bearerTokenSecret:
        name: {{ template "minio.fullname" . }}-prometheus
        key: token
      {{- end }}
  namespaceSelector:
    matchNames:
      - {{ .Release.Namespace | quote }}
  selector:
    matchLabels:
      app: {{ include "minio.name" . }}
      release: {{ .Release.Name }}
      monitoring: "true"
{{- end }}
{{- if .Values.metrics.serviceMonitor.enabled }}
---

.Values.consoleService.nodePort }} {{- else }} targetPort: {{ .Values.consoleService.port }} {{- end}} {{- if .Values.consoleService.externalIPs }} externalIPs: {{- range $i , $ip := .Values.consoleService.externalIPs }} - {{ $ip }} {{- end }} {{- end }} selector: app: {{ template "minio.name" . }} release: {{ .Release.Name }} minio/templates/deployment.yaml {{- if eq .Values.mode "standalone" }} {{ $scheme := "http" }} {{- if .Values.tls.enabled }} {{ $scheme = "https" }} {{ end }} {{ $bucketRoot := or ...

Instead, the opposite was chosen: each workload will list the policies that select it.
This works out to be more efficient in common cases where policies change much less often than workloads.
This only applies for selector-based policies; namespaced and global policies can be handled without needing to list them out in the Workload API.

## Redirection

// RuntimeClass.
message Scheduling {
  // nodeSelector lists labels that must be present on nodes that support this
  // RuntimeClass. Pods using this RuntimeClass can only be scheduled to a
  // node matched by this selector. The RuntimeClass nodeSelector is merged
  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

		"XDS Endpoint")
	cmd.PersistentFlags().StringVar(&o.CertDir, "cert-dir", viper.GetString("CERT-DIR"),
		"XDS Endpoint certificate directory")
	cmd.PersistentFlags().StringVar(&o.XdsPodLabel, "xds-label", "",
		"Istiod pod label selector")
	cmd.PersistentFlags().IntVar(&o.XdsPodPort, "xds-port", viper.GetInt("XDS-PORT"),
		"Istiod pod port")
	cmd.PersistentFlags().DurationVar(&o.Timeout, "timeout", time.Second*30,
		"The duration to wait before failing")

.Values.consoleService.nodePort }} {{- else }} targetPort: {{ .Values.consoleService.port }} {{- end}} {{- if .Values.consoleService.externalIPs }} externalIPs: {{- range $i , $ip := .Values.consoleService.externalIPs }} - {{ $ip }} {{- end }} {{- end }} selector: app: {{ template "minio.name" . }} release: {{ .Release.Name }} minio/templates/deployment.yaml {{- if eq .Values.mode "standalone" }} {{ $scheme := "http" }} {{- if .Values.tls.enabled }} {{ $scheme = "https" }} {{ end }} {{ $bucketRoot := or ...

.Values.consoleService.nodePort }} {{- else }} targetPort: {{ .Values.consoleService.port }} {{- end}} {{- if .Values.consoleService.externalIPs }} externalIPs: {{- range $i , $ip := .Values.consoleService.externalIPs }} - {{ $ip }} {{- end }} {{- end }} selector: app: {{ template "minio.name" . }} release: {{ .Release.Name }} minio/templates/deployment.yaml {{- if eq .Values.mode "standalone" }} {{ $scheme := "http" }} {{- if .Values.tls.enabled }} {{ $scheme = "https" }} {{ end }} {{ $bucketRoot := or ...

.Values.consoleService.nodePort }} {{- else }} targetPort: {{ .Values.consoleService.port }} {{- end}} {{- if .Values.consoleService.externalIPs }} externalIPs: {{- range $i , $ip := .Values.consoleService.externalIPs }} - {{ $ip }} {{- end }} {{- end }} selector: app: {{ template "minio.name" . }} release: {{ .Release.Name }} minio/templates/deployment.yaml {{- if eq .Values.mode "standalone" }} {{ $scheme := "http" }} {{- if .Values.tls.enabled }} {{ $scheme = "https" }} {{ end }} {{ $bucketRoot := or ...

.Values.consoleService.nodePort }} {{- else }} targetPort: {{ .Values.minioConsolePort }} {{- end}} {{- if .Values.consoleService.externalIPs }} externalIPs: {{- range $i , $ip := .Values.consoleService.externalIPs }} - {{ $ip }} {{- end }} {{- end }} selector: app: {{ template "minio.name" . }} release: {{ .Release.Name }} minio/templates/deployment.yaml {{- if eq .Values.mode "standalone" }} {{ $scheme := "http" }} {{- if .Values.tls.enabled }} {{ $scheme = "https" }} {{ end }} {{ $bucketRoot := or ...

.Values.consoleService.nodePort }} {{- else }} targetPort: {{ .Values.minioConsolePort }} {{- end}} {{- if .Values.consoleService.externalIPs }} externalIPs: {{- range $i , $ip := .Values.consoleService.externalIPs }} - {{ $ip }} {{- end }} {{- end }} selector: app: {{ template "minio.name" . }} release: {{ .Release.Name }} minio/templates/deployment.yaml {{- if eq .Values.mode "standalone" }} {{ $scheme := "http" }} {{- if .Values.tls.enabled }} {{ $scheme = "https" }} {{ end }} {{ $bucketRoot := or ...