kind: ConfigMap
metadata:
  name: istio-inject
  namespace: {ISTIO_NAMESPACE}
apiVersion: v1
data:
  config: |
    policy: enabled
    template: |-
      initContainers:
      - name: istio-init
        image: {PROXY_HUB}/proxy_init:{PROXY_TAG}
        args:
        - "-p"
        - {{ .MeshConfig.ProxyListenPort }}
        - "-u"
        - 1337
        imagePullPolicy: IfNotPresent
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
          privileged: true
        restartPolicy: Always
      - args:
        - -c
        #/etc/istio/proxy value here matches ConfigPathDir const in context.go
        - sysctl -w kernel.core_pattern=/etc/istio/proxy/core.%e.%p.%t && ulimit -c
          unlimited
        command:
        - /bin/sh
        image: alpine
        imagePullPolicy: IfNotPresent
        name: enable-core-dump
        resources: {}
        securityContext:
          privileged: true
      containers:
      - name: istio-proxy
        image: {PROXY_HUB}/proxy_debug:{PROXY_TAG}
        args:
        - proxy
        - sidecar
        - --configPath
        - {{ .ProxyConfig.ConfigPath }}
        - --binaryPath
        - {{ .ProxyConfig.BinaryPath }}
        - --serviceCluster
        {{ if ne "" (index .ObjectMeta.Labels "app") -}}
        - {{ index .ObjectMeta.Labels "app" }}
        {{ else -}}
        - "istio-proxy"
        {{ end -}}
        - --drainDuration
        - {{ formatDuration .ProxyConfig.DrainDuration }}
        - --parentShutdownDuration
        - {{ formatDuration .ProxyConfig.ParentShutdownDuration }}
        - --discoveryAddress
        - {{ .ProxyConfig.DiscoveryAddress }}
        - --discoveryRefreshDelay
        - {{ formatDuration .ProxyConfig.DiscoveryRefreshDelay }}
        - --zipkinAddress
        - {{ .ProxyConfig.ZipkinAddress }}
        - --connectTimeout
        - {{ formatDuration .ProxyConfig.ConnectTimeout }}
        - --statsdUdpAddress
        - {{ .ProxyConfig.StatsdUdpAddress }}
        - --proxyAdminPort
        - {{ .ProxyConfig.ProxyAdminPort }}
        - --controlPlaneAuthPolicy
        - {{ .ProxyConfig.ControlPlaneAuthPolicy }}
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        imagePullPolicy: IfNotPresent
        securityContext:
            privileged: true
            readOnlyRootFilesystem: false
            runAsUser: 1337
        restartPolicy: Always
        volumeMounts:
        - mountPath: /etc/istio/proxy
          name: istio-envoy
        - mountPath: /etc/certs/
          name: istio-certs
          readOnly: true
      volumes:
      - emptyDir:
          medium: Memory
        name: istio-envoy
      - name: istio-certs
        secret:
          optional: true
          {{ if eq .Spec.ServiceAccountName "" -}}
          secretName: istio.default
          {{ else -}}
          secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }}
          {{ end -}}
