failurePolicy: Fail
    matchPolicy: Equivalent
    name: rev.namespace.sidecar-injector.istio.io
    namespaceSelector:
      matchLabels:
        istio.io/deactivated: never-match
    objectSelector:
      matchLabels:
        istio.io/deactivated: never-match
    reinvocationPolicy: Never
    rules:
      - apiGroups:
          - ""
        apiVersions:
          - v1
        operations:
          - CREATE

      protocol: TCP
  selector:
    app: istiod
    {{- if ne .Values.revision "" }}
    istio.io/rev: {{ .Values.revision | quote }}
    {{- else }}
    # Label used by the 'default' service. For versioned deployments we match with app and version.
    # This avoids default deployment picking the canary
    istio: pilot
    {{- end }}
  {{- if .Values.pilot.ipFamilyPolicy }}
  ipFamilyPolicy: {{ .Values.pilot.ipFamilyPolicy }}
  {{- end }}

env:
  GF_SECURITY_ADMIN_USER: "admin"
  GF_SECURITY_ADMIN_PASSWORD: "admin"
  GF_AUTH_BASIC_ENABLED: "false"
  GF_AUTH_ANONYMOUS_ENABLED: "true"
  GF_AUTH_ANONYMOUS_ORG_ROLE: Admin

# Expose on port 3000 to match the Istio docs
service:
  port: 3000

securityContext: null

# Set up out dashboards
dashboardProviders:
  dashboardproviders.yaml:
    apiVersion: 1
    providers:
      - name: "istio"

    # with golangci-lint call it on a directory with the changed file.
    check-exported: false
  gci:
    sections:
      - standard # Captures all standard packages if they do not match another section.
      - default # Contains all imports that could not be matched to another section type.
      - prefix(istio.io/) # Groups all imports with the specified Prefix.
  gocritic:
    # Disable all checks.