party CA: ``` kubectl -n minio create secret generic minio-trusted-certs --from-file=keycloak.crt ``` The name of the generated secret can then be passed to Helm using a values file or the `--set` parameter: ``` trustedCertsSecret: "minio-trusted-certs" or --set trustedCertsSecret=minio-trusted-certs ``` ### Create buckets after install Install the chart, specifying the buckets you want to create after install: ```bash helm install --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false...

meshConfig:
  defaultConfig:
    proxyMetadata:
      ISTIO_META_ENABLE_HBONE: "true"
global:
  variant: distroless
pilot:
  env:
    PILOT_ENABLE_AMBIENT: "true"
    CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
cni:
  ambient:
    enabled: true

# Ztunnel doesn't use a namespace, so everything here is mostly for ztunnel

meshConfig:
  defaultConfig:
    proxyMetadata:
      ISTIO_META_ENABLE_HBONE: "true"
global:
  variant: distroless
pilot:
  env:
    PILOT_ENABLE_AMBIENT: "true"
    CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
cni:
  ambient:
    enabled: true

# Ztunnel doesn't use a namespace, so everything here is mostly for ztunnel

  env:
    PILOT_ENABLE_AMBIENT: "true"
    # Allow sidecars/ingress to send/receive HBONE. This is required for interop.
    PILOT_ENABLE_SENDING_HBONE: "true"
    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
    CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
platform: openshift
variant: distroless
seLinuxOptions:

  env:
    PILOT_ENABLE_AMBIENT: "true"
    # Allow sidecars/ingress to send/receive HBONE. This is required for interop.
    PILOT_ENABLE_SENDING_HBONE: "true"
    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
    CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
platform: openshift
variant: distroless
seLinuxOptions:

    serviceAnnotations: {}
    serviceAccountAnnotations: {}
    topologySpreadConstraints: []
    # You can use jwksResolverExtraRootCA to provide a root certificate
    # in PEM format. This will then be trusted by pilot when resolving
    # JWKS URIs.
    jwksResolverExtraRootCA: ""
    # This is used to set the source of configuration for
    # the associated address in configSource, if nothing is specified

    serviceAnnotations: {}
    serviceAccountAnnotations: {}

    topologySpreadConstraints: []

    # You can use jwksResolverExtraRootCA to provide a root certificate
    # in PEM format. This will then be trusted by pilot when resolving
    # JWKS URIs.
    jwksResolverExtraRootCA: ""

    # This is used to set the source of configuration for
    # the associated address in configSource, if nothing is specified

ISTIO_META_ENABLE_HBONE: "true" variant: distroless pilot: variant: distroless env: # Setup more secure default that is off in 'default' only for backwards compatibility VERIFY_CERTIFICATE_AT_CLIENT: "true" ENABLE_AUTO_SNI: "true" PILOT_ENABLE_HBONE: "true" CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel" PILOT_ENABLE_AMBIENT_CONTROLLERS: "true" cni: logLevel: info privileged: true ambient: enabled: true # Default excludes istio-system; its actually fine to redirect there since we opt-out istiod,...

trentinsudtirol.it trentinsued-tirol.it trentinsuedtirol.it trentinsüd-tirol.it trentinsüdtirol.it trento.it treviso.it trieste.it troandin.no trogstad.no troitsk.su trolley.museum tromsa.no tromso.no tromsø.no trondheim.no trust trust.museum trustee.museum trv try-snowplow.com trycloudflare.com trysil.no træna.no trøgstad.no ts.it ts.net tselinograd.su tsk.tr tsu.mie.jp tsubame.niigata.jp tsubata.ishikawa.jp tsubetsu.hokkaido.jp tsuchiura.ibaraki.jp tsuga.tochigi.jp tsugaru.aomori.jp tsuiki.fukuoka.jp...

  certSecret: ""
  publicCrt: public.crt
  privateKey: private.key

## Trusted Certificates Settings for MinIO. Ref: https://min.io/docs/minio/linux/operations/network-encryption.html#third-party-certificate-authorities
## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret