istio.io/dataplane-mode: none
        app: ztunnel
{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
      annotations:
        sidecar.istio.io/inject: "false"
{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
    spec:
      nodeSelector:
        kubernetes.io/os: linux
{{- if .Values.nodeSelector }}
{{ toYaml .Values.nodeSelector | indent 8 }}
{{- end }}
{{- if .Values.affinity }}

  volumeMounts: []

  # Additional volumes to the ztunnel pod
  volumes: []

  # Annotations added to each pod. The default annotations are required for scraping prometheus (in most environments).
  podAnnotations:
    prometheus.io/port: "15020"
    prometheus.io/scrape: "true"

  # Additional labels to apply on the pod level
  podLabels: {}

  # Pod resource configuration
  resources:
    requests:

    excludeNamespaces:
      - kube-system

    # Allows user to set custom affinity for the DaemonSet
    affinity: {}

    # Custom annotations on pod level, if you need them
    podAnnotations: {}

    # Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
    # Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case

securityContext:
  enabled: true
  runAsUser: 1000
  runAsGroup: 1000
  fsGroup: 1000
  fsGroupChangePolicy: "OnRootMismatch"
  readOnlyRootFilesystem: false

# Additational pod annotations
podAnnotations: {}

# Additional pod labels
podLabels: {}

## Configure resource requests and limits
## ref: http://kubernetes.io/docs/user-guide/compute-resources/
##
resources:
  requests:

.Values.ignoreChartChecksums }} checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} {{- end }} {{- if .Values.podAnnotations }} {{- toYaml .Values.podAnnotations | trimSuffix "\n" | nindent 8 }} {{- end }} spec: {{- if .Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" {{- end }} {{- if .Values.runtimeClassName }} runtimeClassName: "{{ .Values.runtimeClassName...

  k8s.io.api.core.v1.Affinity affinity = 20;

  // Additional annotations to apply to the istio-cni Pods.
  google.protobuf.Struct podAnnotations = 10 [deprecated = true];

  // PodSecurityPolicy cluster role. No longer used anywhere.
  string psp_cluster_role = 11;

	// Additional annotations to apply to the istio-cni Pods.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	PodAnnotations *structpb.Struct `protobuf:"bytes,10,opt,name=podAnnotations,proto3" json:"podAnnotations,omitempty"`
	// PodSecurityPolicy cluster role. No longer used anywhere.

    memory: {}
    # targetAverageUtilization: 80

    # Additional volumeMounts to the istiod container
    volumeMounts: []
    # Additional volumes to the istiod pod
    volumes: []
    nodeSelector: {}
    podAnnotations: {}
    serviceAnnotations: {}
    serviceAccountAnnotations: {}
    topologySpreadConstraints: []
    # You can use jwksResolverExtraRootCA to provide a root certificate

      # targetAverageUtilization: 80

    # Additional volumeMounts to the istiod container
    volumeMounts: []

    # Additional volumes to the istiod pod
    volumes: []

    nodeSelector: {}
    podAnnotations: {}
    serviceAnnotations: {}
    serviceAccountAnnotations: {}

    topologySpreadConstraints: []

    # You can use jwksResolverExtraRootCA to provide a root certificate