{{- if eq .Values.global.caName "GkeWorkloadCertificate" }}
        - name: gke-workload-certificate
          mountPath: /var/run/secrets/workload-spiffe-credentials
          readOnly: true
        {{- else }}
        - name: workload-certs
          mountPath: /var/run/secrets/workload-spiffe-credentials
        {{- end }}
        {{- if eq .Values.global.pilotCertProvider "istiod" }}

            - ALL
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /etc/ml_secret_key
          name: memberlist
          readOnly: true
        - mountPath: /etc/metallb
          name: metallb-excludel2
          readOnly: true
      hostNetwork: true
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: speaker
      terminationGracePeriodSeconds: 2

            mountPath: /var/run/secrets/tokens
            readOnly: true
          - name: local-certs
            mountPath: /var/run/secrets/istio-dns
          - name: cacerts
            mountPath: /etc/cacerts
            readOnly: true
          - name: istio-kubeconfig
            mountPath: /var/run/secrets/remote
            readOnly: true
          {{- if .Values.pilot.jwksResolverExtraRootCA }}

}} - name: istio-token mountPath: /var/run/secrets/tokens readOnly: true {{- end }} - name: local-certs mountPath: /var/run/secrets/istio-dns - name: cacerts mountPath: /etc/cacerts readOnly: true - name: istio-kubeconfig mountPath: /var/run/secrets/remote readOnly: true {{- if .Values.pilot.jwksResolverExtraRoo }} - name: extracacerts mountPath: /cacerts {{- end }} - name: istio-csr-dns-cert mountPath: /var/run/secrets/istiod/tls readOnly: true - name: istio-csr-ca-configmap mountPath: /var/run/secrets/istiod/ca...

{{- end }}
          - name: istio-token
            mountPath: /var/run/secrets/tokens
            readOnly: true
          {{- if .Values.global.mountMtlsCerts }}
          # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
          - name: istio-certs
            mountPath: /etc/certs
            readOnly: true
          {{- end }}
          - mountPath: /var/lib/istio/data
            name: istio-data

  CONDITIONAL_HOST_MOUNTS+="--mount type=bind,source=${HOME}/.docker,destination=/config/.docker,readonly "
fi

# gcloud conditional host mount (needed for docker push with the gcloud auth configure-docker)
if [[ -d "${HOME}/.config/gcloud" ]]; then
  CONDITIONAL_HOST_MOUNTS+="--mount type=bind,source=${HOME}/.config/gcloud,destination=/config/.config/gcloud,readonly "
fi

# gitconfig conditional host mount (needed for git commands inside container)

	// We do this by detecting the longest running process. We could look at `cmdline`, but is likely more reliable to weird platforms.
	for _, p := range procs {
		ns := getPidNamespace(p.PID)
		fd, err := unix.Open(ns, unix.O_RDONLY, 0)
		if err != nil {
			// Not uncommon, many processes are transient and we have a TOCTOU here.
			// No problem, must not be the one we are after.
			log.Debugf("failed to open pid %v: %v", p.PID, err)
			continue

              name: cni-bin-dir
            {{- if or .Values.cni.repair.repairPods .Values.cni.ambient.enabled }}
            - mountPath: /host/proc
              name: cni-host-procfs
              readOnly: true
            {{- end }}
            - mountPath: /host/etc/cni/net.d
              name: cni-net-dir
            - mountPath: /var/run/istio-cni
              name: cni-socket-dir

  // `/foo` would not allow `/food` or `/etc/foo`
  optional string pathPrefix = 1;

  // when set to true, will allow host volumes matching the pathPrefix only if all volume mounts are readOnly.
  // +optional
  optional bool readOnly = 2;
}

// Eviction evicts a pod from its node subject to certain policies and safety constraints.
// This is a subresource of Pod.  A request to cause such an eviction is