apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: istiod
    release: istio
  name: istiod-clusterrole-istio-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istiod-clusterrole-istio-system
subjects:
- kind: ServiceAccount
  name: istiod
  namespace: istio-system

---
apiVersion: rbac.authorization.k8s.io/v1

				"istio-pilot.istio-system.svc",
				"istiod-canary.istio-system.svc",
				"istiod-remote.istio-system.svc",
				"istiod.istio-system.svc",
				"istiod.istio-system.svc.cluster.local",
			},
		},
		{
			name:             "customHost has duplicate hosts with inner default",
			customHost:       "a.com,b.com,c.com,istiod",
			discoveryAddress: "istiod.istio-system.svc.cluster.local",
			revision:         "canary",

				"istiod, false, hybrid, true, envoy. The client fetching JWKs is as following: "+
				"istiod/false - Istiod; hybrid/true - Envoy and fallback to Istiod if JWKs server is external; "+
				"envoy - Envoy.",
		).Get()
		return jwt.ConvertToJwksFetchMode(v)
	}()

	// IstiodServiceCustomHost allow user to bring a custom address or multiple custom addresses for istiod server

		envoyBytes.WriteString(envoy)
	}
	istiodRouteDump, err := c.istiod.GetDynamicRouteDump(true)
	if err != nil {
		istiodBytes.WriteString(err.Error())
	} else {
		istiod, err := protomarshal.ToJSONWithAnyResolver(istiodRouteDump, "    ", &envoyResolver)
		if err != nil {
			return err
		}
		istiodBytes.WriteString(istiod)
	}
	diff := difflib.UnifiedDiff{
		FromFile: "Istiod Routes",
		A:        difflib.SplitLines(istiodBytes.String()),

	IstiodConnectionFailures = monitoring.NewSum(
		"istiod_connection_failures",
		"The total number of connection failures to Istiod",
	)

	// istiodDisconnections records total number of unexpected disconnections by Istiod.
	istiodDisconnections = monitoring.NewSum(
		"istiod_connection_terminations",
		"The total number of connection errors to Istiod",
	)

{{- if .Values.global.defaultPodDisruptionBudget.enabled }}
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Release.Namespace }}
  labels:
    app: istiod
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}

apiVersion: v1
kind: Service
metadata:
  labels:
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Pilot"
    app: istiod
    istio: pilot
    release: {{ .Release.Name }}
  name: istiod
  namespace: istio-system
spec:
  ports:
    - name: grpc-xds
      port: 15010
      protocol: TCP
    - name: https-dns
      port: 15012
      protocol: TCP

      - command: run
    deploy:
      helm:
        releases:
          - name: istiod
            remoteChart: istiod
            repo: https://istio-release.storage.googleapis.com/charts
            namespace: istio-system
---
apiVersion: skaffold/v2beta22
kind: Config
metadata:
  name: ingress
requires:
  - configs: [istiod]
profiles:
  - name: dev
    activation:
      - command: dev
    deploy:

spiffe://cluster.local/ns/istio-system/sa/istiod         Leaf     Available        true           e5dfb59150b2ba7f108d93dcec5aa613     2033-03-22T13:04:57Z     2023-03-21T13:02:57Z
spiffe://cluster.local/ns/istio-system/sa/istiod         Root     Available        false          8a516645c40ce76c2c0d27ab4e2461c1     2022-03-18T13:04:49Z     2022-03-21T13:04:49Z

    name: istio-ingressgateway

---


apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  labels:
    app: istiod
    install.operator.istio.io/owning-resource: unknown
    istio.io/rev: default
    operator.istio.io/component: Pilot
    release: istio
  name: istiod
  namespace: istio-system
spec:
  maxReplicas: 5
  metrics:
  - resource:
      name: cpu
      target: