verbs: ["get", "list", "watch", "update"]

  # istio configuration
  # removing CRD permissions can break older versions of Istio running alongside this control plane (https://github.com/istio/istio/issues/29382)
  # please proceed with caution
  - apiGroups: ["config.istio.io", "security.istio.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io", "telemetry.istio.io", "extensions.istio.io"]
    verbs: ["get", "watch", "list"]

	"sync"
	"time"

	cert "k8s.io/api/certificates/v1"
	clientset "k8s.io/client-go/kubernetes"

	meshconfig "istio.io/api/mesh/v1alpha1"
	"istio.io/istio/pkg/log"
	"istio.io/istio/security/pkg/k8s/chiron"
	"istio.io/istio/security/pkg/pki/ca"
	raerror "istio.io/istio/security/pkg/pki/error"
	"istio.io/istio/security/pkg/pki/util"
)

// KubernetesRA integrated with an external CA using Kubernetes CSR API

metadata:
  labels:
    app: istiod
    release: istio
  name: istiod
  namespace: istio-system

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: istio-reader
    release: istio
  name: istio-reader-clusterrole-istio-system
rules:
- apiGroups:
  - config.istio.io
  - security.istio.io
  - networking.istio.io
  - authentication.istio.io
  - rbac.istio.io

          optional: true
      - name: istio-kubeconfig
        secret:
          secretName: istio-kubeconfig
          optional: true
      # Optional: istio-csr dns pilot certs
      - name: istio-csr-dns-cert
        secret:
          secretName: istiod-tls
          optional: true
      - name: istio-csr-ca-configmap
        configMap:
          name: istio-ca-root-cert
          defaultMode: 420

    apiVersion: apps/v1
    kind: Deployment
    name: istio-ingressgateway

---


apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  labels:
    app: istiod
    install.operator.istio.io/owning-resource: unknown
    istio.io/rev: default
    operator.istio.io/component: Pilot
    release: istio
  name: istiod
  namespace: istio-system
spec:
  maxReplicas: 5
  metrics:
  - resource:

  * Istiod xDS server;
  * Istiod injection and validation webhook servers.

  The restrictions are not applied on the following data paths:
  * Istiod to Kubernetes API server;
  * JWK fetch from Istiod;
  * Wasm image and URL fetch from Istio Proxy containers;
  * ztunnel.

  Note that Istio injector will propagate the value of COMPLIANCE_POLICY to the

istio-bluelogo-whitebackground-unframed.svg...

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:
    internal.istio.io/gateway-semantics: gateway
    internal.istio.io/gateway-service: eastwestgateway-istio.istio-system.svc.domain.suffix
    internal.istio.io/parents: Gateway/eastwestgateway/istiod-grpc.istio-system
  creationTimestamp: null
  name: eastwestgateway-istio-autogenerated-k8s-gateway-istiod-grpc
  namespace: istio-system
spec:
  servers:
  - hosts:

      creationTimestamp: null
      labels:
        app: hello
        security.istio.io/tlsMode: istio
        service.istio.io/canonical-name: hello

      creationTimestamp: null
      labels:
        app: traffic
        security.istio.io/tlsMode: istio
        service.istio.io/canonical-name: traffic
        service.istio.io/canonical-revision: latest
    spec:
      containers:
      - image: fake.docker.io/google-samples/traffic-go-gke:1.0
        name: traffic