apiVersion: v1
kind: ServiceAccount
{{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
{{- end }}
{{- end }}
metadata:
  name: istio-cni
  namespace: {{ .Release.Namespace }}
  labels:
    app: istio-cni
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" }}

  {{- end }}
{{- if .Values.global.ipFamilyPolicy }}
  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
{{- end }}
{{- if .Values.global.ipFamilies }}
  ipFamilies:
{{- range .Values.global.ipFamilies }}
  - {{ . }}
{{- end }}
{{- end }}
---

          "kubernetes": {
              "kubeconfig": "__KUBECONFIG_FILEPATH__",
              "cni_bin_dir": {{ .Values.cni.cniBinDir | default $defaultBinDir | quote }},
              "exclude_namespaces": [ {{ range $idx, $ns := .Values.cni.excludeNamespaces }}{{ if $idx }}, {{ end }}{{ quote $ns }}{{ end }} ]
          }

spec:
  replicas: 1
  revisionHistoryLimit: {{ .Values.deploymentHistory }}
  selector:
    matchLabels:
      name: istio-operator
  template:
    metadata:
      labels:
        name: istio-operator
        {{- range $key, $val := .Values.podLabels }}
        {{ $key }}: "{{ $val }}"
        {{- end }}
      annotations:
        prometheus.io/port: "{{ .Values.operator.monitoring.port }}"
        prometheus.io/scrape: "true"

      - "certificatesigningrequests/status"
    verbs: ["update", "create", "get", "delete", "watch"]
  - apiGroups: ["certificates.k8s.io"]
    resources:
      - "signers"
    resourceNames:
{{- range .Values.global.certSigners }}
    - {{ . | quote }}
{{- end }}
    verbs: ["approve"]
{{- end}}

  # Used by Istiod to verify the JWT tokens
  - apiGroups: ["authentication.k8s.io"]

                  You can list multiple ranges in a single pool, they will all share
                  the same settings. Each range can be either a CIDR prefix, or an
                  explicit start-end range of IPs.
                items:
                  type: string
                type: array
              autoAssign:
                default: true

nodeSelectorTerms: - matchExpressions: {{- if .global.arch }} - key: kubernetes.io/arch operator: In values: {{- range $key, $val := .global.arch }} {{- if gt ($val | int) 0 }} - {{ $key | quote }} {{- end }} {{- end }} {{- end }} {{- range $key, $val := $nodeSelector }} - key: {{ $key }} operator: In values: - {{ $val | quote }} {{- end }} {{- end }} {{- end }} {{- define "nodeAffinityPreferre" }} {{- range $key, $val := .global.arch }} {{- if gt ($val | int) 0 }} - weight: {{ $val | int }} preference: matchExpressions:...

      value: |
             {{ protoToJSON .ProxyConfig }}
    - name: ISTIO_META_POD_PORTS
      value: |-
        [
        {{- $first := true }}
        {{- range $index1, $c := .Spec.Containers }}
          {{- range $index2, $p := $c.Ports }}
            {{- if (structToJSON $p) }}
            {{if not $first}},{{end}}{{ structToJSON $p }}
            {{- $first = false }}
            {{- end }}

}} {{- end }} app.kubernetes.io/managed-by: {{ .Release.Service }} app.kubernetes.io/name: {{ include "gateway.name" . }} {{- range $key, $val := .Values.labels }} {{- if not (or (eq $key "app") (eq $key "istio")) }} {{ $key | quote }}: {{ $val | quote }} {{- end }} {{- end }} {{- end }} {{- define "gateway.podLabels" -}} {{ include "gateway.selectorLabels" . }} {{- range $key, $val := .Values.labels }} {{- if not (or (eq $key "app") (eq $key "istio")) }} {{ $key | quote }}: {{ $val | quote }} {{-...

  {{- end }}
{{- if .Values.global.ipFamilyPolicy }}
  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
{{- end }}
{{- if .Values.global.ipFamilies }}
  ipFamilies:
{{- range .Values.global.ipFamilies }}
  - {{ . }}
{{- end }}
{{- end }}
---