Ztunnel additionally will handle the rotation of these certificates (typically 24hr expiration) as they approach expiry.

## Telemetry

127.0.0.1:15020                                  HEALTHY                  agent
10.244.0.156:9402                                HEALTHY                  outbound|9402||cert-manager-istio-csr-metrics.cert-manager.svc.cluster.local
10.244.0.156:6443                                HEALTHY                  outbound|443||cert-manager-istio-csr.cert-manager.svc.cluster.local

      return 1
      ;;
  esac

  # If metrics server configuration directory is specified then deploy in
  # the cluster just created
  if [[ -n ${METRICS_SERVER_CONFIG_DIR:-} ]]; then
    retry kubectl apply -f "${METRICS_SERVER_CONFIG_DIR}"
  fi

  # Install Metallb if not set to install explicitly
  if [[ -z "${NOMETALBINSTALL}" ]]; then

	}
	url := fmt.Sprintf("See %s\n", url.DeploymentRequirements)
	if !labels.HasCanonicalServiceName(objLabels) || !labels.HasCanonicalServiceRevision(objLabels) {
		fmt.Fprintf(writer, "deployment %q may not provide Istio metrics and telemetry labels: %q. "+url,
			fmt.Sprintf("%s/%s:", un.GetName(), un.GetNamespace()), objLabels)
	}
	return nil
}

// GetTemplateLabels returns spec.template.metadata.labels from Deployment

          - "!**/pkg/tracing/**"
        deny:
          - pkg: go.opentelemetry.io/otel
            desc: "do not use OpenTelemetry directly; use pkg/monitoring"
          - pkg: go.opentelemetry.io/otel/metric
            desc: "do not use OpenTelemetry directly; use pkg/monitoring"
      DenyProtobufV1:
        files:
          - $all
        deny:
          - pkg: github.com/golang/protobuf/ptypes

  # https://lyft.github.io/envoy/docs/operations/admin.html
  # for more details
  proxyAdminPort: 15000
  #
  # Zipkin trace collector
  zipkinAddress: ""
  #
  # Statsd metrics collector converts statsd metrics into Prometheus metrics.
  statsdUdpAddress: ""
  #
  # Mutual TLS authentication between sidecars and istio control plane.
  controlPlaneAuthPolicy: NONE
  #
  # Address where istio Pilot service is running

  {{ $prom := include "default-prometheus" . | eq "true" }}
  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
  {{- if or $prom $sdMetrics $sdLogs }}
    defaultProviders:
    {{- if or $prom $sdMetrics }}
      metrics:
      {{ if $prom }}- prometheus{{ end }}
      {{ if and $sdMetrics $sdLogs }}- stackdriver{{ end }}
    {{- end }}

        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /metrics
            port: monitoring
          initialDelaySeconds: 0
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        startupProbe:
          httpGet:
            path: /metrics
            port: monitoring
          initialDelaySeconds: 1
          periodSeconds: 1

        healthCheckConfig: {}
      healthStatus: HEALTHY
      loadBalancingWeight: 1
    locality: {}
  policy:
    overprovisioningFactor: 140
- clusterName: outbound|9402||cert-manager-istio-csr-metrics.cert-manager.svc.cluster.local
  endpoints:
  - lbEndpoints:
    - endpoint:
        address:
          socketAddress:
            address: 10.244.0.156
            portValue: 9402
        healthCheckConfig: {}

  minReplicas: {{ .Values.pilot.autoscaleMin }}
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: {{ .Values.pilot.cpu.targetAverageUtilization }}