: Update this to follow our convention for oneOf, whatever we decide it
  // to be. Same as Deployment `strategy.rollingUpdate`.

h3. Plugins

* Execution model
* Metadata model
* Metadata tooling
 ** Metadata extractor
 ** Metadata reader
 ** Metadata writer
 ** Metadata adapter (if required for the target system)
* Maven packaging and lifecycle
* Maven test harness for plugin execution model
* Eclipse IDE tooling for plugin execution model and metadata model

- we also seem to have information like the plugin lifecycle model that's buried inside the maven execution model

        url = uri("https://repo.gradle.org/gradle/public")
        content {
            includeGroup("net.rubygrapefruit")
            includeModule("flot", "flot")
            includeModule("org.gradle", "gradle-tooling-api")
            includeModule("org.gradle.buildtool.internal", "configuration-cache-report")
            includeModule("org.gradle.buildtool.internal", "gradle-ide-starter")
        }
    }
    google {

latform..*||src:org.gradle.plugin.devel..*||src:org.gradle.plugin.use..*||src:org.gradle.plugin.management..*||src:org.gradle.plugins..*||src:org.gradle.process..*||src:org.gradle.testfixtures..*||src:org.gradle.testing.jacoco..*||src:org.gradle.tooling..*||src:org.gradle.swiftpm..*||src:org.gradle.model..*||src:org.gradle.testkit..*||src:org.gradle.testing..*||src:org.gradle.vcs..*||src:org.gradle.work..*||src:org.gradle.workers..*||src:org.gradle.util..*||src:org.gradle.kotlin.dsl.||src:org.gr...

    end
    Client--Plain-->CZ
    CZ-."HBONE (target)".->Server
    CZ--"HBONE (actual)"-->SZ
    SZ--Plain-->Server
```

### Pooling

User connections can be multiplexed over shared HBONE connections.
This is done through standard HTTP/2 pooling.
The pooling is keyed off the `{source identity, destination identity, destination ip}`.

### Headers

Ztunnel uses the following well-known headers in HBONE:

    {{- end }}
  labels:
{{ $gateway.labels | toYaml | indent 4 }}
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "EgressGateways"
spec:
{{- if $gateway.loadBalancerIP }}
  loadBalancerIP: "{{ $gateway.loadBalancerIP }}"
{{- end }}

metadata:
  name: {{ $gateway.name }}-sds
  namespace: {{ .Release.Namespace }}
  labels:
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "IngressGateways"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ $gateway.name }}-sds
subjects: